Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #243871

Re: How to secure access to SD cards a la USBGuard?

Show all headers | View raw

On 2022-01-11 12:41, Andrei POPESCU wrote:
> On Du, 02 ian 22, 20:52:25, David Wright wrote:
>> On Fri 10 Dec 2021 at 17:20:52 (+0100), Andrei POPESCU wrote:
>>> On Lu, 06 dec 21, 10:18:49, David Wright wrote:
>>>> On Sun 05 Dec 2021 at 13:33:41 (+0100), Andrei POPESCU wrote:
>>>>> On Vi, 12 nov 21, 12:27:59, Stefan Monnier wrote:
>>>>>>
>>>>>> As mentioned, the way to control it will depend on the specific tool
>>>>>> used to mount.  E.g. if it's mounted by hand via a rule in /etc/fstab,
>>>>>> then you can rules that specify the device via /etc/disk/by-uuid.
>>>>>>
>>>>>> Do note that partition UUIDs are not designed to be reliable w.r.t
>>>>>> malicious uses (it's easy to create a partition with the same UUID as
>>>>>> some other).
>>>>>
>>>>> /dev/disk/by-id/ should be device specific.
>>>>
>>>> It certainly is, but specific to the card reader reading it,
>>>> not the card. And that's whether the card is plugged into a
>>>> slot on the computer, or into a discrete SD/USB adapter.
>>>
>>> At least with the built-in reader on an Acer Chromebook R13 the ID
>>> changes with every card I tested, but you are indeed right about USB
>>> adapters (at least for the two I could test).
>>
>> I did some comparisons between machines, and it would appear that
>> when the link starts with /dev/disk/by-id/mmc- then the ID is
>> that of the card, whereas when it starts with /dev/disk/by-id/usb-
>> then the ID is that of the card reader. Note that I did all the
>> comparisons using fullsize SD cards pushed into slots in the PCs,
>> so there were no separate adapters involved, neither SD→USB, nor µSD→SD.
> 
> My guess is micro-SD to SD adapters are passive only (i.e. just
> connecting pin-to-pin as needed), so it shouldn't matter.
> 
> For the OP's issue, it seems a possible solution would be to disallow
> any USB-to-SD adapters, and for the (hopefully few) users that really
> need to use SD cards to use MMC-style slots only.

I am afraid that I won't be able to exclude SD cards from use. They are 
in use right now and changing that policy would create too much negative 
sentiment among the users of these systems/laptops. We have a hard 
enough time to get them to comply as it is. Plus, I try to accommodate 
our users where I can, so that they know I am doing my best to not get 
in their way unless it can't be done in another way. This has paid many 
dividends in the past, where others were not able to get our users to 
cooperate and they would when I asked them. Just because they trust I am 
doing my best to think of them. I am very careful not to waste that 
goodwill.

> A less secure option would be to allow USB adapters only for a few
> select *trusted* users, with the understanding that they use "safe" SD
> cards only.

The problem is that a significant number of those users is not very much 
security aware. In the past I have been able to demonstrate many many 
social engineering and technical attacks to them, and still they fall 
for it. It is not that they are unwilling or dumb. They just don't get 
how computers (or indeed they themselves) can be manipulated so easily. 
They expect us admins to make that impossible, but they also don't want 
to be bothered by any measures we take...

I am still trying to find a manageable and dependable way to limit the 
mounting of storage devices to devices (not filesystems) that have been 
vetted up front.

Thanks for taking the time to help me with this!

Grx HdV

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

How to secure access to SD cards a la USBGuard? "hdv@gmail" <hdv.jadev@gmail.com> - 2021-11-11 18:50 +0100
  Re: How to secure access to SD cards a la USBGuard? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-11-12 17:20 +0100
    Re: How to secure access to SD cards a la USBGuard? "hdv@gmail" <hdv.jadev@gmail.com> - 2021-11-12 18:10 +0100
      Re: How to secure access to SD cards a la USBGuard? Stefan Monnier <monnier@iro.umontreal.ca> - 2021-11-12 18:30 +0100
        Re: How to secure access to SD cards a la USBGuard? Andrei POPESCU <andreimpopescu@gmail.com> - 2021-12-05 13:40 +0100
          Re: How to secure access to SD cards a la USBGuard? "hdv@gmail" <hdv.jadev@gmail.com> - 2021-12-05 14:20 +0100
            Re: How to secure access to SD cards a la USBGuard? David Wright <deblis@lionunicorn.co.uk> - 2021-12-06 17:20 +0100
          Re: How to secure access to SD cards a la USBGuard? David Wright <deblis@lionunicorn.co.uk> - 2021-12-06 17:20 +0100
            Re: How to secure access to SD cards a la USBGuard? Andrei POPESCU <andreimpopescu@gmail.com> - 2021-12-10 17:30 +0100
              Re: How to secure access to SD cards a la USBGuard? David Wright <deblis@lionunicorn.co.uk> - 2022-01-03 04:00 +0100
                Re: How to secure access to SD cards a la USBGuard? Andrei POPESCU <andreimpopescu@gmail.com> - 2022-01-11 12:50 +0100
                Re: How to secure access to SD cards a la USBGuard? "hdv@gmail" <hdv.jadev@gmail.com> - 2022-01-11 17:50 +0100

csiph-web