4 ms·

Can we have a usb condom for this situation? The actual product called "usb condom" is about charging phones and blocking all data pins on the usb drive. Can we

by jordigh 11y ago

Can we have a usb condom for this situation? The actual product called "usb condom" is about charging phones and blocking all data pins on the usb drive. Can we have one that will only allow devices to connect as mass storage devices, or is this at odds with the usb protocol?

_yy 11y ago
That would require an active intermediary, but yes, it should be possible.
gchadwick 11y ago
I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.
- gchadwick 11y ago
  Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?
  - nitrogen 11y ago
    USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
  - zxv 11y ago
    USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.
    - dfox 11y ago
      Various devices tend to either have serial number empty (for example both my keyboard and mouse, Sun and Logitech respectively, so not exactly cheap Chinese crap) or filled with some random garbage that is not unique at all ("123456", "Serial" and so on). One would assume that "garbage in iSerial" is workaround for Windows' behavior of identifying devices by either it's serial or physical port and requiring distinct driver registrations for devices that are "different" according to this logic.
      - the8472 11y ago
        it might still be useful to filter based on type. if you expect a mass storage device you don't want it to register as input device.
    - okasaki 11y ago
      You can do something like this with grsecurity. It's not a whitelist but you can deny any new usb devices after you toggle a switch: If you say Y here, a new sysctl option with name "deny_new_usb" will be created. Setting its value to 1 will prevent any new USB devices from being recognized by the OS. Any attempted USB device insertion will be logged. This option is intended to be used against custom USB devices designed to exploit vulnerabilities in various USB device drivers.
  - IshKebab 11y ago
    Simple: You don't have to confirm the first mouse and keyboard.
    - jfoutz 11y ago
      Is the order deterministic? More to the point, if i leave a bad USB stick plugged in, how do i guarantee my keyboard gets the free pass rather than the evil stick?
      - PeterisP 11y ago
        The OS can know that you had the same keyboard (the same ID) plugged in for the whole last year at the same socket, but the new 'keyboard' is plugged in that socket where you usually plug in random USB data storage devices.
- mschuster91 11y ago
  > I wonder if you actually need a hardware device for this? Yes. Bugs in the kernel part parsing the USB descriptors IIRC were one of the avenues in PS3 jailbreaking.
- toyg 11y ago
  Users will just click yes, or whichever default for "just make it work" you choose. Advanced protection/admin features left to consumers simply don't work, I thought we understood that by now. You must have something that will intelligently handle them on its own (e.g. heuristic AVs, smart firewalls etc). Because there is no way for a system to say "well, this looks like a storage device, but it's telling me it's an input one, something is fishy", you're just going to have a whitelist nobody really uses, like IE's "trusted sites" zones.
captainmuon 11y ago
I was thinking about this. I tinkered a bit with the usb (OTG) drivers on linux. But I don't have the skills to create a hardware device from scratch. It would be great if there was a simple device that had two USB chips and that you could program, something like a raspberry PI or a smartphone. (Actually, many smartphones can be used as a USB host as well as a device, but not at the same time.) Does anybody know if some platform like this exists? I heard you could do it with the BeagleBone?
- dezgeg 11y ago
  The Intel Galileo has one host port and one device port and runs Linux. In my project I was able to relay enough USB packets to support USB keyboards and mice successfully. It isn't too expensive either.
elektromekatron 11y ago
A raspberry pi could probably do this quite well.
knorby 11y ago
Would any such countermeasure really be worth it to use random 8GB USB drives from conferences? They are so cheap, and I have a hard time believing this would ever be better than simply not using these ever.
- URSpider94 11y ago
  A lot of conferences are only distributing their symposium notes this way now. So, if you want to read the notes, you need to use the USB key.
- PeterisP 11y ago
  They're distributed because people need/want to access the data that way. It's a somewhat efficient way to distribute a gigabyte of data to a hundred people so that they all have access to it now despite all sharing a lousy wifi at a conference center.
cbhl 11y ago
A basic version of this already exists from Monoprice: http://www.monoprice.com/product?p_id=13166 http://www.monoprice.com/product?p_id=13166 Plug in a microUSB device and it can only charge; you have to hit the button in order to enable the data pins. But I think this is designed for risks going the other way, i.e. to protect your cell phone from data-scraping USB-A female ports in airports and the like.

by jordigh 11y ago

_yy 11y ago

That would require an active intermediary, but yes, it should be possible.

gchadwick 11y ago

I wonder if you actually need a hardware device for this? Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.

gchadwick 11y ago
Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!). Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs. Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?
- nitrogen 11y ago
  USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).
- zxv 11y ago
  USB firewall. White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.
  - dfox 11y ago
    Various devices tend to either have serial number empty (for example both my keyboard and mouse, Sun and Logitech respectively, so not exactly cheap Chinese crap) or filled with some random garbage that is not unique at all ("123456", "Serial" and so on). One would assume that "garbage in iSerial" is workaround for Windows' behavior of identifying devices by either it's serial or physical port and requiring distinct driver registrations for devices that are "different" according to this logic.
    - the8472 11y ago
      it might still be useful to filter based on type. if you expect a mass storage device you don't want it to register as input device.
  - okasaki 11y ago
    You can do something like this with grsecurity. It's not a whitelist but you can deny any new usb devices after you toggle a switch: If you say Y here, a new sysctl option with name "deny_new_usb" will be created. Setting its value to 1 will prevent any new USB devices from being recognized by the OS. Any attempted USB device insertion will be logged. This option is intended to be used against custom USB devices designed to exploit vulnerabilities in various USB device drivers.
- IshKebab 11y ago
  Simple: You don't have to confirm the first mouse and keyboard.
  - jfoutz 11y ago
    Is the order deterministic? More to the point, if i leave a bad USB stick plugged in, how do i guarantee my keyboard gets the free pass rather than the evil stick?
    - PeterisP 11y ago
      The OS can know that you had the same keyboard (the same ID) plugged in for the whole last year at the same socket, but the new 'keyboard' is plugged in that socket where you usually plug in random USB data storage devices.
mschuster91 11y ago
> I wonder if you actually need a hardware device for this? Yes. Bugs in the kernel part parsing the USB descriptors IIRC were one of the avenues in PS3 jailbreaking.
toyg 11y ago
Users will just click yes, or whichever default for "just make it work" you choose. Advanced protection/admin features left to consumers simply don't work, I thought we understood that by now. You must have something that will intelligently handle them on its own (e.g. heuristic AVs, smart firewalls etc). Because there is no way for a system to say "well, this looks like a storage device, but it's telling me it's an input one, something is fishy", you're just going to have a whitelist nobody really uses, like IE's "trusted sites" zones.

captainmuon 11y ago

I was thinking about this. I tinkered a bit with the usb (OTG) drivers on linux. But I don't have the skills to create a hardware device from scratch. It would be great if there was a simple device that had two USB chips and that you could program, something like a raspberry PI or a smartphone. (Actually, many smartphones can be used as a USB host as well as a device, but not at the same time.) Does anybody know if some platform like this exists? I heard you could do it with the BeagleBone?

dezgeg 11y ago
The Intel Galileo has one host port and one device port and runs Linux. In my project I was able to relay enough USB packets to support USB keyboards and mice successfully. It isn't too expensive either.

elektromekatron 11y ago

A raspberry pi could probably do this quite well.

knorby 11y ago

Would any such countermeasure really be worth it to use random 8GB USB drives from conferences? They are so cheap, and I have a hard time believing this would ever be better than simply not using these ever.

URSpider94 11y ago
A lot of conferences are only distributing their symposium notes this way now. So, if you want to read the notes, you need to use the USB key.
PeterisP 11y ago
They're distributed because people need/want to access the data that way. It's a somewhat efficient way to distribute a gigabyte of data to a hundred people so that they all have access to it now despite all sharing a lousy wifi at a conference center.

cbhl 11y ago

A basic version of this already exists from Monoprice: http://www.monoprice.com/product?p_id=13166 http://www.monoprice.com/product?p_id=13166 Plug in a microUSB device and it can only charge; you have to hit the button in order to enable the data pins. But I think this is designed for risks going the other way, i.e. to protect your cell phone from data-scraping USB-A female ports in airports and the like.