I have to centralize logs collection from many different widespread computers on which I can only plug USB flash drives. Those computers should not be reachable from the network in any case to prevent any network attack.

It must be hardware-level secured by design for the host computers against remote access (the logging system could crash but the host computers could not be compromised in any case) and I should be able to prove it. USB flash drives are the only authorized devices for security and certification reasons (even if a USB flash drive could still be infected :( ). So I don't have much choice.

I thought about designing a device acting as a USB flash drive on one side linked to an Ethernet interface on the other side. Any log written on the USB flash drive would be pushed to the Ethernet module, the Ethernet module would automatically send any incoming data to a target IP (centralized data logging system). The link between the USB and Ethernet module would be simplex (hardware design) so that no attack on the Ethernet module could compromise the USB flash drive connected on each computer.

I posted a similar question on https://electronics.stackexchange.com/questions/209885/secured-centralized-logs-collection-through-usb-flash-drives but we didn't come up with a solution maybe because I proposed an over engineered solution.

There might be a much simpler solution. I must find a cost effective solution with proven security guarantees (host computer unreachable even if USB module is compromised)

Thanks a lot for your help

PS: I cannot use the serial interface (which could have been a good solution)

  • Your goals are a bit misguided. Stop thinking about guaranteed security and you will find solutions that do this to almost any risk appetite level. – Rory Alsop Jan 8 '16 at 8:05

First of all, 100% security is a myth and is something you should never claim or promise.

If I were in a situation where there are multiple hosts that are not connected to a network, I would consider the following things:

  1. Create an internal (management) LAN for all hosts.
  2. HIPS / HIDS - Host-based Intrusion Prevention/Detection System.
  3. Secure the hosts by iptables (e.g. do not allow incoming connections).
  4. Harden the hosts.
  5. Centralized log server.
  6. Physical disable USB ports / card readers.
  7. Implement Network Access Control (NAC).
  8. Security Event Monitoring.

Be aware that when someone has physical access to any Linux machine, the machine could be compromised quite easy by booting into run level 1 (single user mode) and reset the root password.

  • Totally agree that 100% security is a myth, I wanted to highlight that I wanted real guarantees on the host computer against any remote access. To me, software security is always hackable, hardware security (ie. optical isolation) is much harder and is easier to prove. – doxav Jan 8 '16 at 7:38
  • you're suggestion is ok. It's already the way I will go but I need to provide more guarantees on the computer side. My only open door to get data from those computers is to use a USB storage, and, I shouldn't open any security breach on those computers by this mean. – doxav Jan 8 '16 at 7:59
  • This problem has been solved for environments with extremely high security requirements - using mechanisms that Jeroen has mentioned. USB is typically not used as it introduces more vulnerabilities than it fixes. – Rory Alsop Jan 8 '16 at 8:03
  • @RoryAlsop yes, using USB flash drive is already a security breach but it is the certified mean and I should use it without bringing more vulnerabilities especially remote access. Sneakernet brings an extremely high security level but I need to get those data from many computers in (near) real-time so not the way to go. I need to find an effective way to export data via USB storage to a network which can only go one-way with hardware guarantees. – doxav Jan 8 '16 at 10:09

Wouldn't connecting the USB via Ethernet violate the rule that the system should not be connected to the network? You could split hairs that the network services are not reachable, only the USB interface. Regardless, if the data stored there is important enough, someone will find a way in. The way you describe the problem sounds like you are trying to justify a workaround, but the problem statement itself is not really clear.

If USB is the only way to collect the logs, then sadly you will have to rely on manual work and sneakernet. A couple of shell scripts can help you to automate some of it, but it won't remove the need from physically going to the computer.

  • But you could unmount the USB device from a scripting language. – Jeroen Jan 8 '16 at 6:26
  • If I provide a module with optical isolation (logs > USB storage > one way TX with optical isolator > Ethernet), I don't know how it could go the other way. But I'm trying to find an easier way but still 100% secured for the host computers – doxav Jan 8 '16 at 6:28

The USB approach is not scalable and not even secure. You can use the latest practice of central log server using the ELK stack.

E => ElasticSearch : Log storage and indexing (Searchable)

L => LogStash: Filter the incoming logs according to your requirements

K => Kibana: Web interface that integrates with ElasticSearch

You Can secure access to Elastic Search by running it on non routable private IP , with Https , and strong authentication.

  • The USB is the only door to remotely access data of each computer in my case. It doesn't prevent to use an ELK stack at all. It is not at the same level. My need is to setup the data collection without opening any security breach to access the computers – doxav Jan 8 '16 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.