XDA’s report that any USB-C dock can hold more privileged access to your PC’s memory than any app you install is accurate and important. A USB-C dock that identifies as a Thunderbolt or PCIe device can request Direct Memory Access. If the OS grants it, the dock (or a hostile device hidden inside a normal-looking one) can read RAM without any driver install. This is not theoretical; it is the same attack class as PCILeech and Inception.
The seven desktop apps below cover the two ways to defend against this. Either audit what your machine actually allows over USB and Thunderbolt, or actively restrict what unknown devices can do when plugged in. Every pick runs on at least one of Windows, macOS, or Linux.
What to look for in USB dock security
Not every “USB monitoring” tool defends against a real DMA attack. Check for at least three of these:
- IOMMU enforcement or Kernel DMA Protection integration
- Device whitelisting by vendor / product ID and interface class
- Alerts when a device claims a new interface class after enumeration
- Logging with timestamps and device descriptors, exportable to a SIEM
- Support for Thunderbolt authorization prompts
Anything that just watches for USB mass storage misses PCIe-class threats entirely.
Quick comparison
| App | Best for | Free plan | Starting price | Standout feature |
|---|---|---|---|---|
| USBGuard | Linux device whitelisting | Yes | Free | Rules by interface class |
| Kernel DMA Protection | Native Windows Thunderbolt guard | Yes (built-in) | Free | Blocks PCIe DMA at boot |
| duckhunt | Windows BadUSB defense | Yes | Free | Detects rapid HID injection |
| USB Detective | Forensic USB history audit | Trial | Paid license | Reconstructs plug/unplug timeline |
| USBDeview | Lightweight Windows USB log | Yes | Free | Portable, no install |
| Little Snitch | macOS network + USB alert | Trial | Paid license | Alerts on new network behavior after plug-in |
| LimaCharlie | Endpoint telemetry for teams | Free tier | Per-endpoint pricing | Cloud SIEM integration |
The apps
1. USBGuard – Best Linux device whitelisting
USBGuard is the reference tool for USB access control on Linux. It ships a daemon, a CLI, and a small tray app that intercepts every device the kernel sees and either allows or blocks it based on a policy you define. Rules can filter by vendor ID, product ID, interface class, hash of the descriptor, or physical port. A common policy is “allow the internal webcam and keyboard, prompt on everything else.”
Where it falls short: Linux only. First-time setup requires editing a policy file. Some KDE and GNOME shells need a session refresh after installing the tray.
Pricing:
- Free: Open-source under GPL.
- Paid: None.
Platforms: Linux.
Download: USBGuard on GitHub
Bottom line: Install USBGuard on any Linux laptop that leaves the house. It is the single strongest USB defense on the OS.
2. Windows Kernel DMA Protection – Best native Thunderbolt guard
Windows Kernel DMA Protection is a built-in feature on Windows 10 and 11 devices that ship with modern firmware. When it is on, PCIe peripherals plugged into Thunderbolt or USB4 ports cannot request DMA until the OS explicitly grants it, and the OS refuses to grant it before Windows has finished login. This is what stops most drive-by cold-boot and DMA attacks at the boot stage.
Where it falls short: Only useful on hardware with modern firmware (Ryzen 4000/Intel 10th gen and later). Enterprise admins have to enable BitLocker with pre-boot authentication to get the full guarantee.
Pricing:
- Free: Included with Windows 10 and 11.
- Paid: None.
Platforms: Windows 10, Windows 11.
Download: Built into Windows. Confirm status with msinfo32 under Kernel DMA Protection.
Bottom line: Check it is on before you install anything else. It is the strongest native protection on the OS.
3. duckhunt – Best Windows BadUSB defense
duckhunt is a small Windows utility that watches HID input for the signature of a Rubber Ducky or Bash Bunny attack: keystrokes coming through faster than a human can type. When it detects the burst, it locks the workstation and logs the offending device. It doesn’t stop DMA, but it does stop the far more common cheap-USB-stick attacks that impersonate keyboards.
Where it falls short: Watches HID only. Users with mechanical macros (Elgato Stream Deck) need to whitelist those.
Pricing:
- Free: Open-source.
- Paid: None.
Platforms: Windows.
Download: duckhunt on GitHub
Bottom line: A 3 MB install that closes off the most likely USB attack, keystroke injection. Worth the download.
4. USB Detective – Best forensic USB history audit
USB Detective reconstructs the full history of USB devices ever plugged into a Windows machine, along with timestamps, mount points, and the user who was logged in at the time. Investigators use it after an incident; sysadmins use it during onboarding audits.
Where it falls short: Forensic tool, not real-time defense. Paid license required for full detail export.
Pricing:
- Free: A community edition with a limited feature set.
- Paid: Standard and Pro licenses for professional use.
Platforms: Windows.
Download: USB Detective
Bottom line: Install after an incident, not before. Free edition is a solid triage tool.
5. USBDeview – Best lightweight Windows USB log
USBDeview by NirSoft is the classic Windows utility that lists every USB device plugged into the machine, past or present. It is portable (no install), reads directly from the registry, and can export the log to CSV for auditing. Combine it with duckhunt for a lightweight before-and-after picture.
Where it falls short: Read-only, no enforcement. Some antivirus tools flag NirSoft binaries even though they are clean; whitelist the folder.
Pricing:
- Free: Freeware.
- Paid: None.
Platforms: Windows.
Download: USBDeview at NirSoft
Bottom line: A weekend triage tool. Keep a copy on a USB stick along with your other IT-carry utilities.
6. Little Snitch – Best macOS post-plug behavior alert
Little Snitch is a macOS network monitor that catches new outbound connections. It’s not a USB tool per se, but the reason it sits on this list is that a compromised dock or peripheral almost always tries to phone home. Little Snitch prompts the moment the dock’s driver starts talking to a new host and lets you deny or allow it.
Where it falls short: Watches network, not USB descriptors. A DMA attack that reads memory silently won’t touch the network and can slip past.
Pricing:
- Free: Demo mode with 3-hour session limits.
- Paid: Standard and family licenses.
Platforms: macOS.
Download: Little Snitch
Bottom line: Not a USB tool by itself, but it catches the majority of post-plug bad behavior on a Mac.
7. LimaCharlie – Best endpoint telemetry for teams
LimaCharlie is a cloud endpoint-detection platform that installs a lightweight agent on Windows, macOS, and Linux and reports USB and Thunderbolt events, process starts, network flows, and file changes to a central console. Small teams get a free tier that is enough for a laptop fleet under 10 endpoints; larger teams pay per endpoint per month.
Where it falls short: Cloud console means events leave the device. Team tool, not a single-user one.
Pricing:
- Free: Community edition covers small deployments.
- Paid: Per-endpoint pricing scales with fleet size.
Platforms: Windows, macOS, Linux.
Download: LimaCharlie
Bottom line: Overkill for one laptop; the right answer if you manage a fleet.
How to pick the right one
Single Windows laptop: confirm Kernel DMA Protection is on, install duckhunt, keep USBDeview as a triage tool. Single Linux laptop: install USBGuard and write a policy. Single Mac: install Little Snitch and pair with a Thunderbolt authorization prompt in System Settings. Small team: LimaCharlie’s free tier and per-user configuration. Incident response: USB Detective.
Do not rely on a single antivirus product for USB safety. None of the mainstream ones defend against DMA attacks; they watch for known malware signatures that arrive over USB storage.
FAQ
Can any USB-C dock really read my RAM? A dock that identifies itself as a PCIe or Thunderbolt device can request DMA. Whether it succeeds depends on your OS’s IOMMU configuration and, on Windows, Kernel DMA Protection. On older hardware or with those disabled, yes.
Is Windows Defender enough? No. Defender watches file behavior, not device enumeration. Kernel DMA Protection is a separate feature, and third-party tools like duckhunt cover HID injection Defender misses.
Does macOS have anything like USBGuard? Not natively. Little Snitch covers network behavior; Endpoint Security-based tools like Objective-See’s KnockKnock and BlockBlock help. For strong device policy, MDM (Jamf, Kandji) enforces USB restrictions.
How do I test whether Kernel DMA Protection is on?
Run msinfo32 and check the “Kernel DMA Protection” line. It says On, Off, or Not supported.
What is the difference between USBGuard and Kernel DMA Protection? USBGuard filters USB devices by descriptor and interface class in userspace. Kernel DMA Protection blocks PCIe DMA requests at the OS kernel level. Both are useful; they solve different parts of the same problem.
Do these apps stop a Rubber Ducky? duckhunt does, by detecting fast keystroke bursts. USBGuard does too, by refusing to accept a new HID class until the user confirms. Kernel DMA Protection does not; a Rubber Ducky is a keyboard, not a PCIe device.
