For security reasons in public spaces administrators choose to disable the USB interfaces.

Is there a possibility for having something like port knocking on disabled/sleeping USB interfaces?

Port knocking in this case would be a detection of a specific kind of device (basically from lsusb information) and ideally some kind of special file inside of a USB pen drive.

Ideally, it would also require multiple USB pen drives with multiple password files.

Is this possible and was this ever done?

Would is be a secure method to unlock the USB interfaces for administrators and administrators only?

  • Not exactly what you want, but is usbguard useful? Commented May 4, 2020 at 14:54
  • @multithr3at3d thanks, it kind of is. Do you see any flaws in my logic for this "port knocking" for USB though? Commented May 5, 2020 at 11:57

1 Answer 1


It's definitely possible to check parameters of a USB device without mounting/allowing it to be functional. For example, the tool usbguard provides a Linux kernel module that checks parameters of a device against a whitelist before it can be used.

However, I don't think it is sufficient for authentication. Just like network port knocking, it could be intercepted and then duplicated. Depending on the platform and privileges, maybe non-administrator programs could passively record data about plugged in devices, their contents, and the sequence in which they are plugged in. Or, maybe some really small USB sniffers (almost like a keylogger of sorts; not sure if this exists?) are installed over the USB ports that perform similar monitoring. Then, new USB devices could be created to match the criteria (fairly certain you can spoof nearly all attributes, even using something like Raspberry Pi Zero which can pretend to be a mass storage device).

Now, maybe that could be mitigated by rotating keys over the network on a frequent basis, but then you'd have a lot of physical overhead in keeping your USB keys up to date.

That said, I wouldn't want an administrator entering their own credentials into a machine that is compromised in the above ways. Enabling/disabling USB ports could probably be done safely using group policy or the like, although I'm not sure if there is a ready made solution.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .