ChromeOS

Chrome OS will block USB ports while locked with ‘USBGuard’ to protect against malicious devices

Ben Schoon | Jan 2 2019 - 7:34 am PT

Chrome OS is a great option for a secure computer, and it seems Google is working on a new security feature. A recent commit has revealed “USBGuard,” a new security option in Chrome OS which protects users by locking down the USB ports when the machine isn’t in use.

First spotted by Chrome Story, USBGuard is a new option slowly making its way to fresh versions of Chrome OS. The functionality here is relatively simple. When the Chrome OS device, laptop or otherwise, is behind its lockscreen, the USB ports are inoperable until the machine is unlocked with the user’s password or PIN.

This does, however, only applies to devices that aren’t already plugged in. If a USB device such as a hard drive is already plugged in before the machine is locked, it won’t be disconnected or blocked. The latest Canary channel update to Chrome OS sees the flag already available with the description below.

chrome://flags/#enable-usbguard

Prevents newly connected USB devices from operating at the lock screen until Chrome OS is unlocked to protect against malicious USB devices. Already connected USB devices will continue to function. – Chrome OS

ZDNet explains that this new feature is designed to protect against attacks such as “Rubber Ducky” attacks. That sort of attack uses a malicious USB drive which, when plugged into a machine, mimics a keyboard and runs malicious commands. There are plenty of attacks like this out there, but by disabling the USB ports on the lockscreen, Google is protecting Chrome OS users from the majority of these attacks.