why?
using USB devices are unavoidable sometimes this Is a way i found to make it even more secure trough mostly boredom and what If questions.
In no way I want to disregard the amazing work all the maintainers and developers of QubesOS have done, this is just a way I thought of making it even more secure at the cost of considerable ease of use I understand absolutely why this is not a thing by default
this approach has two big advantages:
1. using unknown/untrusted USBs as a direct hint to an attempt of unauthorized access
in this case we’d be using random unknown USB devices being plugged in as a heuristic sign of an attack since this script makes it easy for you to setup all your USB devices which saves each device as a different pattern for grep to ignore so none or all trusted devices and anywhere in-between can be plugged in at once so if any unknown device is plugged in the script would assume its an attacker shutting down your device (gracefully by default but can be easily changed) taking all encryption keys off of ram and massively decreasing attack surface to essentially hardware or encryption attacks which having your machine on all the time wouldn’t protect you from anyways so its way more desirable to have your system in this state if an attacker with physical access was trying to break into it.
2. minimizing damage from hardware USB keyloggers and making detection as best as a post disk passphrase service can
If an attacker plants a USB keylogger which are very inexpensive and easily available you’d probably would have no idea unless you physically check manually each time which is tiring, in this scenario you’d still would get your disk password compromised which is much worse than getting your user password compromised but would help you realize it as soon as possible..
disclaimer: this is currently in “beta” I’ve tested it myself which makes me confident enough to publish but this has not been thoroughly tested on any machine other than my own.
also if you have a USB keyboard you should add a second one into your trusted file so if your main keyboard breaks you won’t have to recover the system
how to do this?
it uses a simple bash script and a service in dom0 so we have access to qvm-usb to make sure we have a consistent output format from qvm-usb list and making sure we can shut off as soon as possible
create trusted db first
to create the trusted USBs “db” first plug in all USBs that you see yourself using regularly then run this command in dom0 (note this whole command is written inside the script verbatim if you want to copy it from there), this commands strips backend vm and devid + if its attached to any qube it will strip that text also to make sure you only get the actual device ID for the pattern matching in the script note what path you have your trust db in and edit it inside the script if its different
qvm-usb list | awk '{if ($NF ~ /\)$/) { $(NF-1)=""; $NF=""; sub(/ +/, " "); $1="" }print}' >> trusted
now we must make the script which is meant to run as a file copy the code below into a file also in dom0
#!/usr/bin/env bash
set -o pipefail
trustedfile=/home/user/trusted # change here for wheres your trusted file
# generate trusted file by running qvm-usb list | awk '{if ($NF ~ /\)$/) { $(NF-1)=""; $NF=""; sub(/ +/, " "); $1="" }print}' >> trusted
trustdb_usbs=$(cat $trustedfile | tr '\n' '|' | sed 's/.$//' ) || exit 1
# change newlines to | instead so each entry in trusted will be a different pattern for grep
i=0
z="z"
#forever loop so it can be setup as a user service
while true; do
sleep 1
#make sure sys-usb is running every 10 iterations
if ((i > 10)) || [[ "$z" = "z" ]] ;then
i=0
if ! qvm-check --running sys-usb &> /dev/null ;then
#sys-usb isnt running so sleep and check again later
sleep 10
z="z"
continue
else
#sys-usb is running so we unset z to make sure we dont keep running the test infinitely
unset z
fi
fi
if qvm-usb list | grep -vE "$trustdb_usbs" ;then
#untrusted usb has been plugged in
notify-send -u critical "usb-killer" "USB PLUGGED SHUTTING DOWN.."
systemctl poweroff --now
echo "usbKillSwitch activated at $(date)" >> ~/.usbKill.log
break
fi
((i++))
done
copy this to a file in /usbkill.sh (easier to type in dom0) then in dom0 run
qvm-run -p <source_domain> cat /usbkill.sh > UsbKillSwitch.sh
after you’ve looked at the code and it looks good to you save the file and set it as executable with chmod +x killswitch.sh. also remember to change the trusted file path if its different in your machine
now we should make a service to have our killswitch running on the background all the time
mkdir -p ~/.config/systemd/user/ && nano ~/.config/systemd/user/usb_Kill_Switch.service
then paste the following (I don’t have much experience with systemd services please correct me if I’m doing something wrong)
[Unit]
Description=shutdown system if any untrusted usb is plugged in
[Service]
ExecStart=/home/user/UsbKillSwitch.sh #adjust change path if needed
Restart=on-failure
RestartSec=5
[Install]
WantedBy=default.target
then enable your service
systemctl --user enable --now usb_Kill_Switch.service
now antime a usb gets plugged in which Isn’t inside your trusted file the system will automatically shutdown!
please let me know if I’m missing something or something could’ve been done better this was a hobby project for me I thought I’d share with the community, pretty niche but I hope this would be to some use to someone…