Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB...
Transcript of Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB...
![Page 1: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/1.jpg)
Usable USB Protection
![Page 2: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/2.jpg)
Background
![Page 3: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/3.jpg)
![Page 4: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/4.jpg)
USB was meant to be cheap
![Page 5: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/5.jpg)
USB was meant to be cheap
![Page 6: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/6.jpg)
USB was meant to be cheap
![Page 7: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/7.jpg)
![Page 8: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/8.jpg)
![Page 9: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/9.jpg)
USB Device claim their identity and capabilities
![Page 10: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/10.jpg)
USB Descriptor
![Page 11: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/11.jpg)
Problems
![Page 12: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/12.jpg)
Session locked with a password?
![Page 13: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/13.jpg)
USB Attack Surface (Kernel space drivers)
![Page 14: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/14.jpg)
Attack surface of USB
![Page 15: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/15.jpg)
USB without borders
![Page 16: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/16.jpg)
People expect USB to work
![Page 17: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/17.jpg)
Other Solutions
![Page 18: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/18.jpg)
Lock your USB Ports (hardware)
![Page 19: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/19.jpg)
Lock your USB Ports (software)
![Page 20: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/20.jpg)
Windows - Kaspersky
![Page 21: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/21.jpg)
USBGuard - Official Qt applet
![Page 22: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/22.jpg)
USBGuard - Official Qt applet
![Page 23: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/23.jpg)
USBGuard - Official Qt applet
![Page 24: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/24.jpg)
USBGuard GNOME
![Page 25: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/25.jpg)
USBGuard
If there are already working USB protection, why start this project at all?
![Page 26: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/26.jpg)
apt install usbguard
![Page 27: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/27.jpg)
apt install usbguard
![Page 28: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/28.jpg)
"Security at the expense of usability, comes at the expense of security."
-- AviD's Rule of Usability
![Page 29: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/29.jpg)
Our Solution
![Page 30: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/30.jpg)
GNOME’s USB protection
● Based on USB Guard● Do not break existing behaviour● Reduce attack surface as much as possible without the
user noticing● Tighten security later
![Page 31: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/31.jpg)
Iterative Design
1. On / Off2. Lockscreen3. Keyboards4. Unlocked Protection
![Page 32: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/32.jpg)
![Page 33: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/33.jpg)
![Page 34: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/34.jpg)
![Page 35: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/35.jpg)
USB Protection - One of the first iterations
![Page 36: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/36.jpg)
USB Protection - New single switch
![Page 37: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/37.jpg)
USB Protection - Notification system
![Page 38: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/38.jpg)
GNOME Shell integration
![Page 39: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/39.jpg)
Cool, but this doesn’t protect us from the very same attack you showed at the beginning of this talk, does
it?
![Page 40: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/40.jpg)
USB protection when the session is unlocked
● Easy to block/allow everything
● Hard to selectively block malicious (or potentially malicious) devices without interfering with users workflow.
![Page 41: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/41.jpg)
USB Keyboards Protection
![Page 42: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/42.jpg)
Call for Action
![Page 43: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/43.jpg)
Test the Patches!
Stage 1:
GNOME Settings Daemon !75https://gitlab.gnome.org/GNOME/gnome-settings-daemon/merge_requests/75
Stage 2:GNOME Shell !369https://gitlab.gnome.org/GNOME/gnome-shell/merge_requests/369
![Page 44: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/44.jpg)
Thank you
![Page 45: Usable USB Protection · 2019. 9. 9. · USB was meant to be cheap. USB was meant to be cheap. USB Device claim their identity and capabilities. USB ... Lock your USB Ports (hardware)](https://reader034.fdocuments.in/reader034/viewer/2022052014/602b6f09ed8d501d273a744a/html5/thumbnails/45.jpg)
Thank you!