Account 로그인

Most people don’t consider their average USB memory stick to be a security threat. In fact, in a social engineering experiment conducted in 2016 at the University of Illinois and detailed in this research paper, a group of researchers dropped 297 USB sticks outside in the parking lot, in the hallway, and classrooms. Of the 297 USB sticks dropped,

290 were picked up and 135 (45%) called home. In order to encourage people to pick them up, some keys had door keys attached, some said “confidential” and some said “final exam” and had file names. As a result, the most opened keys were those collected in the parking lot (53%), while 68% of collectors said that they had plugged it in and opened files to determine the owner. Also, 20% of keys were opened in the first hour, and 70% within 35 hours. This type of social engineered USB attack is effective with an estimated success rate of 45-98% and expeditious with the first drive connected in less than six minutes. One of the researchers who conducted this experiment, Elie Bursztein, presented his findings at the 2016 Black Hat Conference and declared that they had been able to drop the USB sticks and it was “job done”.

Another reminder of the damage a USB security attack can cause is the highly destructive Stuxnet worm that was used to degrade and destroy hundreds of centrifuges at Iran’s uranium enrichment facility at Natanz a few years ago. This attack was in fact, initially introduced into the systems via an infected USB stick.

The fact that users plug such storage devices into corporate computers is obviously a nightmare for IT security professionals. USB sticks can be loaded with spyware, malware, or Trojans, which can not only steal your data but even destroy your computer. The good news is that, if you are a Red Hat Enterprise Linux user, you can prevent these USB attacks with USBGuard, which is included with the release of Red Hat Enterprise Linux 7.4. Inspiration for this is drawn from exploits like BadUSB.

USBGuard is a software framework that protects your systems against rogue USB devices by implementing basic whitelisting and blacklisting capabilities based on device attributes. This allows you to define access control to USB devices. For example, you can define what kind of USB devices are authorized and how a USB device may interact with your system.  It enables you to lock down all USB devices from user space.

There are three main use cases for USBGuard: USB device whitelisting, USB device blacklisting, and triggering actions on USB device events. USBGuard can permit only known devices to create interfaces to it via USB (aka USB device whitelisting). Conversely, if a user doesn’t want to use a particular class of interfaces, he/she can block devices that want to communicate with the computer as an interface from that class (aka USB device blacklisting).   The final use case for USBGuard would be triggering actions on USB device events, such as when a particular USB device or USB device class is inserted, removed, etc. This feature might be used for auditing USB usage, screen locking ,etc.

USBGuard is not installed by default. However, in Red Hat Enterprise Linux, you can install the precompiled packages in the Extras repository.  Once installed, you control USBGuard by the settings in its usbguard-daemon.conf file, which is the USBGuard daemon configuration file. Then the daemon will decide which USB device to authorize based on a policy defined by a set of rules. When a USB device is inserted into the system, the daemon scans the existing rules sequentially and when a matching rule is found, it either authorizes(allows), deauthorizes (blocks), or removes (rejects) the device, based on the rule target. The default is to block the device until a decision is made by the user.

A quick way to start using USBGuard to protect your system from USB attacks is to first generate a policy for your system. Then, start the usbguard-daemon (systemctl start usbguard.service). You can use the USBGuard CLI command and its generate-policy subcommand to generate an initial policy for your system instead of writing one from scratch. The tool generates an allow policy for all devices currently connected to your system at the moment of execution. There are several options to tweak the resulting policy as outlined here.  The typical workflow for generating an initial policy could look like this:

# usbguard generate-policy > rules.conf
# vi rules.conf
(review/modify the rule set)
# sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
# sudo systemctl start usbguard.service

So what are you waiting for? If you want to safeguard your systems against USB based security attacks, be sure to install and utilize USBGuard for all your Red Hat Enterprise Linux systems!


About the author

Red Hat logo LinkedInYouTubeFacebookTwitter

제품

구매 정보

커뮤니케이션

Red Hat 소개

Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.

Red Hat Shares 뉴스레터를 구독하세요

지금 신청하기

언어 선택

© 2022 Red Hat, Inc. Red Hat Summit