2

Is there such thing as a prompt that asks for permission to mount an detected USB device? In order to prevent against physical attacks with USB devices.

Like "A USB device is detected would you like to mount it? Allow/Deny?". Ultimately to also "whitelist" or "blacklist" a device based on the GUID.

I'm wondering for solutions on different operating systems.

Bob Ortiz
  • 6,234
  • 8
  • 43
  • 90

1 Answers1

1

Yes, this exists on Ubuntu for example. You can set permissions that require the root password if you are mounting a drive with non-root permissions. I assume similar things exist in Windows and OSX.

However, there may be some confusion in what you refer to as physical attacks. Something like the USB Rubber Ducky: http://hakshop.myshopify.com/products/usb-rubber-ducky-deluxe?variant=353378649 works by acting as both a storage device and a mouse, capable of clicking as if it is a legitimate user. This is similar to how Stuxnet worked, the virus used to shutdown a uranium enrichment facility in Iran. Or there's the drive that's just a huge capacitor that fries hardware: http://gizmodo.com/this-treacherous-220-volt-flash-drive-can-fry-your-comp-1736502260.

While you can definitely improve security by requiring permissions to mount storage devices, I would argue that this isn't enough to prevent against physical attacks in the sense of hardware attacks. It may be useful in stopping employees from moving confidential files around or getting past corporate firewalls by moving malicious programs on flash drives, but it won't protect against usb drives that act like other devices. For that you would have to set permissions for mounting pretty much anything, including any human interface device and not just storage.

Verbal Kint
  • 737
  • 1
  • 6
  • 20