1

Assuming a threat actor would not have a huge amount of resources or is a script kiddie (he could not write a 0-day but he could buy a rubber ducky); in a Windows 10 environment, if the workstation is fully patched, would disabling USB data transfer via an OS setting mitigate any serious risk?

The scenario would be "the threat actor has unsupervised access to a workstation with accessible USB ports and an open session for a few seconds".

Back in the Windows XP days USB's were spreading malware via USB autorun; afaik this era is well passed. Alternatives such as rubber duckies are the way to go. Therefore, would disabling USB data transfers mitigate anything worthy?

Context: trying to remove an old policy (disabled USB data transfers) that annoys end-users alot and probably does not mitigate much (there is full trust in employees and clicking on random files on a USB found on the parking lot is not something they would do).

Improve this question

1 Answer 1

Reset to default
1

Disabling USB data transfer will not change anything, because Rubber Ducky does not need data transfer to work.

If the computer is unlocked, the USB device will emulate a keyboard and type commands, so it's not needed to transfer data. Other attack creates a network interface and change DNS settings, so every domain resolution can be changed and MitM attacks can be executed on insecure protocols (plain HTTP, SMTP, POP3, FTP, Telnet, and others).

Improve this answer
2
  • I know that disabling USB data transfer would not prevent a rubber ducky attack. My question asks if it prevents other kind of attacks, which rely on data transfers, besides having a gullible end-user clicking on anything :)
    – niilzon
    Dec 9, 2021 at 21:10
  • Disabling data transfer only protects against attacks using data transfer.
    – ThoriumBR
    Dec 10, 2021 at 1:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .