HOW to disable USB ports in imac

Question

HOW to disable USB ports in imac

Hi Friends..I would like to know how to disable Usb ports in imac...

tye, Mac OS X (10.6.2), tyj

Posted on Jan 15, 2010 2:13 AM

Reply

Answer 1

Jan 15, 2010 5:14 AM in response to dghdrgyujhydtujytety

Internet has been blocked because we do have a security s/w...which has been implemented in our network..in our company we have windows xp..so inorder to get access to the internet the XP machines have been installed with these security s/w's and the users have to register these s/w to get internet access..but that particular s/w is not compatible with macOS..so these mac users should get some exception for their machine using the ip address and then alone they will be getting internet access....but we have very few Mac machines around 6...i know we should take some security measures for wireless,optical drive and so on..but the present requirement from the security team was to disable USB..thats why i needed some suggestions..
Regards
ANTONY

Reply

Answer 2

R C-R

Level 6

17,794 points

Jan 17, 2010 11:43 PM in response to etresoft

etresoft wrote:
Nothing has really been disabled. Plug a keyboard in, insert a Snow Leopard DVD, and boot it up with ⌘ C.

If you really, truly, wanted to disable the USB ports, there is only one way - with a screwdriver and pliers.

Exactly. Deleting or otherwise disabling extensions on the normal startup volume is ineffective because a savvy Mac user could simply start up from some other volume -- including a thumb drive with the Mac OS configured to log in as root user.

Even setting a firmware password can be bypassed by anyone with +physical access+ to the computer, as Apple mentions.

Reply

Answer 3

Jan 15, 2010 2:40 AM in response to R C-R

we have wireless keyboard and mouse...it s for security reasons..we neeed to disable it...i know there is a option to get into firmware buy holding cmdopt+of...but m not sure how to do it..or is there any files in /system/library which i can remove it..

Reply

Answer 4

R C-R

Level 6

17,794 points

Jan 15, 2010 4:20 AM in response to dghdrgyujhydtujytety

dghdrgyujhydtujytety wrote:
We dont want the user to copy any data from the system using any usb devices..

Are you worried about USB devices in particular or any unauthorized transfer of data from the iMac? Do not forget that data can be transferred by burning it to optical disks, by email attachments, by using various wired & wireless network connections to other computers, & even by Bluetooth.

If you are mostly concerned with USB devices like thumb drives, the only really reliable approach is to physically disable the ports. A qualified technician could do this by internally disconnecting the rear panel USB ports. Any software-only solution is either likely to be too easy to undo or cause mis-operation of the OS, since a number of internal items relay on USB busses to work.

Reply

Answer 5

thomas_r.

Level 7

32,031 points

Jan 15, 2010 4:22 AM in response to dghdrgyujhydtujytety

You're trusting the user with access to the data, but not trusting them not to misuse it? That doesn't sound secure by itself... trying to secure such a situation may be difficult or impossible.

If this computer is online, what's to prevent uploading of data? What's to prevent connecting a small firewire hard drive? What's to prevent burning a CD or DVD? If you're not also thinking about all possible copy methods, there's very little point in trying to block just one of them.

Reply

Answer 6

Jan 15, 2010 5:28 AM in response to dghdrgyujhydtujytety

Hi..I found a solution....
Log on with an administrator account.
Browse to ‘/System/Library/Extensions’ folder on the system disk.
Trash both IOUSBMassStorageClass.kext and IOFireWireSerialBusProtocolTransport.kext which are found in this directory.
Empty the trash.
Reboot the machine.

..But m not sure on how to reenable these ports..if i do so..

Reply

Answer 7

etresoft

Level 9

56,206 points

Jan 15, 2010 6:50 AM in response to thomas_r.

Thomas A Reed wrote:
You're trusting the user with access to the data, but not trusting them not to misuse it? That doesn't sound secure by itself... trying to secure such a situation may be difficult or impossible.

Usually this level of paranoia is just a reflector of ignorance of true security issues. The only real goal is a big show that can be demonstrated to management. The original poster is giving them what they want, which is the correct course of action.

Reply

Answer 8

Wyodor

Level 6

19,930 points

Jan 15, 2010 7:13 AM in response to dghdrgyujhydtujytety

Yes you did

Trash both IOUSBMassStorageClass.kext and IOFireWireSerialBusProtocolTransport.kext which are found in this directory.
Empty the trash.

If you hadn't trashed them but placed them in a secure place, you would simply place them back in their original location.

Then this wasn't necessary:

But m not sure on how to reenable these ports..if i do so..

Reply

Answer 9

Jan 15, 2010 10:47 AM in response to dghdrgyujhydtujytety

It should be noted that the keyboard and mouse require either Bluetooth or USB. Both can be used to copy data to a solid-state memory device. Most notably, Bluetooth can wireless access a mobile phone and put data on it (I do this, actually, quite a bit). In that respect, Bluetooth is a greater threat because both the recipient can be a third-party, and because there's no visual indication that the file transfer is occurring.

Other modes of data egress from the system: optical disk, wifi (point to point, even without an existing network connection), Firewire, audio, and video ports.

You can disable the USB support by removing The IOUSB*.kext files form the system, but you will not be able to secure information that way.

Reply

Answer 10

Jan 15, 2010 12:07 PM in response to dghdrgyujhydtujytety

Hi dghdrgyujhydtujytety;

You have my deepest sympathy if your management is so paranoid that they think any of this will protect their data. My suggestion is to start working on your resume now so that you are prepared when data is lost and they make you the scapegoat for that lose because data will be lost. Your paranoid management is going blame you for it.

Allan

Message was edited by: Allan Eckert

Reply

Answer 11

etresoft

Level 9

56,206 points

Jan 16, 2010 12:09 PM in response to Old Toad

Old Toad wrote:
Wouldn't he need a wired keyboard and mouse to reinstall the system from the disks?

Sure. But remember, it is all a show for management. Nothing has really been disabled. Plug a keyboard in, insert a Snow Leopard DVD, and boot it up with ⌘ C.

If you really, truly, wanted to disable the USB ports, there is only one way - with a screwdriver and pliers.

Reply

Answer 12

Jan 18, 2010 6:28 AM in response to R C-R

Hi RC-R;

Hence my reason for telling the OP to start working on his resume because this effort is doomed from the start and that paranoid management is sure to look for a scapegoat.

Allan

Message was edited by: Allan Eckert

Reply