[Solved] Usb stick security

jordicg · 2019-08-04 22:57:44

Hello community.-

I am worried about the security of my computer/Arch because i will work surrounded of many people i dont know. I dont want anybody to insert a USB memory stick in my computer while i am in the bathroom and make any harm to my system. So besides BIOS password, is there any software or similar that could ask me for a password when a USB memory stick is inserted in Arch? That way i can prevent anybody form plugging and running USB sticks in my computer. Thank you in advance.

Last edited by jordicg (2019-08-05 20:18:21)

loqs · 2019-08-04 23:13:19

Possibly something based on usb/authorization.txt?

jordicg · 2019-08-04 23:21:30

loqs wrote:

Possibly something based on usb/authorization.txt?

Wow just what i was looking for, thank you

I imagine that i only follow the command instructions, for example.-

echo 0 > /sys/bus/usb/devices/usbX/interface_authorized_default

When i am away from my desk

And

echo 1 > /sys/bus/usb/devices/usbX/interface_authorized_default

When i return to work

The only problem i see is that the computer has arround 8 USB ports, Do i have to do this with every single one of them every time?

Last edited by jordicg (2019-08-04 23:40:57)

Trilby · 2019-08-04 23:41:00

What do you mean by "running usb sticks"? A block device is not executable. Either you would be referring to someone plugging in a flash drive with some software on it, then mounting the device and attempting to run the software, or you'd be referring to them plugin in a bootable usb and (re)booting the system.

In the first case, the fact that some program is on a flash drive is irrelevant at this point - if they can log in to your system and execute a program, you're screwed regardless. If they don't have root access, they can damage any/all data of whatever user you left logged in and unlocked as you stepped away from your computer. They don't even need any software (from the usb, or web, or otherwise) - they can just `rm` whatever they want. If they do have root access - game over.

In the second case, all the steps in the previous post are irrelevant: they'd be booting their own OS, so nothing you do to your linux system will protect anything.

Please clarify what you are actually trying to protect against, and in what way you think a flash drive plugged into your system would even be thing you'd need to protect against. Lock you system when you step away, and have a BIOS/power-on password. With these protections there is no need for additional usb-specific protections, without them, you're screwed anyways.

Last edited by Trilby (2019-08-04 23:43:28)

jordicg · 2019-08-04 23:48:00

Im more concerned about the first option. Rebooting with the USB plugged in is solved by setting a BIOS option i think.

Oh yes, i see your point, but i have heard of scripts in USB that can steal the cache of my session/cookies etc. if they are plugged when i am away. They just need to instert the USB, and remove it. Or this is too complicated to even worry about?

progandy · 2019-08-04 23:51:11

Some tools for limiting usb access.

https://wiki.archlinux.org/index.php/USBGuard
https://wiki.archlinux.org/index.php/Th … horization

Nothing will be able to protect you against devices that replace and exactly mimic one you have authorized. Invisible keyloggers that can be inserted between a keyboard and the computers are available.

Last edited by progandy (2019-08-04 23:59:24)

Trilby · 2019-08-04 23:55:33

jordicg wrote:

... but i have heard of scripts in USB that can steal the cache of my session/cookies etc. if they are plugged when i am away.

If your system is logged in and unlocked while you are away, they can do this even without a usb drive.

Also, nothing automagically runs when a USB is plugged in in a base install (nothing even mounts the drive). If you have installed and enabled something that would automount and run any autorun scripts on flash drives, just disable that thing.

But more importantly, if your system is unlocked, they can just download a script from somewhere else, run it, and have it post/upload the stolen data to a web location of their chosing. Again, no usb required.

Last edited by Trilby (2019-08-04 23:58:33)

progandy · 2019-08-05 00:01:14

Trilby wrote:

Also, nothing automagically runs when a USB is plugged in in a base install (nothing even mounts the drive). If you have installed and enabled something that would automount and run any autorun scripts on flash drives, just disable that thing.

The usb device can simulate a network interface or a keyboard. To do anything useful, the computer has to be unlocked, though i think.

Thunderbolt devices can request DMA access which could be used to read data from RAM, so using authorization is a must here.

Last edited by progandy (2019-08-05 00:03:13)

jordicg · 2019-08-05 20:17:13

Ok @Trilby and @progandy .-

Thank you very much, so i was a little paranoic, but in security matters one can never be paranoic, thank you again. Maybe i will use USBGuard when i know how to correctly configure it (i have seen its dangerous if you dont know what you are doing).

Arch Linux

#1 2019-08-04 22:57:44

[Solved] Usb stick security

#2 2019-08-04 23:13:19

Re: [Solved] Usb stick security

#3 2019-08-04 23:21:30

Re: [Solved] Usb stick security

#4 2019-08-04 23:41:00

Re: [Solved] Usb stick security

#5 2019-08-04 23:48:00

Re: [Solved] Usb stick security

#6 2019-08-04 23:51:11

Re: [Solved] Usb stick security

#7 2019-08-04 23:55:33

Re: [Solved] Usb stick security

#8 2019-08-05 00:01:14

Re: [Solved] Usb stick security

#9 2019-08-05 20:17:13

Re: [Solved] Usb stick security

Board footer