Differences to USBGuard project about ukip HOT 6 CLOSED

I would primarily be interested in the differences to usbauth, which has done a very good job so far. Furthermore, since Gnome 3.36 there is also another kind of "USB Guard" which can be activated via desktop options. Also the differences to this solution would be interesting to know. But on the basis of the previous solutions, I don't know what Google does better here?

from ukip.

Hey @techge Thanks for the question :-) Our tool analyzes the timings between a pre-set window of keystrokes and if they reach a certain threshold, it blocks the causing USB device. For USBGuard, I am quoting from the their website here: "USBGuard is implementing basic whitelisting and blacklisting capabilities based on device attributes". For example, you can set a policy like "Allow a USB device on insertion, where an interface matches a certain product ID and vendor ID. Block every other device not matching those attributes". Once you plug the device that matches those pre-set parameters, it gets blocked (https://usbguard.github.io/documentation/rule-language.html). Also, an awesome feature that USBGuard offers is the blocking of new USB devices, that are plugged in while the screen is locked (https://usbguard.github.io/blog/2017/Screen-Locking). So those two projects are pretty symbiotic: One can use our tool as a heuristic analyzer that blocks fast typing BadUSB-like attacks and USBGuard for setting policies for USB devices.

@FOSSONLY Thanks for your question! Please see my answer to @techge for USBGuard. For the differences between USBGuard and usbauth (if you meant the project by Stefan Koch over here: https://github.com/kochstefan/usbauth-all) please see page 68 ("Seite 66") in the linked article in usbauths README: https://github.com/kochstefan/usbauth-all#usbauth-usb-firewall-suite ( -> https://epub.uni-bayreuth.de/3048/1/koch2017sicherheitsaspekte.pdf). On that page the author compares USBGuard to usbauth.
Regarding "Gnome 3.36 there is also another kind of "USB Guard" which can be activated via desktop options": If you are referring to https://github.com/6E006B/usbguard-gnome As far as I understood, that's a GNOME interface for USBGuard.

from ukip.

Thank you very much @sebastian9er now I understand the difference :)

from ukip.

btw

Our tool analyzes the timings between a pre-set window of keystrokes and if they reach a certain threshold, it blocks the causing USB device.

This or a similar information what ukip is doing would have helped me in the first place. Maybe it is only me, maybe the README could use some note.

from ukip.

That's a really good point, thanks @techge !
Have you seen https://opensource.googleblog.com/2020/03/usb-keystroke-injection-protection.html ?
But in any case, I will add a note in the README :-)

from ukip.

I see, actually I didn't know that blog post before, just came here after reading a media article about ukip :)

from ukip.