USBGuard on Kicksecure to prevent hardware keyloggers/BadUSB

yodawins · July 22, 2021, 5:04pm

“The USBGuard software framework helps to protect your computer against rogue USB devices (a.k.a. [BadUSB]) by implementing basic whitelisting and blacklisting capabilities based on device attributes.” From their Github.

Maybe could help someone with a decent threat model?

Patrick · November 18, 2023, 3:53am

github.com/Kicksecure/security-misc

USB Guard | Depend on it and configure rules

Kicksecure:master ← monsieuremre:patch-3

opened 05:22PM - 17 Nov 23 UTC

monsieuremre

+19 -0

We should depend on usbguard as a package. When installed on debian, usb guard s…ettings are configured in a way that all devices are rejected, only those that were already plugged in before the daemon starts are allowed. Normally this is not optimal. We should by default reject everything and only whitelist the devices that we know and trust. But this requires configuration at the user end. So for now, we better leave the debian config as is. We also add new rules with our config file. These rules do not configure the daemon. They define how the daemon behaves when it is 'applying policy'. The policy is by default blocking everything. We slacken this by allowing devices with mass storage interface, so the users can plug in their external hard drives and usb's. Then we blacklist especially suspicuous storage devices. Those that try to also behave like a keyboard at the same time for example. Normally this is also not optimal, but it is a big improvement. We don't allow anything else. That means everything else is implicitly blocked. If the user plugs in a keyboard or mouse or anything else, it will be blocked. If these devices are plugged in when the machine starts up, they are allowed. This should not be too inconvenient for the user, because most peripherals are almost always already plugged in when the machine starts up. If not, they can be manually allowed or the system can be rebooted for the device to be allowed after having booted.

Patrick · January 10, 2024, 6:45am