Does this keep you safe from USB killers?
Blocking Untrusted USB Devices
11–20 of 31 posts
Re: Blocking Untrusted USB Devices
#12From the manpage[1], you could also permanently allow a device by passing the "-p" option. usbguard allow-device -p [1]: https://github.com/USBGuard/usbguard/blob/master/doc/man/usb...
There is also usbguard-applet-qt, which I have found very helpful to navigate around the options. It also pops up a permission screen as soon as a device is plugged in.
Re: Blocking Untrusted USB Devices
#13Does this keep you safe from USB killers?
No. They just need 5v and increase it until it is high enough to blow something.
Re: Blocking Untrusted USB Devices
#14> But that didn't stop the Debian developers, who maintain that package, to allow USBGuard daemon to start with zero configuration
Ok so you might install it then lose HID access?
Sounds like a bad default config.
Re: Blocking Untrusted USB Devices
#15How immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
Since USB device ID's cannot be trusted by themselves couldn't some 2FA (eg USB security key) be used to authorize a device for as long as it stays connected?
Once a USB security key has been authorized and is kept on your person rather than constantly attached to your machine it should be impossible to connect a new device and have it trusted by default - and re-connecting an already connected device would de-authorize it.
Re: Blocking Untrusted USB Devices
#16What a nice security improvement, many thanks for developing this! It should be default in all operating systems to only accept known USB devices and in the case of new USB devices prompt the user with a clear warning message.
Re: Blocking Untrusted USB Devices
#17This sort of thing should be default in all operating systems, as a basic security feature. Sometimes, innovation comes from the Linux world...
How is this innovation? Imo Windows have this in Group Policy since Vista as well as specific DLP software.
Re: Blocking Untrusted USB Devices
#18How immune is this solution to VID / PID spoofing? I've thought about this topic before and arrived at the idea that USB devices ought to be treated kind of like user accounts, where I can control what drivers / data / devices they have access to.
Would it also not be possible to measure power draw upon the device and with that, add another metric to device profiling. So if you have say a keyboard that uses 200ma power and then suddenly a device that has the same ID's is plugged in and uses 500ma of power, that would trigger a flag.
Re: Blocking Untrusted USB Devices
#19What a nice security improvement, many thanks for developing this! It should be default in all operating systems to only accept known USB devices and in the case of new USB devices prompt the user with a clear warning message.
What if current input or output devices are broken so you can not prompt the user on them? What if they are broken in a such way that operation system does not know that they are broken, and you can not physically detach them because they are integrated? What if your user can not use their old output or input devices because they lost (some of) their sense(s) or limb(s)?
Re: Blocking Untrusted USB Devices
#20What a nice security improvement, many thanks for developing this! It should be default in all operating systems to only accept known USB devices and in the case of new USB devices prompt the user with a clear warning message.
What if current input or output devices are broken so you can not prompt the user on them? What if they are broken in a such way that operation system does not know that they are broken, and you can not physically detach them because they are integrated? What if your user can not use their old output or input devices because they lost (some of) their sense(s) or limb(s)?
Ideas:
"Type the following words on the newly connected keyboard."
"Move the newly connected mouse in the following directions, in order."