cis-ubuntu2004-v300-1-1-1-9

Ensure usb-storage kernel module is not available

Profile

Level 1 - Server, Level 2 - Workstation, Assessment: Automated

Description

USB storage provides a means to transfer and store files ensuring persistence and availability of the files independent of network connection status. Its popularity and utility has led to USB-based malware being a simple and common means for network infiltration and a first step to establishing a persistent threat within a networked environment.

Rationale

Restricting USB access on the system will decrease the physical attack surface for a device and diminish the possible vectors to introduce malware.

Impact

Disabling the usb-storage module will disable any usage of USB storage devices.

If requirements and local site policy allow the use of such devices, other solutions should be configured accordingly instead. One example of a commonly used solution is USBGuard.

Audit Procedure

Command Line

Verify the usb-storage kernel module is not available on the system - OR - has been disabled.

Run the following script to determine if the usb-storage kernel module is available on the system:

#!/usr/bin/env bash

{
   l_mod_name="usb-storage" l_mod_type="drivers"
   while IFS= read -r l_mod_path; do
      if [ -d "$l_mod_path/${l_mod_name}//-/\/" ] &&  [ -n "$(ls -A "$l_mod_path/${l_mod_name}//-/\/")" ]; then
         printf '%s\n' "$l_mod_name exists in $l_mod_path"
      fi
   done < <(readlink -f /usr/lib/modules/**/kernel/$l_mod_type || readlink -f /lib/modules/**/kernel/$l_mod_type)
}

If nothing is returned, the usb-storage kernel module is not available on the system and no further audit steps are required.

Note: Some systems may include the usb-storage filesystem as part of the kernel opposed to being available as a kernel module. In this case, the above audit will not return anything. This is also considered a passing state.

If anything is returned, verify the usb-storage kernel module is not loaded and not loadable by performing the following:

Run the following command to verify the usb-storage kernel module is not loaded:

# lsmod | grep -P -- 'usb(_|-)storage'

Nothing should be returned

Run the following command to verify the usb-storage kernel module is not loadable:

# modprobe --showconfig | grep -P -- '\b(install|blacklist)\h+usb_storage\b'

Verify the output includes:

blacklist usb_storage
 -AND-
install usb_storage /bin/false
 -OR-
install usb_storage /bin/true

Expected Result

blacklist usb_storage
install usb_storage /bin/false

Remediation

Command Line

Run the following commands to unload the usb-storage kernel module:

# modprobe -r usb-storage 2>/dev/null
# rmmod usb-storage 2>/dev/null

Perform the following to disable the usb-storage kernel module:

Create a file ending in .conf with install usb_storage /bin/false in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "install usb_storage /bin/false" >> usb-storage.conf

Create a file ending in .conf with blacklist usb_storage in the /etc/modprobe.d/ directory

Example:

# printf '\n%s\n' "blacklist usb_storage" >> usb-storage.conf

Default Value

Not disabled by default.

References

1. NIST SP 800-53 Rev. 5: SI-3
2. RHEL 8 STIG Vul ID: V-230503
3. RHEL 8 STIG Rule ID: SV-230503r942936
4. Ubuntu 22.04 STIG Vul ID: V-260540
5. Ubuntu 22.04 STIG Rule ID: SV-260540r986276

CIS Controls

v8 - 10.3 Disable Autorun and Autoplay for Removable Media (IG 1, IG 2, IG 3) v7 - 13.7 Manage USB Devices (IG 2, IG 3)

MITRE ATT&CK Mappings: T1052, T1052.001, T1091, T1091.000, T1200, T1200.000 | TA0001, TA0010 | M1034