2

There is a requirement for an unattended, publicly-accessible machine that I have to only allow company-approved USB devices (e.g., USB mass storage, keyboard, mouse, Bluetooth, etc.,) and block all the rest (non-approved).

Even though PID, VID, serial number are unique identifiers to USB devices, but, if somebody knows those information he/she can easily create a USB with the identifiers mentioned above and produce an approved USB.

Is there any way that I can add unique and secure identifiers to USBs (except VID, PID, S/N) and set up a mechanism to differentiate between company approved USBs and non-approved ones and allow only the approved ones?

Expected result: Secure USB for devices that are left unattended (e.g., kiosk) in public places.

Improve this question
2
  • Don't give customers any physical access to the USB ports in the first place.
    – Ghedipunk
    Jan 2, 2020 at 16:33
  • 1
    You are ok with the public plugging things in, but you want to restrict what they can plug in? I would use physical security (physically block the ports) instead of security in software.
    – schroeder ♦
    Jan 2, 2020 at 17:21

3 Answers 3

Reset to default
1

Not really. If you can create own hardware and own kernel modules, restricting access of kernel modules to devices, you can make an device communicating to PC via an optical channel (to prevent power analysis attacks and glitching), embed a unique private key into each device, write the firmware and drivers the way making it authenticate each operation, insert a power source and seal each device the way preventing access to its circuitry (otherwise the adversary will wire to buttons switches directly) and firmware without destruction of the secrets (for example use a battery-powered MCU holding secrets in sram plus a case of tempered glass (breaks violently and wholy, can be untempered by heating) coated with a structure of metal - organic semiconductor - metal (normally doesn't conduct dc and has specific impedance, when disrupted the capacity will change, when heated DC resistance will change, can be detected) ), and make the system to use only authenticated devices. When the battery is drained the device is destroyed and a brand new is added by a security officer.

You also have to do that with PC. But it is infeasible. You cannot solve the problem with technical measures alone. If you need so good security just forbid the staff to attach/detach any devices, disassemble devices and computers, make sure the devices are unflashable without disassembling them and put people to oversee that nothing malicious is going on.

Improve this answer
0

You probably need to block things that might be harmful while still allowing people to get their jobs done.

Instead of trying to call out specific devices, consider blocking or approving USB devices by class types. For example, you might approve all HID devices (class 03) and Audio (class 01), which might be required by people with special needs (custom mouse pointing hardware, keyboards, hearing aids, etc.) Similarly you might block all Mass Storage (class 08) and Networking (class 02) devices so that hackers can't perform malicious acts.

Improve this answer
2
  • Aren't HID devices dangerous because input is considered trusted (i.e. magic SysRq)?
    – KOLANICH
    Feb 1, 2020 at 19:33
  • HID is no guarantee of security. Look at the RubberDucky for an example of an evil keyboard. However, there’s no difference between a rubber ducky and a malicious person typing on your keyboard, so you need to protect the host regardless.
    – John Deters
    Feb 1, 2020 at 22:28
0

Even a set of sophisticated udev rules will not protect against sabotage. Think USB killer for example.

But you can already dispense with the keyboard and the mouse by investing in a touch screen. Instead, you use a virtual keyboard and the mouse is integrated to the touch screen. So you have already eliminated two devices.

USB mass storage, do you really need this ? All the software should be loaded from an internal drive and the chassis should obviously be well secured against tampering. In short, every needed device can be embedded and need not be exposed through USB ports.

What you probably should do is disable USB completely in your BIOS settings (by the way it goes without saying BIOS access should be protected by a strong password...) And plug the holes with cement perhaps.

What I think is that the setup you are contemplating is not appropriate. In your situation I would really - if possible - invest in a rugged computer that is designed to withstand adverse environments. Depends on your budget, the operating environment and the intended purpose.

It's true, someone could bring their own equipment (a battery-powered Raspberry PI for example) and easily clone your peripherals. All it takes is a determined (or very bored) individual. It's not a difficult hack at all. But you can get rid of USB rather than figuring out how to protect it.

Bottom line: if you can't solve the problem, kill the problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.