From mboxrd@z Thu Jan 1 00:00:00 1970 From: Josh Subject: Re: Auditing USB Question Date: Fri, 02 Aug 2013 10:30:54 -0400 Message-ID: <51FBC29E.4070603@gmail.com> References: <51F93037.5000202@gmail.com> <7DF115C1-B9AB-4F69-8D28-FBF4A4E304BA@gmail.com> <2851419.3BDt02r3tb@x2> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1730045302294608345==" Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id r72EUwX6021470 for ; Fri, 2 Aug 2013 10:30:58 -0400 Received: from mail-ve0-f173.google.com (mail-ve0-f173.google.com [209.85.128.173]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r72EUuWU007719 for ; Fri, 2 Aug 2013 10:30:57 -0400 Received: by mail-ve0-f173.google.com with SMTP id cy12so728876veb.32 for ; Fri, 02 Aug 2013 07:30:56 -0700 (PDT) Received: from sis-jak-d02.ctisl.gtri.org (frontend.gtri.gatech.edu. [130.207.218.196]) by mx.google.com with ESMTPSA id qh6sm571286vec.0.2013.08.02.07.30.55 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Fri, 02 Aug 2013 07:30:55 -0700 (PDT) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============1730045302294608345== Content-Type: multipart/alternative; boundary="------------010908000507070005010300" This is a multi-part message in MIME format. --------------010908000507070005010300 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit On 08/01/2013 02:04 PM, Trevor Vaughan wrote: > You don't have to mount media to pull off the data. > > dd + one of any number of user space utils can extract data. > > But, UDEV is probably the correct subsystem for this. > > Trevor > > > On Thu, Aug 1, 2013 at 12:35 PM, Steve Grubb > wrote: > > On Wednesday, July 31, 2013 08:15:21 PM Josh wrote: > > That appears to only cover the mounting of filesystems, not any > usb device > > insertion. Specifically I'd like to capture the insertion of a USB > > keyboard, USB mouse, or USB thumb-drive. > > There is no support for that. Auditing is mostly shaped by common > criteria > requirements. CC takes the point of view that data import and > export is of > interest. In order to do that, you have to mount a file system. > So, the > solution is to watch for mounts. The act of inserting a device has > not been > considered security relevant because it also says that there is > physical > security of the data center and random people can't stick random > devices into > the computer > > That said...there is the real world. I could see this being > interesting for > very paranoid setups where a random device could be inserted and > start fuzzing > the kernel to inject code. But if we consider this, there is also > bluetooth > and firewire and who knows what other interface to worry about. > > It might be possible to find the udev code that gets executed and > place a watch > on that. Or perhaps modify udev code to send a AUDIT_TRUSTED_APP > event which > ausearch/report will not impose and control over. > > -Steve > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit > > > > > -- > Trevor Vaughan > Vice President, Onyx Point, Inc > (410) 541-6699 > tvaughan@onyxpoint.com > > -- This account not approved for unencrypted proprietary information -- > > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit I decided to write a simple udev rule that is triggered when a USB device is added. From here I can use environment variables to choose which data gets sent to the audit system as a USER message. This will be enough for our purposes. For reverence, here is the udev rule: ACTION=="add", SUBSYSTEM=="usb", RUN+="/usr/local/sbin/usb_device_add.sh" Thanks! -josh --------------010908000507070005010300 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit
On 08/01/2013 02:04 PM, Trevor Vaughan wrote:
You don't have to mount media to pull off the data.

dd + one of any number of user space utils can extract data.

But, UDEV is probably the correct subsystem for this.

Trevor


On Thu, Aug 1, 2013 at 12:35 PM, Steve Grubb <sgrubb@redhat.com> wrote:
On Wednesday, July 31, 2013 08:15:21 PM Josh wrote:
> That appears to only cover the mounting of filesystems, not any usb device
> insertion.  Specifically I'd like to capture the insertion of a USB
> keyboard, USB mouse, or USB thumb-drive.

There is no support for that. Auditing is mostly shaped by common criteria
requirements. CC takes the point of view that data import and export is of
interest. In order to do that, you have to mount a file system. So, the
solution is to watch for mounts. The act of inserting a device has not been
considered security relevant because it also says that there is physical
security of the data center and random people can't stick random devices into
the computer

That said...there is the real world. I could see this being interesting for
very paranoid setups where a random device could be inserted and start fuzzing
the kernel to inject code. But if we consider this, there is also bluetooth
and firewire and who knows what other interface to worry about.

It might be possible to find the udev code that gets executed and place a watch
on that. Or perhaps modify udev code to send a AUDIT_TRUSTED_APP event which
ausearch/report will not impose and control over.

-Steve

--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit



--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699
tvaughan@onyxpoint.com

-- This account not approved for unencrypted proprietary information -- 


--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

I decided to write a simple udev rule that is triggered when a USB device is added.  From here I can use environment variables to choose which data gets sent to the audit system as a USER message.  This will be enough for our purposes.

For reverence, here is the udev rule:

ACTION=="add", SUBSYSTEM=="usb", RUN+="/usr/local/sbin/usb_device_add.sh"

Thanks!
-josh
--------------010908000507070005010300-- --===============1730045302294608345== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1730045302294608345==--