Overview

MetaDefender Kiosk helps protect your network by enabling control over the flow of data into and out of your organization. It can be used as a media scanning station on your own hardware or on OPSWAT's custom-made kiosks. Media such as USB devices, DVDs, SD cards, flash drives, or floppy disks are processed by Kiosk. After the scan is complete, Kiosk generates a detailed report.

This user guide covers installing, configuring, upgrading, using, and troubleshooting MetaDefender Kiosk.

Key Features

• Protection against zero-day attacks (MetaDefender Core integration)

• Customized data security policies

• Control over data flow

• Active Directory authentication

• Custom Authentication

• Portable Media support including floppy disks, SD cards, CDs, DVDs, encrypted USB, and more

• UI localization

  • Contains bundled language translations and the ability to manually additional languages

• Securely wipe USB drives

• Easier system hardening

User authentication

MetaDefender Kiosk has the following authentication features:

• Active Directory authentication

• Support for Custom Authentication Module

Peripheral media

MetaDefender Kiosk automatically detects multiple peripheral media insertions for the following:

Common media types:

• USB devices

• Encrypted USB devices (refer to supported encrypted USB device list)

• CDs/DVDs/Blu-ray

• Card readers

• SD cards

• Floppy disks

Other media types:

• CF Card

• MS Pro Duo

• XDCAM drive (refer to How to scan XDCAM Drive in Kiosk? - MetaDefender Kiosk Windows)

Encrypted USB devices

MetaDefender Kiosk can unlock encrypted USB devices with a given password and process its contents. Kiosk supports the following encrypted USB devices:

Media handling

MetaDefender Kiosk's media handling features include the following:

• Can process drives with multiple partitions

• Can process full or partial media

• Can wipe/format USB drives

• Supports integration with MetaDefender Managed File Transfer for uploading files for processing or uploading/downloading processed files

• USB device soft eject

• CD/DVD eject

Processing files

MetaDefender Kiosk uses MetaDefender Core to process files. MetaDefender Core has the following processing features:

• Scanning with multiple anti-malware engines

• Data sanitization

• Application vulnerability detection

• Heuristics for zero-day threats

• Archive extraction

• File type verification

• Workflow engines

Processing session results

After processing media, MetaDefender Kiosk allows you to view detailed logs and print results.

Customizable interface

The MetaDefender Kiosk user interface includes multiple display languages:

• English

• Arabic

• Hebrew

• Korean

• Vietnamese

• German

• Japanese

• Spanish

• French

With the additional support of customizing the bundled languages or adding other languages.

On-screen keyboards are also supported for all of these languages.

Refer to UI Localization / Customization - MetaDefender Kiosk Windows

System hardening

MetaDefender Kiosk comes with a variety of system hardening features for additional security:

• Disables autorun of inserted media

• Users can only exit by pressing ALT+S and if Kiosk is configured to require a password to exit, entering the exit password

• User interface blocks direct access to the underlying system and unnecessary keystrokes

• Runs automatically on system startup

Defending against BadUSB devices

A range of BadUSB devices, including well-known ones like RubberDucky and BashBunny, mimic standard USB flash storage devices in appearance. Beneath that facade, they present a USB keyboard (or network adapter) interface when connected to a host system, and use it to execute keystroke sequences that launch processes, open a shell, or change system settings.

Starting in Kiosk 4.8.0, you can turn on Bad USB Detection to actively identify and isolate these devices the moment they're plugged in, instead of only suppressing their keystrokes in the background.

To turn on Bad USB Detection:

1. In the Kiosk Management Console, go to Settings > System Hardening.

2. Turn on Bad USB Detection.

3. Click Save Updates.

Bad USB Detection is off by default, so existing Kiosk deployments are not affected until an administrator turns it on.

What happens when a suspicious device is detected

When a connected USB device presents an interface other than storage — such as a keyboard or a network adapter — Kiosk isolates that interface right away and shows a warning on screen naming the device and what it appears to be, so the person at the Kiosk knows a device has been blocked and why.

• If the device looks like a keyboard, a short numeric code appears on screen. Entering that code on the on-screen keypad allows the keyboard to work for the rest of that session.

• For other device types (for example, a network or Bluetooth adapter), a simple confirmation prompt is shown instead of a code.

Unblocking a device this way only applies while it stays plugged in — unplugging and reconnecting the same device triggers the check again.

Permanently blocking a device

From the warning screen, an administrator can choose to permanently block a specific device instead of allowing it. Once blocked, that same device is ignored automatically on future connections, with no warning shown. To clear this list and start over, go to Settings > System Hardening, turn on Bad USB Detection if it isn't already on, and click Reset Blocked USB List.