How to secure against USB drives?

Question

Is it possible to set up Windows in a way that plugging in external storage can't compromise the device/network?

To clarify, I would like to use the storage device to transfer data into the network. My concern is the threat of the device itself, not the files on the storage device.

Answer 1

There are "sheep dip" kiosks that are designed to inspect and even sanitise USB and other storage devices. So, before you plug the storage device into the computer, you plug it into the kiosk first, which tests it, sanitises it, and clears it for use.

I know of several high-security environments that use something like this. I'm sure there are other vendors, but I've seen OPSWAT most often.

This is on top of the basic controls on the computer, like disabling auto-run, having an agent on the computer that only allows file transfer from the device and blocks all direct access to files or executables, etc.

Answer 2

Airgap the machine if you don't want anything getting out to the network. If that's unreasonable, firewall it heavily, put in an IDS, and hope your risk model isn't extremely high. If that's unreasonable, just turn on airplane mode and hope for the best :) [you're only at risk if there's another attack vector that gets triggered by plugging the device which is rather unlikely in and of itself]. Seeing as your intent is to transfer files, an extreme way to protect yourself is to close all ports except your desired one (default port for SFTP is 22), and perhaps do the same on the receiving device. A less extreme way is using an IDS or anti-virus which should protect you from most possible attacks.

On that note, it's impossible to with certainty protect your device, however a few good pieces of advice are:

1. Disable DMA!
2. Don't execute anything on the USB
3. Might be worthwhile to run it in a VM (though a fair few escapes have been documented from those)
4. Don't use file explorer; a vulnerability in that is one of the more likely ways in which just plugging a drive in could be damaging
5. (unlikely case but) check for internal tampering with the USB (USB killers exist; you can identify them by the presence of large capacitors if you take the USB apart)
6. Depending on what you're using the drive for, you may not need it to be automatically mounted (that can be disabled with mountvol /n)
7. Also, if your storage device is an SD card (or anything with a microcontroller embedded), keep in mind that they have been previously proven compromised and may exhibit unexpected behavior