Using infected USB devices safely on Qubes

[fsflover]

@qqubes

The threat model is actually irrelevant to my question

No, it isn’t.

@qqubes

but you may assume life and death

In this case you should not rely on community volunteers and ask a real security expert.

@qqubes

Do not plug in any USB devices before Qubes is up and running.

Correct.

@qqubes

I have a PS/2 keyboard and touchpad, and a default sys-usb VM that automatically connects to my USB mouse. To be safe and make sure the infected device doesn’t get attached to sys-usb, I can shut it down in this step.

Looks right.

@qqubes

Create a disposable usb VM, and set the policy to not allow any input devices.

This policy is the default for a new usb qubes AFAIK. This step can be improved if you hardware allows that and if your threat model implies that usb controller firmware can be compromised. You should put separate USB controllers into the main sys-usb and the secondary one, if you have more than one usb controller. Some of these devices allow that.

In theory, a malicious USB device can not just compromise the OS in the sys-usb qube but also the USB firmware. See also: Reset / reinstall USB qube after compromise.

As a side note, I also recommend to create a disposable sys-usb for everything, including your mouse. By the way, it’s a default in Qubes 4.1.

See also: Proposed procedure for using untrusted USB drives.