On Linux, how do I enforce a whitelist of USB devices?

Question

With the things like RubberDucky, and available code to reprogram USB Flash, the USB port on my laptop is becoming a security risk.

How can I begin using a whitelist of acceptable USB storage and HID devices?

Thanks.

Answer 1

You can't.

The USB Stick firmware can be modified so it identifies as a completely different device. That's the security risk.

So for example, if you whitelist your printer a usb stick can be flashed to identify itself as your whitelisted printer and then send data to your printer driver that it was never expected to receive. Your printer driver may behave unexpectedly possibly resulting in the usb stick having root access to your pc.

Also, take a look at https://security.stackexchange.com/questions/64524/how-to-prevent-badusb-attacks-on-linux-desktop

Answer 2

You could try USBGuard. It implements a USB device blacklist/whitelist on top of UDev and the Linux kernel USB authorization framework. It has a rule language for writing USB device usage policies, i.e. to express things like:

• "I want to use just this keyboard and USB flash disks on my system, block everything else"
• or "block USB flash disks that have an additional interface on them (keyboard, network card, ...)"

For example, to block USB flash disks which aren't just flash disks (i.e., they were reprogrammed to include a keyboard or something else than a mass storage interface) you could use this USBGuard policy:

allow with-interface equals { 08:*:* }
block

That causes USBGuard to authorize only USB devices that contain just one interface of the class 08 (mass storage).

Disclaimer: I'm the author of that project.