In a previous diary, I presented the CIRCLean (USB sanitizer) developed by the Luxembourg CERT (circl.lu). This tool is very useful to sanitize suspicious USB sticks but it lacks of control and enforcement. Nevertheless, how to prevent the user to insert the original USB stick in a port of his computer? 

Amongst many commercial products, Powershell is a good solution! As it interacts nicely with the operating systems, useful actions can be programmed when a specific event occurs like… the insertion of a USB stick. Specific events can registered like this:

Register-WmiEvent -Query <query> -SourceIdentifier <name> -Action { <script block> }

The "query", in WMI Query Language (WQL) format, specifies the WMI event class on which events must be attached. The "name" must be a unique identifier. In "script block", we define the actions to take. In our case, we must monitor the Win32_LogicalDisk instances and define two actions: when a new instance is created (USB stick inserted) and deleted (USB stick removed).

Then, we can use the magic of Powershell to perform plenty of useful actions… In my example, I’m just testing the presence of a specific log file (created by CIRCLean) and if it is not older than 2 days. If the file is not present or older, we just unmount the file system to present the user to access it and display a pop up message. I admin, the current check is not bullet proof but we could elaborate more robust scenarios:

• Call directly the PyCIRCLean framework and skip the need of a Raspberry Pi (but Python must be available on the workstation)
• Use the other CIRCLean log file called /log/content.log which contains hashes
• Generate a hash of files and test them against VT
• Just generate an alert (Syslog, mail, SNMP, WMI, ...)
• ... (just adapt it to your environment)

The script can be deployed via a login script on the workstation that must be protected. To unregister the new event, just do this (ex: at logout)

Unregister-Event RemovableDiskDetection

The script is available on my github repository. Here is a small video which demonstrates how it works( https://www.youtube.com/watch?v=3wXk_524qPs): I insert a USB stick which contains the processing.log file, it is mounted. Then I delete the file, eject and reinsert it, access is now denied!

Xavier Mertens
ISC Handler - Freelance Security Consultant
PGP Key