5 ms·
Blocking Untrusted USB Devices
- rkagerer 7y agoHow immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
- T3OU-736 7y agoIf the USB device can proffer a spoofed ID, there is no auth a-la PKI. Maybe there is a USB controller where it is possible to turn off the data lanes and only keep the power ones active, but short of that, USBGuard had to trust the ID of the device. Raspberry Pi Zero's USB controller, AFAIK, had the ability to present itself as a target, so that seems like a quick experiment.
- rkagerer 7y agoThanks! One benefit of the approach I envisioned above is that even a perfect imposter would be restricted to the access rights I granted the original device.
- T3OU-736 7y agoTake a look at USB Rubber Ducky or similar device(s). HackADay [1] [2] has a couple of write-ups about it and some associated tools. [1]https://hackaday.com/2019/02/12/a-malicious-wifi-backdoor-in-a-keyboards-clothing/ https://hackaday.com/2019/02/12/a-malicious-wifi-backdoor-in... [2]https://hackaday.com/2014/10/05/badusb-means-were-all-screwed/ https://hackaday.com/2014/10/05/badusb-means-were-all-screwe...
- daxterspeed 7y agoSince USB device ID's cannot be trusted by themselves couldn't some 2FA (eg USB security key) be used to authorize a device for as long as it stays connected? Once a USB security key has been authorized and is kept on your person rather than constantly attached to your machine it should be impossible to connect a new device and have it trusted by default - and re-connecting an already connected device would de-authorize it.
- Zenst 7y agoWould it also not be possible to measure power draw upon the device and with that, add another metric to device profiling. So if you have say a keyboard that uses 200ma power and then suddenly a device that has the same ID's is plugged in and uses 500ma of power, that would trigger a flag.
- Ajedi32 7y agoGood idea. Though that can also be bypassed rather easily by including a small battery in the malicious device and only drawing the expected amount of power from the USB connection itself. The real solution needs to be some sort of standardized auth system, where devices are identified by a public key rather than a static serial number. In the absence of that though, I think whitelisting serial numbers is the next best thing. It'll slow down attacks at least, and open the door for future improvements to the system.
- rasz 7y agoCurrently deployed hardware has no ability to measure that.
- Zenst 7y agoYes it does: lsusb -v upon linux shows exactly that information. Not sure upon windows flavours of doing that beyond gui digging some properties, but the values are in there.
- rasz 7y agoSadly the number you are thinking about is self reported by the device - it is required by the spec to report its bMaxPower in USB Configuration Descriptor. This field is merely a convenience and a promise. http://dangerousprototypes.com/docs/Designing_USB_Devices_for_proper_current_and_MaxPower http://dangerousprototypes.com/docs/Designing_USB_Devices_fo...
- Zenst 7y agoAha, my humble apologies for my confusions, appreciate being educated. I learned something today, thank you.
- rasz 7y agoIts not. Whats more attackers USB device is able to obtain quite a lot of insight about the host from enumeration alone - operating system, state of the system (boot/fully working etc), configuration (enabled/disabled autostart etc). Its not infeasible for an attacker to keep trying new VID/PID pairs until detecting successful enumeration.
- cerberusss 7y agoPretty awesome. I wonder is there's something open source like this for macOS?
- a_bell 7y agoNot open source but more generic in it's approach https://www.quora.com/How-can-I-stop-people-from-hacking-my-Mac-with-devices-like-BadUSB-and-the-O-MG-cable/answer/iBoostUp https://www.quora.com/How-can-I-stop-people-from-hacking-my-...
- isostatic 7y agoWhy would you want something open source? You’re running a closed source OS that prevents you from making things like this.
- SomeOldThrow 7y agoI don’t follow.
- mindfulhack 7y agoThis sort of thing should be default in all operating systems, as a basic security feature. Sometimes, innovation comes from the Linux world...
- tooop 7y agoHow is this innovation? Imo Windows have this in Group Policy since Vista as well as specific DLP software.
- SomeOldThrow 7y agoLast I checked Linux doesn’t do this by default either.
- oakslab 7y agoFrom the manpage[1], you could also permanently allow a device by passing the "-p" option. usbguard allow-device -p <id> [1]: https://github.com/USBGuard/usbguard/blob/master/doc/man/usbguard.1.adoc https://github.com/USBGuard/usbguard/blob/master/doc/man/usb...
- regecks 7y agoThere is also usbguard-applet-qt, which I have found very helpful to navigate around the options. It also pops up a permission screen as soon as a device is plugged in.
- voiper1 7y agoDoes this keep you safe from USB killers?
- steve19 7y agoNo. They just need 5v and increase it until it is high enough to blow something.
- raverbashing 7y ago> But that didn't stop the Debian developers, who maintain that package, to allow USBGuard daemon to start with zero configuration Ok so you might install it then lose HID access? Sounds like a bad default config.
- yrro 7y agoI I stalled it on my Debian machine this morning. The daemon was not started by default.
- acd 7y agoWhat a nice security improvement, many thanks for developing this! It should be default in all operating systems to only accept known USB devices and in the case of new USB devices prompt the user with a clear warning message.
- anonymfus 7y agoWhat if current input or output devices are broken so you can not prompt the user on them? What if they are broken in a such way that operation system does not know that they are broken, and you can not physically detach them because they are integrated? What if your user can not use their old output or input devices because they lost (some of) their sense(s) or limb(s)?
- heinrich5991 7y agoIdeas: "Type the following words on the newly connected keyboard." "Move the newly connected mouse in the following directions, in order."
- WengerPen 7y agoIt is a tricky area to add layers of security to. In theory, you would want a device to refuse any connections unless it is explicitly agreed upon. At the same time, you average user will start calling Tech support everytime they hit the road block of "not being able to use the USB". In orgs with sensitive info, it should be mandatory, but others may be better off without it.
- SomeOldThrow 7y agoThis is exactly why businesses make software that ends up sucking.