USBGuard: authorization for USB

Benefits for LWN subscribers The primary benefit from subscribing to LWN is helping to keep us publishing, but, beyond that, subscribers get immediate access to all site content and access to a number of extra site features. Please sign up today!

USBGuard is a security framework for the authorization of USB devices that can be plugged into a Linux system. For users who want to protect a system from malicious USB devices or unauthorized use of USB ports on a machine, this program gives a number of fine-grained policy options for specifying how USB devices can interact with a host system. It is a tool similar to usbauth, which also provides an interface to create access-control policies for the USB ports. Although kernel authorization for USB devices already exists, programs like USBGuard make it easy to craft policies using those mechanisms.

Malicious USB attacks

Before we look at USBGuard, let's first take a look at the problem it tries to solve: unauthorized use of the USB ports. Beyond the usual data theft that can occur with USB storage devices on sensitive machines, there is also the problem of malicious USB devices programmed specifically for sophisticated attacks. The recent spate of vulnerabilities in the USB subsystem that can be exploited via specially crafted USB devices is worrying. However, even in the absence of software vulnerabilities, it is possible to mount a USB-based attack against host systems. The BadUSB attack is a proof-of-concept malware that reprograms a USB device to surreptitiously attack a computer that it is plugged into—with no privileges required beyond physical access to the machine in question.

USB devices have a tiny embedded microcontroller that is used to facilitate communications between the device and the host computer. The microcontroller runs embedded firmware that lets it perform this task; for BadUSB this firmware was overwritten with customized malicious code that can wreak havoc on a computer in a number of ways. A malicious USB device attached to a host that's booting can infect the system if USB devices are in the boot sequence order. USB devices interact with the host via interfaces, which are a description of the type of device that is presented to the host. A malicious USB storage device, for example, could stealthily create a secondary interface such as a faux keyboard or spoofed network device that sends malicious input or redirects network traffic.

It is also possible to steal credentials from a screen-locked machine simply with a rigged USB drive which, when plugged in, pretends to be a NIC, hijacks the network and DNS settings, and collects credentials from the all too trusting operating system. The information can either be collected by physically retrieving the drive, or it can have its own rogue wireless connection that transmits the sensitive information to the attacker.

USBGuard

It is possible to thwart unauthorized or malicious USB port usage by controlling the types of devices that are allowed to connect to them or to take certain actions based on USB device events. The idea behind USBGuard is that there is a set of approved devices that a user can specify to be allowed on their system and USBGuard enforces those restrictions. A whitelist or blacklist can be generated for a set of devices, which also specifies the allowed behaviors from approved USB devices.

When constructing a whitelist (or blacklist) of devices, a question that needs to be answered is: "How can I tell if this device is mine or not?" The identification system needs to work even on devices that can't be written to, such as scanners and mice. USBGuard attempts to do this by creating a hash of each device a user owns that they want to whitelist, based on its name, manufacturer and model, serial number when available, interface type, and which port it is connected to.

USBGuard works using the underlying kernel USB authorization mechanism to authorize or de-authorize USB devices connecting to the system. A daemon waits on USB events to implement whatever policy the user has specified. A shared library, libusbguard, exports an API for third-party applications to create their own programs that wish to use USBGuard's functionality. While USBGuard can't do anything about boot-time USB attacks, it can protect the ports once the operating system is up and running.

Identifying USB devices

USBGuard collects information about the devices the user owns to identify them, but it is not possible to generate a unique hash for every single USB device in existence. To generate a hash, USBGuard primarily relies on information inside the USB device descriptor, which is a data structure sent from the device to the host when it connects to a port on the computer. The device descriptor includes the manufacturer and model ID of the USB device. The descriptor also contains a field for serial number, but the USB spec makes it an optional field, except for USB storage devices. Therefore, there is no guarantee that the serial number will be present.

It is better to generate a hash with the serial number information if it is present, but if it isn't, then the default behavior for USBGuard is to enable port-specific rules for the connected device. The documentation notes that this is a security measure to ensure the policy is harder to bypass for devices without serial numbers, with the assumption that said device is always physically connected to a specific port.

Rule-based configuration

Configuring USBGuard policy is done using a rule-based language that lets a user specify whether to allow, block, or reject a device based on particular attributes. A device that is blocked will be listed by the operating system as being connected, but no communication is allowed for it. A device that is rejected will be completely ignored after it is inserted into the port.

When a device is inserted in the host, the rules list is scanned from beginning to end until a matching rule is found or, if it reaches the end without a match, then a default rule is applied. An initial policy can be created for the system using the usbguard command-line tool with the generate-policy sub-command that will add the currently connected USB devices to the list of allowed devices and create hashes to identify each device.

The following is an example of a rule, extracted from the documentation:

    allow with-interface equals { 08:*:* }

The colon separated triad of numbers refer to the USB interface class, subclass, and protocol, which in turn identifies the type of USB device. For example, the hexadecimal number 08 in the class segment of the interface identifier signifies a USB storage device. The example will let any USB storage device (wildcards indicate any subclass or protocol) work on the system. In the absence of any other rule, the default is to block everything else.

The following example is a rule allowing a specific device, also from the documentation:

   allow 1050:0011 name "Yubico Yubikey II" serial "0001234567" \
       via-port "1-2" hash "044b5e168d40ee0245478416caf3d998" \
       reject via-port "1-2"

The identifier 1050:0011 indicates that the device's manufacturer ID is 1050 (Yubico), and the product ID is 0011 (which is the Yubikey II). Therefore the above command will accept only a Yubikey II device with the given serial number and hash on either port 1 or 2 and reject everything else on that port. The hash is a value that is pre-generated when the user created a whitelist of devices they want to allow.

Development status

USBGuard is included with Red Hat Enterprise Linux 7.4 and later, and has found its way into other distributions too. On Ubuntu and Arch Linux, it is a community-supported optional install. The code is also available from its GitHub repository. The documentation in the repository warns that the 0.x releases are not production ready; since the latest release is numbered at 0.7.0, there is no production release of the software yet.

Conclusion

USBGuard gives users a way to lock down the USB ports of their machine while also enabling specific permissions for specific devices. It is particularly useful for machines that are accessible to the public or in an environment with many users, such as an office. USBGuard provides a reasonable defense against malicious USB devices, although such things are not widespread, at least yet. However, the attribute-based identification mechanism is only "good enough", as it is not possible to confirm the ID of a plugged-in device with 100% certainty, especially for non-storage USB devices without a serial number. It is also possible to spoof the information in the USB descriptor, thus if the policy rules are revealed to an attacker, the whitelist can be bypassed. Despite this, it is better than having no guards against USB attacks at all.

---

(Log in to post comments)