Blocking Untrusted USB Devices
roussos.cc
Blocking Untrusted USB Devices
1–10 of 31 posts
Re: Blocking Untrusted USB Devices
#2How immune is this solution to VID / PID spoofing?
I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
Re: Blocking Untrusted USB Devices
#3Pretty awesome. I wonder is there's something open source like this for macOS?
Re: Blocking Untrusted USB Devices
#4How immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
If the USB device can proffer a spoofed ID, there is no auth a-la PKI.
Maybe there is a USB controller where it is possible to turn off the data lanes and only keep the power ones active, but short of that, USBGuard had to trust the ID of the device.
Raspberry Pi Zero's USB controller, AFAIK, had the ability to present itself as a target, so that seems like a quick experiment.
Re: Blocking Untrusted USB Devices
#5How immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
If the USB device can proffer a spoofed ID, there is no auth a-la PKI. Maybe there is a USB controller where it is possible to turn off the data lanes and only keep the power ones active, but short of that, USBGuard had to trust the ID of the device. Raspberry Pi Zero's USB controller, AFAIK, had the ability to present itself as a target, so that seems like a quick experiment.
Thanks! One benefit of the approach I envisioned above is that even a perfect imposter would be restricted to the access rights I granted the original device.
Re: Blocking Untrusted USB Devices
#6Earlier quoted context omitted.
If the USB device can proffer a spoofed ID, there is no auth a-la PKI. Maybe there is a USB controller where it is possible to turn off the data lanes and only keep the power ones active, but short of that, USBGuard had to trust the ID of the device. Raspberry Pi Zero's USB controller, AFAIK, had the ability to present itself as a target, so that seems like a quick experiment.
Thanks! One benefit of the approach I envisioned above is that even a perfect imposter would be restricted to the access rights I granted the original device.
Take a look at USB Rubber Ducky or similar device(s). HackADay [1] [2] has a couple of write-ups about it and some associated tools.
[1]https://hackaday.com/2019/02/12/a-malicious-wifi-backdoor-in...
[2]https://hackaday.com/2014/10/05/badusb-means-were-all-screwe...
Re: Blocking Untrusted USB Devices
#7Pretty awesome. I wonder is there's something open source like this for macOS?
Not open source but more generic in it's approach https://www.quora.com/How-can-I-stop-people-from-hacking-my-...
Re: Blocking Untrusted USB Devices
#8From the manpage[1], you could also permanently allow a device by passing the "-p" option.
usbguard allow-device -p
Re: Blocking Untrusted USB Devices
#9This sort of thing should be default in all operating systems, as a basic security feature. Sometimes, innovation comes from the Linux world...
Re: Blocking Untrusted USB Devices
#10Pretty awesome. I wonder is there's something open source like this for macOS?
Why would you want something open source? You’re running a closed source OS that prevents you from making things like this.