Auditing USB Question
I'd like to audit the insertion and removal of all USB devices but I'm not sure where to start.
Do I need to be auditing a specific syscall, should it be a udev configuration?
Any tips would be greatly appreciated.
Thanks,
-josh
Quoted 13 lines · zhu xiuming
my guess is
-a always,exit -F arch=ARCH -S mount -F auid>=500 -F auid!=4294967295 -k exportrefer to http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf
On Wed, Jul 31, 2013 at 8:41 AM, Josh <[email protected]> wrote:
I'd like to audit the insertion and removal of all USB devices but I'm not sure where to start.Do I need to be auditing a specific syscall, should it be a udev configuration?
Any tips would be greatly appreciated.
Quoted 8 lines
Thanks,
-josh--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
That appears to only cover the mounting of filesystems, not any usb device insertion. Specifically I'd like to capture the insertion of a USB keyboard, USB mouse, or USB thumb-drive.
Thanks,
-josh
Quoted 5 lines · Josh
I'd like to audit the insertion and removal of all USB devices but I'm not sure where to start.
Do I need to be auditing a specific syscall, should it be a udev configuration?
Any tips would be greatly appreciated.
On my Mac (and BSM) I use syslog data to identify USB inserts, which includes the USB's manufacturer, model number, and serial number. Then I look at the mount command in the BSM data to see where it was mounted in the file system. Since I monitor all file reads and writes in BSM, I can also tell what files were read from or written to that USB thumb drive.
See if the Linux syslog messages contain the USB insert information.
Todd
Quoted 3 lines · Josh
That appears to only cover the mounting of filesystems, not any usb device insertion. Specifically I'd like to capture the insertion of a USB keyboard, USB mouse, or USB thumb-drive.
There is no support for that. Auditing is mostly shaped by common criteria requirements. CC takes the point of view that data import and export is of interest. In order to do that, you have to mount a file system. So, the solution is to watch for mounts. The act of inserting a device has not been considered security relevant because it also says that there is physical security of the data center and random people can't stick random devices into the computer
That said...there is the real world. I could see this being interesting for very paranoid setups where a random device could be inserted and start fuzzing the kernel to inject code. But if we consider this, there is also bluetooth and firewire and who knows what other interface to worry about.
It might be possible to find the udev code that gets executed and place a watch on that. Or perhaps modify udev code to send a AUDIT_TRUSTED_APP event which ausearch/report will not impose and control over.
-Steve
You don't have to mount media to pull off the data.
dd + one of any number of user space utils can extract data.
But, UDEV is probably the correct subsystem for this.
Trevor
Quoted 34 lines · Steve Grubb
Quoted 1 line · Josh
That appears to only cover the mounting of filesystems, not any usb
device
Quoted 2 lines
insertion. Specifically I'd like to capture the insertion of a USB keyboard, USB mouse, or USB thumb-drive.
There is no support for that. Auditing is mostly shaped by common criteria requirements. CC takes the point of view that data import and export is of interest. In order to do that, you have to mount a file system. So, the solution is to watch for mounts. The act of inserting a device has not been considered security relevant because it also says that there is physical security of the data center and random people can't stick random devices into
the computerThat said...there is the real world. I could see this being interesting for very paranoid setups where a random device could be inserted and start fuzzing
the kernel to inject code. But if we consider this, there is also bluetooth and firewire and who knows what other interface to worry about.It might be possible to find the udev code that gets executed and place a watch
on that. Or perhaps modify udev code to send aAUDIT_TRUSTED_APPevent which
ausearch/report will not impose and control over.-Steve
--
Linux-audit mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/linux-audit
Signature · 6 lines
Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 [email protected] -- This account not approved for unencrypted proprietary information --
Quoted 45 lines · Trevor Vaughan
You don't have to mount media to pull off the data.
dd + one of any number of user space utils can extract data.
But, UDEV is probably the correct subsystem for this.
Trevor
On Thu, Aug 1, 2013 at 12:35 PM, Steve Grubb <[email protected] <mailto:[email protected]>> wrote:
On Wednesday, July 31, 2013 08:15:21 PM Josh wrote:
> That appears to only cover the mounting of filesystems, not any usb device
> insertion. Specifically I'd like to capture the insertion of a USB > keyboard, USB mouse, or USB thumb-drive.There is no support for that. Auditing is mostly shaped by common criteria
requirements. CC takes the point of view that data import and export is of
interest. In order to do that, you have to mount a file system. So, the
solution is to watch for mounts. The act of inserting a device has not been
considered security relevant because it also says that there is physical
security of the data center and random people can't stick random devices into
the computerThat said...there is the real world. I could see this being interesting for
very paranoid setups where a random device could be inserted and start fuzzing
the kernel to inject code. But if we consider this, there is also bluetooth
and firewire and who knows what other interface to worry about.It might be possible to find the udev code that gets executed and place a watch
on that. Or perhaps modify udev code to send aAUDIT_TRUSTED_APPevent which
ausearch/report will not impose and control over.
Quoted 23 lines
-Steve
--
Linux-audit mailing list [email protected] <mailto:[email protected]>
https://www.redhat.com/mailman/listinfo/linux-auditSignature · 12 lines
Trevor Vaughan Vice President, Onyx Point, Inc (410) 541-6699 [email protected] <mailto:[email protected]> -- This account not approved for unencrypted proprietary information -- -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
I decided to write a simple udev rule that is triggered when a USB device is added. From here I can use environment variables to choose which data gets sent to the audit system as a USER message. This will be enough for our purposes.
For reverence, here is the udev rule:
ACTION=="add", SUBSYSTEM=="usb", RUN+="/usr/local/sbin/usb_device_add.sh"
Thanks!
-josh