Slashdot Mirror
USB Canary Sends An SMS When Someone Tinkers With Your USB Ports (bleepingcomputer.com)
An anonymous reader quotes a report from BleepingComputer: A new tool released on GitHub last week can help paranoid sysadmins keep track of whenever someone plugs in or disconnects an USB-based device from high-value workstations. Called USB Canary, this tool is coded in Python and currently, works only on Linux (versions for Windows and Mac are in the works). The tool works by watching USB ports for any activity while the computer is locked, which generally means the owner has left his desk. If an USB device is plugged in or unplugged, USB Canary can perform one of two actions, or both. It can alert the owner by sending an SMS message via the Twilio API, or it can post a message in a Slack channel, which can be monitored by other co-workers. USB Canary can prove to be a very useful tool for large organizations that feature strict PC policies. For example, if you really want to enforce a "No USB drives" at work, this could be the tool for the job. Further, with modifications, it could be used for logging USB activity on air-gapped systems.
fp
Suck it Trebek!
epoxy in the USB ports works wonders!
Because if you're really serious, you take python to tell you by slack something or other happened. Much better than, say, turning all USB ports off via BIOS, then disconnecting them, and gluing them shut for good measure. Because USB is the future and dedicated PS/2 ports are for chumps.
If you really want to keep people from plugging random shit into a system, just fill the USB ports with resin or caulk and super-glue the keyboard and mouse cables in place.
FWIW, usb ports can be used to hack systems at the microcode level, no OS interaction needed.
In fact, usb microcode hacking was how the PS3 was eventually cracked.
Most security conscious organization killed WiFi so just pull enet cord, insert usb, then hard reboot. Forget only when logged in the trigger should be tied to approved devices like keyboards and mice and any other device flags...Or just flag all state changes for secure rooms, assuming such areas are enforced for sensitive up or personal data. Windows already has similar tools.
boycott USB now before its too late!!!
I've heard stories about how businessmen staying in Chinese hotels leave their laptops in the room while going out, and the "maid" comes in, sticks in a USB drive, and downloads all the files.
I've often wondered if it's possible to make a spring-loaded trap that would clamp down on a USB device and prevent it from being removed. The USB connector has 2 square holes that square pegs might fit into.
It might be possible to "fish" for these foreign USB devices, and reverse engineer them to see what sorts of attack they use.
you may as well burn your computer... Why not just have a USB self destruct, once someone has "tinkered" with your USB ports you can't guarantee anything.
Plug in an unauthorized USB stick at my job and security will be at your desk in five minutes to confiscate it.
Creating your own udev rules for USB device attach/detach is possible without Python, especially not as a service (which is what this appears to be). udev has the RUN argument which can run a program/shell script/whatever on an event. I understand that one may want to use Python or any other PL for utilising an HTTP-based API (re: Twilio, Slack, etc.), but I do not understand the design choice of having this run as a daemon.
I also urge others to look at the prerequisites (refer to GitHub); this does not appear to be KISS-compliant in the least, and the description in Getting Started is downright bullshit (re: "for some this may seem like a bad idea, but it's better than recreating the wheel or rolling your own crypto" -- what wheel would need to be recreated? And why would you need to "roll your own crypto" for device monitoring to work? Using an HTTP API via HTTPS does not require one "roll their own crypto")
I use usbguard but I still don't trust the $1 usb drives I bought.
auditd
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Counter-Canary to the USB-Canary Killer.
The never ending game of peripheral warfare...
If you don't want USB devices being used just disaable "USB Storage Devices" altogether in your system policies
When I saw the headline, my first thought was "I could probably do this pretty quickly on a Linux machine in Python."
Then I read the summary.
http://www.nirsoft.net/utils/usb_log_view.html
Which one wins the race? The USB kill stick as it does its powerful best to fry your MoBo, or the Python code trying to send out a network message before some critical component coughs up smoke? My money's on the kill stick.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
I came here to read about suicides, death threats, people linking to some research about the pros/cons of a green-to-orange transition in nerd communities, etc. And then I realised about today's date and well... nice one, Slashdot! The doomsday-like alternative would have been much funnier though.
Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
Just unplug the network and this utility is no longer useful.
This fact doesn't make the utility worthless... only much less effective against someone who is actually thinking about an attack rather than your roommate who just wants to see what king of porno you are into.
What we really need is a BIOS that will perform an immediate power-off (not "shutdown") if a device is plugged-in during sleep mode, or any other time when the device needs to be "secure."
I have a new MacBook Pro, so I don't have to worry about people messing with the USB ports because there isn't anything available that works with them.
The joke should be pretty obvious though, just read the headline and replace a few words.
Sorry I just don't want to lose my job or get in any trouble :)
I tend to rant.