Hacker News Reader

Comment by jordigh | Hacker News Reader

Can we have a usb condom for this situation? The actual product called "usb condom" is about charging phones and blocking all data pins on the usb drive. Can we have one that will only allow devices to connect as mass storage devices, or is this at odds with the usb protocol?

View on HN

I wonder if you actually need a hardware device for this?

Seems you could have an OS feature so when you insert a USB device it first confirms you're happy for the device to register as an X (mass storage, input, audio etc) before it lets it do it.

Though saying yes to registering your keyboard, mouse etc every time you boot might get a little tedious (not to mention impossible if you have no other input devices!).

Perhaps an extension to USB that has 512-bits worth of persistent storage per device. When you register a device the OS produces a random number and writes it and saves the list of allowed IDs.

Or perhaps you could ask the OS to only apply the ask to register feature to certain USB ports?

USB ports are individually addressable, even through hubs, so you can do what everyone hated about Win98 and show a new hardware wizard if a particular port ever has its device change (devices can be recognized by vendor, product, type, and in some cases serial number).

USB firewall.

White-list the USB keyboard when it is first attached, using its unique serial number, and avoid a prompt in the future.

Various devices tend to either have serial number empty (for example both my keyboard and mouse, Sun and Logitech respectively, so not exactly cheap Chinese crap) or filled with some random garbage that is not unique at all ("123456", "Serial" and so on).

One would assume that "garbage in iSerial" is workaround for Windows' behavior of identifying devices by either it's serial or physical port and requiring distinct driver registrations for devices that are "different" according to this logic.

it might still be useful to filter based on type. if you expect a mass storage device you don't want it to register as input device.

You can do something like this with grsecurity. It's not a whitelist but you can deny any new usb devices after you toggle a switch:

    If you say Y here, a new sysctl option with name "deny_new_usb"
    will be created.  Setting its value to 1 will prevent any new
    USB devices from being recognized by the OS.  Any attempted USB
    device insertion will be logged.  This option is intended to be
    used against custom USB devices designed to exploit vulnerabilities
    in various USB device drivers.

Simple: You don't have to confirm the first mouse and keyboard.

Is the order deterministic? More to the point, if i leave a bad USB stick plugged in, how do i guarantee my keyboard gets the free pass rather than the evil stick?

The OS can know that you had the same keyboard (the same ID) plugged in for the whole last year at the same socket, but the new 'keyboard' is plugged in that socket where you usually plug in random USB data storage devices.

> I wonder if you actually need a hardware device for this?

Yes. Bugs in the kernel part parsing the USB descriptors IIRC were one of the avenues in PS3 jailbreaking.

Users will just click yes, or whichever default for "just make it work" you choose.

Advanced protection/admin features left to consumers simply don't work, I thought we understood that by now. You must have something that will intelligently handle them on its own (e.g. heuristic AVs, smart firewalls etc). Because there is no way for a system to say "well, this looks like a storage device, but it's telling me it's an input one, something is fishy", you're just going to have a whitelist nobody really uses, like IE's "trusted sites" zones.

I was thinking about this. I tinkered a bit with the usb (OTG) drivers on linux. But I don't have the skills to create a hardware device from scratch. It would be great if there was a simple device that had two USB chips and that you could program, something like a raspberry PI or a smartphone. (Actually, many smartphones can be used as a USB host as well as a device, but not at the same time.)

Does anybody know if some platform like this exists? I heard you could do it with the BeagleBone?

The Intel Galileo has one host port and one device port and runs Linux. In my project I was able to relay enough USB packets to support USB keyboards and mice successfully. It isn't too expensive either.

That would require an active intermediary, but yes, it should be possible.

A basic version of this already exists from Monoprice: http://www.monoprice.com/product?p_id=13166

Plug in a microUSB device and it can only charge; you have to hit the button in order to enable the data pins.

But I think this is designed for risks going the other way, i.e. to protect your cell phone from data-scraping USB-A female ports in airports and the like.

Would any such countermeasure really be worth it to use random 8GB USB drives from conferences? They are so cheap, and I have a hard time believing this would ever be better than simply not using these ever.

A lot of conferences are only distributing their symposium notes this way now. So, if you want to read the notes, you need to use the USB key.

They're distributed because people need/want to access the data that way.

It's a somewhat efficient way to distribute a gigabyte of data to a hundred people so that they all have access to it now despite all sharing a lousy wifi at a conference center.

A raspberry pi could probably do this quite well.

Reply on news.ycombinator.com