Welcome to the MacNN Forums.

netvn · Feb 23, 2007, 02:30 AM

My company has about one hundred Macintosh OSX computers and my boss don't want user copy the company confidential data to USB drive. Is there any way to deny user to use USB drive in mac OSX? I had searched from google but until now i hadn't find any software to bock USB drive. Please help me: confused: . Thanks so much

NetVN

Big Mac · 02:57 AM

USB Hacks: Endpoint Insecurity � How to: Disable USB ports on OSX

Btw, if that works, I hope you'll send me some small remuneration through PayPal.

netvn · Feb 23, 2007, 02:57 AM

yeah, it works!!! Thanks so much

jasong · Feb 24, 2007, 04:15 PM

What happens if someone uses a firewire drive? I suppose you could put the computer inside a box without access to the physical computer, but how do you prevent someone from emailing a document to themselves?

Big Mac · Feb 25, 2007, 10:41 AM

I'm betting these computers aren't on the Internet, or if they are they are limited to specific sites. As for Firewire, it is probably more difficult to conceal a Firewire drive.

Person Man · Feb 25, 2007, 10:16 PM

Originally Posted by Big Mac

As for Firewire, it is probably more difficult to conceal a Firewire drive.

Techtool Protege, which comes on a 1 GB Firewire flash drive.

Big Mac · Feb 26, 2007, 02:10 AM

I see, Person Man. Well, here's a Macintouch Reader Reports page on the same topic, and the last post has a theoretical way to disable Firewire as well.

Person Man · Feb 26, 2007, 08:34 AM

Originally Posted by Big Mac

I see, Person Man. Well, here's a Macintouch Reader Reports page on the same topic, and the last post has a theoretical way to disable Firewire as well.

That might work, but Firewire flash drives aren't very common anyway, and I'm not sure someone would want to spend the price of TechTool Protege for one when USB flash drives of that size are MUCH, MUCH cheaper.

shifuimam · Feb 26, 2007, 08:56 AM

Isn't there a way to prevent a user from the rights to mount drives? The hard drive could still mount, but it could prevent the user from mounting anything else. I'd imagine you could manage mounting network shares through a script.

peeb · Mar 1, 2007, 04:38 PM

There must be some system wide controls under the hood for this, but at some point you are going to have to have some trust that your users are relatively honest. The tech side of it will only give you so much security.

Big Mac · Mar 1, 2007, 06:36 PM

The system wide controls exist, but they can only be utilized if the clients are bound to OS X Server. Otherwise, you have to hack the system as described.

richwig83 · Mar 2, 2007, 06:04 PM

Hmm So now youve stopped the usbs from working... whats stopping ppl burning a cd????

TETENAL · Mar 2, 2007, 07:58 PM

Originally Posted by richardwigley

Hmm So now youve stopped the usbs from working... whats stopping ppl burning a cd????

Parental controls.

Person Man · Mar 3, 2007, 11:39 AM

Originally Posted by TETENAL

Parental controls.

or removing the CD drive and replacing it with one that doesn't do CD or DVD burning, or removing the drive entirely, or just disconnecting the power to the drive on the inside of the computer.

I've seen all three done at various places.

Techs either have an external CD drive when they need to install something, or they do it over the network.

f1000 · Mar 3, 2007, 12:00 PM

How about transferring data via the monitor? At the most basic level, one could attach a simple electric eye type device to some point on the screen and just have the pixels in that region flash binary to the eye.

An even simpler approach would be to transfer data via audio out, or even speakers via an acousto-coupler.

Big Mac · Mar 3, 2007, 11:13 PM

Transferring digital (with the exception of audio) in such a fashion is pretty time consuming, f1000.

f1000 · Mar 3, 2007, 11:42 PM

Originally Posted by Big Mac

Transferring digital (with the exception of audio) in such a fashion is pretty time consuming, f1000.

I think you'd be surprised at how fast such data transfers could be. If each pixel on a screen could be mated to its own cell, and each cell could be made to respond instantly to a screen refresh, then a theoretical upper limit to throughput would be roughly equivalent to the data rate of the display's VGA or DVI cable.

Besides, let's say you're not a spook at the CIA but just some malcontent trying to steal passwords using a single, cheap Radio Shack cell. How much throughput does one need to steal a 12 character ASCII password or even a thousand such passwords within an hour? Some people are willing to go through a lot of trouble for money.

Remember this? Optical Emission Security FAQ

scattered · Mar 4, 2007, 08:54 AM

Wouldn't it just be easier to encrypt whatever data it is that might be sensitive?

Person Man · Mar 4, 2007, 10:21 PM

Originally Posted by f1000

How about transferring data via the monitor? At the most basic level, one could attach a simple electric eye type device to some point on the screen and just have the pixels in that region flash binary to the eye.

An even simpler approach would be to transfer data via audio out, or even speakers via an acousto-coupler.

Both approaches that you describe there would require one to install some sort of software on the computer and if you're going to go to the trouble of disabling the ability to use USB or firewire flash drives and/or disable the ability to read or write to/from optical drives, then you're also going to disable the ability to install software.

f1000 · Mar 4, 2007, 11:11 PM

Originally Posted by Person Man

Both approaches that you describe there would require one to install some sort of software on the computer and if you're going to go to the trouble of disabling the ability to use USB or firewire flash drives and/or disable the ability to read or write to/from optical drives, then you're also going to disable the ability to install software.

Indeed, but I had assumed that we were talking about work computers, as opposed to dumb terminals, with some limited ability to save files.