We’ve all come across a USB stick (or something that looks like one) in the street, at school or at work. Without a USB sanitization station (known in French as a “station blanche”), it’s hard to plug it in without taking a risk.
Note: this article summarises a project that ran over several months, in which I set out to learn about and build my own sanitization station. Some elements were open to interpretation.
What is a USB sanitization station?
A sanitization station is a workstation isolated from the production network, dedicated to analysing removable media to determine whether they can safely be used on that network.
In practice, it’s a computer whose operating system scans any device plugged into it and tells us whether it looks clean.
You’ll rarely find one in a home, but they’re fairly common in the defence sector, on military bases, in the pharmaceutical industry and in research labs.
The problem
A huge number of attacks rely on removable media. Attackers exploit the weakest link: humans, with their flaws, including kindness (holding the door open for someone without checking they have a badge to enter the building) and curiosity.
To be clear, these are normally good qualities, but in this context they become weaknesses.
It’s very easy to drop an infected USB stick on the floor, in the middle of a corridor or outside the offices of a targeted company.
Curiosity then pushes someone to plug the stick into their computer, and there aren’t many ways to check whether the data is legitimate before doing so. Even if the antivirus warns them, there’s a good chance they’ll accept the risk to satisfy their curiosity. An entire network can be compromised this way, and the signs of a compromised computer aren’t always obvious.
One solution is to set up a sanitization station (sometimes called a disinfection station, a term I’m less keen on because it implies the station must clean the stick, which can prevent a more detailed analysis of the device if an alert is raised).
Challenges
Before going further, let me explain the main problem I faced during this project. I ran into small issues all along, which is normal and even reassuring, and they were always solved.
The major problem, however, was the lack of information, open-source projects and documentation. Apart from the ANSSI report, which is very thorough, most projects are commercial, so I couldn’t draw inspiration from them, look at their source code and so on.
This may actually have been an advantage: I had to interpret and invent certain things myself.
Threats to the sanitization station
To build an effective sanitization station, you first need to define the threats:
- Legitimate user: inserts compromised media or makes a handling error.
- Unauthorised user: gains physical access to the station.
- Attacker with administrator rights: the attacker has managed to compromise an administrator account.
To protect against threats from legitimate users, give them the minimum permissions and keep their interaction with the user interface to a minimum.
To protect against unauthorised users, I came up with two solutions. The first is to place the station somewhere secure, such as a building only employees can enter with a badge. The second is to put it in a busy area so there are always eyes on whoever uses it. A series of hardening measures will also reduce the attack surface.
To protect against an attacker with administrator rights, isolate the machine from the production network or, better still, keep it offline. At the same time, harden the operating system.
Features of the sanitization station
The first choice is the machine itself. For this proof of concept, I worked on a virtual machine, but to deploy the solution in a company you need a dedicated machine, preferably an old one, in case someone plugs in a device like a USB Killer, which sends electrical surges. Another element I left out, but which should be part of any real deployment, is video surveillance of the machine to detect physical tampering. Combined with physical access control, this greatly reduces the risks.
I chose a lightweight Debian-based operating system. Cybersecurity budgets are often tight, so the machine is likely to be low-spec, and it will probably break from time to time; a small OS is quicker to reinstall. The hard drive is encrypted, which helps protect against unauthorised users who gain physical access to the machine.
The main feature is scanning removable media. For this, I chose several antivirus engines, including ClamAV, which keeps an offline database of virus signatures.
When a device is plugged into a USB port, a script runs ClamAV against /media. Here’s what the command looks like:
clamscan -i -r -z /media/Other security tools can then be added, as we’ll see below.
Hardening the sanitization station
At the start of the project, I thought scanning was the most important part of the station, and it is, but system hardening comes a close second. It’s the step I found most interesting, because it applies to every project. Unfortunately, it’s often skipped through lack of knowledge or procrastination.
For hardening, I discovered Lynis. It’s extremely simple to use: the command below audits your system:
sudo lynis audit systemThe audit takes a few minutes and returns a list of warnings, suggestions and errors to improve your system. Let’s be clear: this is very time-consuming work, and I still haven’t finished on my station, but I applied the Pareto principle, i.e. 20% of the effort for 80% of the results. That leaves 80% of the effort for the last 20% of the results.
Recommendations include:
- protecting the GRUB boot loader
- installing an Intrusion Detection System (IDS)
- enabling logging for certain services
In short, plenty of advice that’s just as useful on a sanitization station as on a web server.
Updating the sanitization station
However hard we work to reduce the station’s attack surface at a given moment, its vulnerabilities will grow over time, so it must be updated regularly. There are several ways to do this.
Initially, I connected the station to the internet, but on a network separate from the company’s, behind a firewall with a strict policy, so I could update the OS and the ClamAV database. Thanks to Lynis, I discovered tools such as Debsecan, which lists the CVEs affecting the packages installed on the station, and Debsums, which checks installed files against their packages’ MD5 checksums.
The best method is still never to connect the station to the internet, and to update it manually by downloading packages on another clean machine and transferring them by USB (a method I haven’t implemented yet).
Room for improvement
As you can see, a sanitization station is a never-ending project. I thoroughly enjoyed it and learnt a great deal. My main takeaway is that the tool is useful but not infallible. If you’re curious, I encourage you to try building one yourself. For everyone else who still lacks a similar tool at work, there are various commercial solutions available online.
Leave a Reply