USB port access although disabled in BIOS

[StefanoFereri]

Hi,

to block the use of USB drives on our company desktops I just enabled "Only allow keyboard and mouse" option in BIOS. When I start Windows 11 and test front USB ports with an USB drive, there is no access, as expected. On rear USB ports it's the same - with one exception: When I pull out the HP keyboard from it's rear USB port and plug in my USB test drive to this port, I have access to it.

Computer is an HP Pro SFF 400 G9, latest BIOS.

This seems like an easy way to cheat, right? Any idea?

Thanks

Stefano

[Bill_To · Accepted solution]

Greetings @StefanoFereri 

Welcome to the HP Forum. Sawadee Krap 🙏 (Hello)!

I've been out of the IT security game since 2007.

I'm intrigued by your sleuthing. Very interesting findings.

Do you see any additional BIOS options available to enhance USB access restrictions?

Windows may be mapping unrestricted access to a USB port having an active: keyboard or mouse connection. The OS can't differentiate dissimilar USB devices connected to an "open" USB port within an active Windows session.

I would think Microsoft might have thought this through. There should be a Windows OS solution. Or you have discovered a Windows USB access  security flaw.

I don't know. Maybe you need to look at Windows Group Policy Settings to further harden USB access.

There should be a Windows way to lock down all USB ports to specific USB devices.

Regards 

[StefanoFereri]

Hi,

thanks for input! I wasn't aware that such settings were possible (and much more granular) in Windows using GPOs. So I created a corresponding GPO.

The settings at the BIOS level are obviously very vague and allow a port if it has been recognized as HID, leaving it open for everything. This should be preventable with the Windows GPO settings (testing still pending).

Best regards,

Stefano

[Bill_To]

Greetings @StefanoFereri 

My pleasure.

Let the Forum know how USB security testing goes.

Regards