I wonder if USB can be exploited by someone with physical access to a reasonably secured computer. For example a kiosk, or a laptop attached to a desk.

Obviously, the boot sequence should be secure (BIOS/UEFI set to "internal disk only" and password protected...). Also, mount options should be restricted with `nodev,nosuid,noexec`. Also, files should be analyzed by antivirus/antimalware. .. And so on.

I am really concerned about exploits like [DMA attacks](https://en.m.wikipedia.org/wiki/DMA_attack), where a user just has to plug in a USB device to extract information in memory.

Which features could be disabled to still allow mouse and keyboard but reduce the attack surface?