Hacker News new | ask | show | jobs
by NooneAtAll3 8 days ago
what ways are there to protect from malicious HID device?
3 comments

I know of https://usbguard.github.io/

But I remember that on Linux changing some /etc/udev file helped me with some naggy bug long ago. I worked temporary in an office with several wonky USB keyboards. Whenever someone disconnected their tablet or laptop from their KB (ie shut the lid), my linux would pick it up and suddenly connect to this KB. A little googling and some trial-error and I had my linux set-up that it would only connect to whitelisted USB devices.

Which, months later, caused me insane headaches when I could not find why a new USB microphone wasn't working, despite it being advertised as "works on linux"....

My computers ignore USB HIDs other than the ones that I have explicitly permitted. Unfortunately, this is a major architectural revamp for many operating systems. The idea that every HID is automatically added to a keyboard/mouse 'multiplexer', that provides a single combined input stream, is a pervasive one.
Some sort of USB firewall? Something you can share?
No. The multiplexers are all turned off, and I have devd/udev rules that spawn my own userspace driver processes (as services, via service management) to attach to the individual USB devices. The driver services in turn use an autoconfiguration system to determine whether they should actually attach to the device whose name they are passed, and where they should pass input onwards to.

* https://jdebp.uk/Softwares/nosh/guide/user-virtual-terminal-...

* https://jdebp.uk/Softwares/nosh/guide/commands/user-vt-reali...

This is for a virtual terminal system. For X11 or Wayland, one would have to replicate the same idea in an appropriate form, and stop using the multiplexed devices.

Use Qubes OS, https://qubes-os.org.