Skip to content

0065-usbstorage-disable - Disable USB Storage¶

Rule ID¶

0065-usbstorage-disable

Category¶

system

Severity¶

warn

Compatible Versions¶

Linux

Description¶

USB storage devices provide a method for transferring and storing files. However, attackers can use USB drives to install malware on servers, which has become a simple and common means of network penetration and a common way to establish persistent threats in a network environment.

Scan Frequency¶

0 */30 * * *

Rationale¶

Restricting USB access on systems reduces the attack surface at the physical layer and decreases the likelihood of introducing malware.

Risk¶

Production servers should minimize external interfaces. USB is a simple and efficient way to implant malware.

Audit Procedure¶

Run the following commands and verify the output is as shown:

# modprobe -n -v usb-storage
install /bin/true
# lsmod | grep usb-storage
<No output>

Remediation¶

Edit or create a file ending in .conf in the /etc/modprobe.d/ directory. Example: vim /etc/modprobe.d/usb_storage.conf and add the following line:

install usb-storage /bin/true

Run the following command to unload the usb-storage module:

# rmmod usb-storage

Impact¶

After unloading, attackers cannot implant malware via USB interfaces. System security is also improved.

Default Value¶

The USB module is not installed by default.

References¶

None

CIS Controls¶

Version 7 > 8.4 Configure Anti-Malware Scanning of Removable Devices
Configure devices so that they automatically conduct an anti-malware scan of removable media when inserted or connected. > 8.5 Configure Devices Not To Auto-run Content
Configure devices to not auto-run content from removable media.