Allow only specific devices to be connected to USB

Question

Suppose I have a Windows PC in a safe room, disconnected from the internet, with only 3 cables connecting to another room, to a mouse, monitor and keyboard.

The computer contains highly sensitive data. The HDMI monitor cable is no problem, but the mouse and keyboard cables are USB cables, and could be connected to some USB drive. I am specifically interested here in securing the USB cables. Please disregard other ways of stealing information, like taking photos of the screen etc.

My question is: How can I make sure only some specific mouse and keyboard are allowed to be connected to the USB cables?

• For example, is there some kind of hardware I can put between the USB cable and the computer to make sure only some allowed device is connected to it? Security KVM Switches (Keyboard-Video-Monitor switches) are not good because in practice all of them seem to introduce some small delay (lag, or latency) when moving the mouse or typing. It really must feel as if you are directly connected (no lag whatsoever). Maybe there are some Arduino, BasicX, Parallax, Pololu, or Raspberry Pi projects out there to filter USB communication and let through only allowed devices, with no lag?

• I know there is software to do that (e.g.: https://support.symantec.com/en_US/article.TECH175220.html) but since the user is using the computer he could disable it.

Answer 1

Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector).

They have logic and cost about $10 USD at time of writing.

Then buy USB to PS2 adapters for both mice and keyboard (separate adapters).

They have no logic, just internal wiring to each connection and they cost less than $5 USD at time of writing.

Put them altogether. Yes, it looks funky, but the devices will still work as-expected. Now, even if one of the user-reachable cables is spliced, they can't add new hardware other than generic mice and keyboards.

Nice things about this:

• cheap
• simple
• hardware-implemented
• protects against unknown devices
• OS-independent

UPDATE: I manually verified, twice, that there is no continuity between USB's data-/data+ pins and the PS2 data/clk pins (or any other ps2 pins) on a two-in-one adapter. There is continuity on single-port adapters though, but that's not important as long as one of the adapters implements some kind of logic like the two-in-one does. Plugging in the empty adapter to a windows box should cause the "USB insertion ding"; otherwise it's a naive physical adapter.

The dual PS2-USB adapter I specifically tested was an "ez-pu21", available still on amazon.

UPDATE #2, 2 things:

• there are usb keyboard attacks, so you need to lock down the OS properly to maintain security.
• one can get inside bios with a keyboard, and i'm not sure how risky that is to exfiltration, or if all they can do is "break" the computer.

UPDATE#3: After using the double-inline adapters for about 24 hours, I can say they work, but not quite 100%, maybe 99%. When I was doing serious programming (typing) I noticed that keys held down for about 1/3rd of a second repeat. This is before my typematic repeat about 2/3rds a second after press, and it only repeats once; leading to stuff like "biig" instead of "big". I only noticed it a few times, late at night, but I wanted to mention it. I didn't even notice it until after hours of use, but if you were writing a novel, it might be frustrating. It could just be the cheap adapter i used, the really long cables i'm using or something else nobody will experience.

BONUS: (related but OT): I just realized these cheap usb switches don't connect the data pins, they are too cheap to switch all 4 wires, thus making a cheap "USB condom" for those who desire such a thing, thought i'd share. cheap condoms, how can you go wrong?

Answer 2

You are taking the wrong side of the problem. If someone you do not trust can access to a machine, the machine has been compromised. Full stop.

That's the reason why access to server rooms is highly controlled, and why admin normally do not care for the physical security of the connectors: the defense line is not at the connector level but at the room containing the machine.

That being said, you can imagine special USB drivers that only allow specific hardware ids. You simply cannot install them by default when installing a kernel on a new machine because of a chicken and egg problem, but after an initial installation, you can build a custom kernel with those special USB drivers. But as there are plenty other possibilities to compromise a machine when you have physical access to it, it is simply IMHO a waste of time and energy...

And anyway, nothing prevent an evil powerful organization to build a specific USB keyboard that presents itself with the ID and the apparence of a innocent keyboard from a well known hardware manufacturer but that contains a keylogger. If you do not trust your admin, he could replace the keyboard at a system reboot. As I have already said, if an evil guy could touch the machine it is compromised, and if he could not you should not worry about the USB connectors.

Answer 3

On Windows systems, you've been able to block or restrict USB devices through Local or Group Policy since at least Windows Vista. By setting the "Removable Storage Access" policies, you can disable the attachment of USB storage devices (that category includes a lot of nefarious USB devices). These settings block Windows from interacting with the devices because it prevents loading the services.

https://community.spiceworks.com/how_to/25619-blocking-usb-devices-and-removable-media https://technet.microsoft.com/en-us/library/2007.06.grouppolicy.aspx

Answer 4

Just use a PS/2 keyboard and mouse.

Don't bother with adapters and other sorts of hardware condoms. There are still lots of mainboards available that have PS/2 mouse and keyboard connectors.

Answer 5

Clarification request: what attacks are you concerned about? By your remark about not worrying about photos of the screen, I take it you don't want data injected into the system, and don't care about ANY exfiltration of data.

So, how can we attack your system, and what can be done about it?

USB attacks & mitigation

As noted by others, stay FAR away from USB. The operating system CANNOT protect from all attacks. Nohl et al demonstrated in 2014 how to attack the USB host microcontroller firmware, and their attack, named BadUSB was shown to be usable even while the system was sitting in the BIOS after rebooting.

After the USB host microcontrollers are compromised, a malicious payload could conceivably muck on the PCI bus to modify or snoop memory.

Can these attacks be avoided or mitigated? YES! There is at least one USB hardware firewall device on the market, the USG, that was explicitly designed to combat the BadUSB attack. It still won't deal with untrusted keyboard input.

Untrusted keyboard inputs, USB & PS/2:

The PS/2 cabling suggested by others is also a strong contender, but there's no reason a device couldn't be added to inject all the needed keystrokes & mouse movements to attack your system (eg: open notepad or anything that lets me enter characters, inject needed binary characters to form a program, save as .exe, run!). Even BadUSB can't combat that.

HDMI attacks & mitigation

You're allowing an HDMI cable to be connected? There's been at least one remark by a security research (Dragos Ruiu) that this can allow Ethernet-over-HDMI to be used to infect the restricted system.

The mitigation here is simple: make sure you use a HDMI cable without the ethernet bits, but watch out for DDC...

DDC video attacks:

To be fair, even VGA allowed digital transfer via bidirectional DDC communication (as did DVI), so that has a potential for exploitation; but it's much less likely to be used. It's not uncommon to upgrade firmware in monitors via the DDC over VGA/DVI/etc.

Work like HDMI – Hacking Displays Made Interesting by Andy Davis, Blackhat-EU-2012 is about using DDC to hack monitors, but the I2C bus that forms the DDC link is bidirectional, and could be creatively utilized poke the host's video card.

You can't avoid the DDC link because it's needed for setting the video mode correctly.

Answer 6

You would want a data diode in line next to the PC for both your keyboard and mouse, so then no data could be sent from the PC to the room no matter what (since you said cable number 3 is no problem). You might find using a serial mouse and keyboard better too.

This is all tin foil hattery by the way. here is a communication protocol named tin foil chat that shows data diodes for serial devices, that are wrapped in tin foil. https://www.cs.helsinki.fi/u/oottela/tfc.pdf

Adding a diode alone is not creating a data diode, as with a diode you could send against the arrow with a reverse voltage, the data diodes used in the project have an optocoupler to make it impossible for information to travel against the arrow (without having access to the hardware).

After trying too show why the HDMI cable may not be an issue I came up with this layout of the room, the idea is you put your head to the microscope looking viewing device and it allows you to see the screen through a optical fiber cable that passes through the wall. The keyboard and mouse you bring with you can only send data, not receive, as there is the data diode on the other side of the wall. Bob the security guy is there to keep you company in this windowless hellhole of a work place, and to kick you out if you start talking to your recording device, put something other than your eye to the view finder, or try to smash through the wall. Notice he can't shoulder surf any information. You would be logged out if you moved your head off the view finder, to log in you would need to type a password as usual but then also quickly type characters that appear in alternating left and right screens (there are now two monitors that lead to each eye separately). This is to prevent you boring out one eyeball and replacing it with a camera (one eyed pirates need not apply). Now you are not able to copy any files from the PC, Bob doesn't have to strip search you for spy equipment, and everyone is happy.

Anything you could memorize from the system and take home with you looses some credibility, you could have just made it up instead of memorizing it.

Answer 7

One solution which is universal for any OS is to remove all USB drivers except the ones you need (HID). Make sure to prevent the user from installing new drivers though.

Answer 8

As others have already said, specially robbat2 and Serge Ballesta... Once people have physical access to the machine, you are for all purposes compromised.

You can make your setup more electronically secure in a number of ways. Many of them will probably cover practically all your use cases. Unless you are working with top secret government or corporate stuff and the attacker is bringing in special technology with them, you should be practically safe.

But the only way to be 100% safe in academical terms here is to go physical too. You need a person you can trust guarding the machine.

If you are really paranoid about cable splicing and that is really your only concern, you could cover the length of the mouse and keyboard cables in a mesh of copper that is connected to a sensor. Run a current through it, and have a relay that can measure voltage checking it 24/7. Have the relay connected to another machine, maybe a Raspberry Pi or an Arduino, so that it can trigger an alarm in case the mesh gets depowered.

Now you just have to set the voltage on the mesh. Use some small potential - say, 3 to 12 volts - if you just want to know whether the cables have been cut or not. Or go all the way to 220V or more if you want it to serve as a booby trap (some people would say that is an unethical thing to do).

Answer 9

You can attach the keyboard to a desk (e.g. with vandal-proof screws through the base of the keyboard) so that the USB lead is not accessible, e.g. in a channel cut into the desk and covered with a metal plate.

You do not need a wired or wireless mouse: you can use a wired tablet (e.g. a Wacom one) with the USB cable similarly rendered inaccessible. You can get a mouse for the tablet if users cannot cope with using a pen.

Of course, a particularly malicious user might try to rip the keyboard apart to access the USB connection inside, so choose one of vandal-proof construction, possibly with an alarm so that if they still manage to get inside someone is alerted.

Also, stainless steel panel-mount keyboards with a trackball are available.

Answer 10

What if...

...we connected the keyboard into a Raspberry Pi or Teensy (https://www.pjrc.com/teensy), programmed to read the keys and "type" them again into the computer? I guess it would be fast enough to avoid any perceived latency. This would act as an "USB Firewall for Keyboard", and another one similarly as "USB Firewall for Mouse".

The computer would identify the Teensy as "FirewalledKeyboard" or "FirewalledMoused". There is no need for the computer to see the original keyboard or mouse.

Interestingly, user @robbat2 pointed to an USB firewall that prevents some low level USB attacks:

• https://github.com/robertfisk/USG/wiki
• https://github.com/robertfisk/USG/wiki/Hardware-(DIY-v0.9)

It seems to me this could also be modified to allow for only keyboards and mouses to be connected.

We may also still add PS/2 cables solution (see user @dandavis answer) between the keyboard and the "USB Firewall".

Update:

I sent an email to Robert Fisk, creator of the (open source) USG, and asked him (condensed):

Hello Mr. Robert Fisk,

Can your USG be modified so that it only allows keyboards and mouses to be connected, and also prevent information to be sent from the computer to the keyboard? If I buy your ready USG hardware (instead of building my own), is it possible to change its firmware? How much is each USG?

He replied:

Hi Marcelo. The firmware can easily be turned into a 'keyboard-only' or 'mouse-only' device. You can also disable the computer-to-keyboard communication that updates the caps, scroll, and num lock lights. However you will still be vulnerable to a malicious user typing in an evil VBScript, Powershell script, or even binary using ALT ascii codes that will perform malicious actions. Yes you can certainly program in your own firmware, see this page: https://github.com/robertfisk/USG/wiki/DFU-Firmware-Upgrade

I hope that helps!

Please note I had never talked to Mr. Fisk before this email, and never heard of USG before I asked this question. I am not connected to USG or its creator in any way, and I have never used one, tested it, or studied it. I don't personally know if it's fit for the job. I am just posting this info because I think it's interesting and possibly useful.

If in the end I decide to buy some USG and alter its firmware, I'll probably open-source the new firmware in GitHub and link it here.

Answer 11

Here you go. Epoxy, hot glue, etc. You have given very specific requirements and conditions without giving much basis except "Highly Sensitive Data".

Your question suggests the user CAN unplug and insert USB devices into the computer DESPITE the strict nature you originally described. This implies physical access to part of the system. The old rule goes "physical access trumps all other controls".

This is the best answer I can come up with, given your supposed conditions. I have worked in government high security environments, with cross-domain solutions, and those were easier. The simple answer is usually the more secure answer.

Answer 12

You could use a wireless mouse and keyboard if the computer with the usb ports is not to far from your input station.

Answer 13

Based on your comment on one of the answers: The concept of "touching the machine" here is the problem.

So this is answer is suggesting a different approach rather than concentrating on USB ports.

1. Why not use wireless? Wireless keyboard and mouse keeps you away from using wires.

2. Computer Remote Access, there are applications/software that can let you control other computer remotely, locally. It make sense, if you are making a server-like setup.

3. Control cursor and keyboard strokes through local network device (router)? Not sure if possible, but if it is, routers have mac address filtering, and such inputs devices need to have their own MAC addresses. Check out this HP Wifi Mouse, though by reviews online, it seems to be buggy.