0

O.MG Cable is here and the way technology is going, more of those devices will be available to the common user.

This kind of USB attack isn't new and there is plenty of devices out there ready to do some hardware or software damage to your computer (Rubber Ducky, BadUSB, USBKill...). But they are getting smarter and being disguised as devices of daily use like a cable.

Question: Is there a software that would block all udev triggers and ask for the user if he wants to allow a new usb device to be enabled, creating a device whitelist? A feature to execute an initial scan to register the devices that are already connected is much appreciated...

I'm thinking that if O.MG Cable is a HID device, it should be safe to not allow it to be mapped neither access system resources (it would show "HID Device" when plugged and the user could refuse it).

1

Take a look at usbguard. You can create policies based on manufacturer, or specific devices that are allowed or forbidden.

As an example, on Arch Linux you can install using:

pacman -S usbguard usbguard-qt

/etc/usbguard/usbguard-daemon.conf is the main config file. If you want to make usbguard work out of the box with the hardware you already have conected before the daemon starts:

  • Edit the PresentDevicePolicy= parameter and set it to true. This will auto register the current USB hardware you have before the daemon starts.
  • Edit the IPCAllowedUsers= or IPCAllowedGroups= so you can communicate with the daemon and list devices, create rules on-the-fly, etc based on your username or a group you are member of.

This will also avoid any loss of connection from your current mouse and keyboard.

Out of curiosity, Linux 5.1 will have an option to lockdown USB ports that are not internal to the motherboard until it reaches userspace, creating a new layer of protection before USBGuard starts.

  • 1
    Your answer is good, but i'll add some stuff to it :) – nwildner Feb 21 at 0:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.