Project Description

USB devices can be dangerous to read directly from your PC. There are countless stories of PCs being infected (e-g: filesystem encrypted) because a USB device was read without first checking the USB content. But how do you check the device content without having a look at it first?!

If we could fire up a virtual machine on the PC that could read from the USB device first, we'd be able to protect our PC: if any malware ran on the device, it would only affect the virtual machine.

Goal for this Hackweek

Start up a virtual machine from the PC where the USB key is inserted to read from that USB key: - disable the USB port on the PC - enable PCI passthrough for this USB port to be read from the virtual machine - use QEMU + vfio to load the necessary driver/kernel modules in the virtual machine - read the USB key from the virtual machine - if time permits, automatically run the virtual machine as soon as a "USB inserted" event occurs.

Code

• https://github.com/susenguyen/usb_notify

Resources

• https://www.kernel.org/doc/html/latest/driver-api/vfio.html
• https://en.wikipedia.org/wiki/Input%E2%80%93output_memory_management_unit
• https://www.man7.org/linux/man-pages/man7/inotify.7.html