25

When inserting a USB stick or device to computer, there is always the risk that the device is malicious, will act as an HID and potentially do some damage on the computer. How can I prevent this problem? Is disabling HID on specific USB port sufficient? How do I do that?

34

Install USBGuard — it provides a framework for authorising USB devices before activating them. It can pop up a notification when you connect a new device, asking you what to do; and it can store permanent rules for known devices so you don’t have to confirm over and over. Rules are defined using a comprehensive language with support for any USB attribute (including serial number, insertion port...), so you can write rules that are as specific as you want — whitelist this keyboard if it has this identifier, this serial number, is connected to this port, etc.

  • What makes known devices "known"? It stores their ID or something? Can't that be faked too? – Martin Heralecký Dec 20 '17 at 11:01
  • 4
    Known devices are matched using a rich condition language, you can be as specific as you want (including USB serial number, insertion port...). Anything can be faked, but if you’re up against an adversary that’s figuring out what you’ve whitelisted, you’ve probably lost anyway. (You can of course never whitelist anything apart from your keyboard if you really want to play it safe.) – Stephen Kitt Dec 20 '17 at 12:03
  • Emphasis on your keyboard, not "any USB keyboard". – grawity Dec 21 '17 at 9:03
10

To complete the other answer, it should be known that you can never completely protect a computer from malicious USB devices. There have been several proof-of-concept and commercially available devices such as the USB Killer which can literally fry the port or the motherboard.

Software will never be able to protect from this, and there's always a chance it can be vulnerable. If you really need strong protection, make the ports physically inaccessible (think ATMs, for example).

  • 7
    I suppose the OP had in mind the devices that don't attempt to physically destroy your computer or his owner. Otherwise a bit of anthrax would be enough to make a glass wiper a security issue. – 9ilsdx 9rvj 0lo Dec 20 '17 at 12:31
  • 1
    I think it's still relevant though --- sure, it's not going to be a problem in all (most) situations, but it's still good to keep in mind if you don't trust your user, which the question implies. – Baptiste Candellier Dec 20 '17 at 12:40
  • 1
    Yes, I was asking mainly about the software security. Protecting against USB stick frying my motherboard is of course a different thing. But thank you for mentioning it anyway. – Martin Heralecký Dec 20 '17 at 23:58
  • 1
    The OP specifically mentions HID devices, which your answer completely fails to address. – Dmitry Grigoryev Dec 21 '17 at 11:58
0

A list of known Vid:ProductId could be added as 'authorised' Authorised USB But you should know about USB zappers USB port zapper

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.