1

At work, my company disables usage of USB peripherals on Windows XP machines by:

  1. Removing the USBSTOR.INF file from system32.
  2. Changing the value of the Start key in HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

What are the other software-based methods of disabling USB on Windows machines? How do you counter them (if you do)?

Improve this question
2
  • 2
    do consider the implications of breaking your company's IT policies and circumventing their restrictions. Depending on where you work and what you would do with USB access, this could cause you to lose your job, or even face legal repercussions depending on what contracts you may have agreed to. Please note that you are responsible for any actions you take based on advice posted here. Proceed at your own risk.
    – nhinkle
    Dec 10, 2010 at 9:27
  • 1
    @nhinkle, I do understand the implications of asking such a question. I am trying to compile a list of ways network administrators can counteract such hacks.
    – GPX
    Dec 10, 2010 at 10:56

4 Answers 4

Reset to default
2

Disable USB in the BIOS, lock BIOS with passwords prior to distribution to system owner.

I would counter this by transferring information off to a network device prior to putting it on my USB, if that is in fact what I needed to do (assuming I'm doing this to get my job done, cause some lame security zealot thinks that blocking USB will actually increase security). If I wanted to steal data off the system, I'd transfer it off to another via the network, bluetooth, or some other mechanism, or simply remove the hard drive (assuming it is not encrypted, or is poorly encrypted as it is likely to be in a scenario where the IT staff feels that preventing USB access is going to do anything more than make it difficult for people to get their job done).

NOTE: None of the above applies for secure systems that are in a controlled environment and are off-network. In those places, disabling USB makes perfect sense, to prevent quick and easy transfer of the data (because the systems are secured from physically removing the drive, and other data transfer mechanisms are also restricted). In those scenarios, I'd simply bribe a guard or threaten to reveal the embarrassing secret of someone who can get the information for me. Or just take a picture with my cleverly concealed camera (it looks like a button, doesn't it?).

Improve this answer
1
  • Disabling USB on the BIOS is a great idea! Also, at my workplace, they seal the case with a lock, so there's no way to remove the hard-disk! What I'm looking for exactly, is how admins disable USB inside Windows, and how I can break it!
    – GPX
    Dec 10, 2010 at 6:29
1

In addition to those previously mentioned, do it in your windows policy - see http://oreilly.com/pub/a/windows/2005/11/15/disabling-usb-storage-with-group-policy.html for more info.

Improve this answer
1
  • 1
    This has the added benefit of automatically being able to be distributed to all attached client machines with no extra work if you are using a properly configured domain.
    – eidylon
    Dec 10, 2010 at 17:33
1

Third Party software like Web (non) Sense can do the same

Improve this answer
0

Software that is described as endpoint protection will often include this feature. See Symantec, Check Point, and McAfee as examples. As others have pointed out Windows can do this. Newer version of Windows offer greater control over what is or is not allowed, but are still behind the third-party solutions.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .