1

Is it possible to set up Windows in a way that plugging in external storage can't compromise the device/network?

To clarify, I would like to use the storage device to transfer data into the network. My concern is the threat of the device itself, not the files on the storage device.

3
  • It sounds like you have a network of computers and you want to plug a storage device like a USB stick into one of them? Is that what you are describing? What are you worried about exactly?
    – hft
    Mar 30 at 0:22
  • Arbitrary code execution due to a weakness in USB.
    – chx
    Mar 30 at 0:26
  • I assure you no one cares about you this much. Buy a USB stick at BestBuy and stick it right into your computer with abandon.
    – hft
    Mar 30 at 2:10

2 Answers 2

3

There are "sheep dip" kiosks that are designed to inspect and even sanitise USB and other storage devices. So, before you plug the storage device into the computer, you plug it into the kiosk first, which tests it, sanitises it, and clears it for use.

I know of several high-security environments that use something like this. I'm sure there are other vendors, but I've seen OPSWAT most often.

This is on top of the basic controls on the computer, like disabling auto-run, having an agent on the computer that only allows file transfer from the device and blocks all direct access to files or executables, etc.

1

Airgap the machine if you don't want anything getting out to the network. If that's unreasonable, firewall it heavily, put in an IDS, and hope your risk model isn't extremely high. If that's unreasonable, just turn on airplane mode and hope for the best :) [you're only at risk if there's another attack vector that gets triggered by plugging the device which is rather unlikely in and of itself]. Seeing as your intent is to transfer files, an extreme way to protect yourself is to close all ports except your desired one (default port for SFTP is 22), and perhaps do the same on the receiving device. A less extreme way is using an IDS or anti-virus which should protect you from most possible attacks.

On that note, it's impossible to with certainty protect your device, however a few good pieces of advice are:

  1. Disable DMA!
  2. Don't execute anything on the USB
  3. Might be worthwhile to run it in a VM (though a fair few escapes have been documented from those)
  4. Don't use file explorer; a vulnerability in that is one of the more likely ways in which just plugging a drive in could be damaging
  5. (unlikely case but) check for internal tampering with the USB (USB killers exist; you can identify them by the presence of large capacitors if you take the USB apart)
  6. Depending on what you're using the drive for, you may not need it to be automatically mounted (that can be disabled with mountvol /n)
  7. Also, if your storage device is an SD card (or anything with a microcontroller embedded), keep in mind that they have been previously proven compromised and may exhibit unexpected behavior
5
  • Well, airgapping / airplane would defeat the purpose which is to copy files securely into the network.
    – chx
    Mar 29 at 23:21
  • Update your question with the purpose please
    – belkarx
    Mar 29 at 23:22
  • 2
    This is wrong and has some bad advice. The link to disabling DMA you posted is about MDMA (or whatever it was called back then) which is not related to DMA hotplugging. All that would happen if you disabled drive DMA at the SATA hub is it would switch to PIO mode, which would make things really slow (a few Mbps and 100% CPU load) and still wouldn't protect you from DMA attacks. What you need to do is disable DMA on specific hotpluggable devices like Firewire (ohci1394 driver), PCMCIA, PCIe hotplugging, etc. It's actually physically impossible to globally disable DMA on a modern system.
    – forest
    Mar 30 at 0:14
  • 1
    What you should do instead of trying to disable DMA is enable DMAR with the IOMMU. I'm not sure how to do it on Windows, but on Linux you can boot with intel_iommu=on or amd_iommu=force. It requires the BIOS have proper DMAR entries in the ACPI table which some BIOS vendors don't have. Note also that IOMMU support isn't all that's needed. On Intel systems at least, it has to be VT-d2 and must support Interrupt Remapping and x2APIC, although this is always the case for new hardware.
    – forest
    Mar 30 at 0:17
  • 1
    Thanks @forest, I wasn't at all diligent in choosing my link; I was previously unaware of how to disable DMA attacks in Windows beyond a vague notion of a registry key to enable IOMMU so I chose the most-revelant-seeming guide. I should have actually read it as opposed to skimming and I'll take care to do that in the future
    – belkarx
    Mar 30 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.