Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer would intentionally send a drive containing malware, but I don't know that the drive is clean.

I'm using Mac OS 10.8.3; is there a significant risk of malware transfer upon connection? Is there a safe way to inspect the drive before copying the files?

EDIT For clarification, I'm concerned about the risk of triggering malware transfer from the USB drive to my computer upon connection. This might be a real risk; I'm asking for confirmation that this transfer-upon-connection risk is real in this scenario, or imagined.

ANOTHER EDIT @Adnan answered the question as stated, and I agree with his answer. I now realize I was also interested in another possibility -- the device might mask its nature or purpose. The USB page on Wikipedia states that USB 3.0 supports a guest device initiating communication with the host upon connection, and that Fireware has always had this capability, while earlier versions of the USB protocol enforce a "speak-when-spoken-to" behavior on guest devices. An external drive is unlikely to initiate communication, but a malicious device might. So if you trust that the device is just an external hard drive, connecting that drive to a Mac OS or Windows computer (with Autorun turned off) is probably not risky by itself. But if the device is not just an external drive (i.e. it's something like the USB Rubber Ducky), there is some risk.

share|improve this question
    
For the sake of sanity of all us paranoid types, you can also buy a brand-new spring-clean USB 2.0 external drive and give it to the client. :) –  Deer Hunter May 6 '13 at 19:31
    
If you're very concerned, you could boot to a Live CD and copy the files that way. –  John May 6 '13 at 19:55
    
Knowing that it doesn't answer your question, Windows users can hold down the <shift> key, until after the drive is mounted, this should prevent any autoplay and autorun scripts. –  martinstoeckli May 6 '13 at 20:02
add comment

6 Answers

up vote 2 down vote accepted

If you connect the disk, don't open it, and just send the files to it, then there's almost no risk at all. If your system is originally clean, malware cannot magically move themselves from the USB disk to your system. Plus, Mac OS X doesn't have an autorun capability for USB drives. It never has.

The only theoretical risk I can think of, is if the attacker had found a vulnerability in the way Mac handles the drive's names and was able to exploit it and execute some code.

Personally, I wouldn't worry about it. Just make sure you copy without opening it.

Note 1: When I say "don't open it", I don't mean that there's a magical way to get you infected if you open the disk, there isn't. It's just that if you open it, it's more likely that you'll click on something in it.

Note 2: Please don't run an Anti-Virus scan on a disk that is not yours unless you're asked to. Anti-Viruses tend to be stupid, they delete pen. testing tools all the time.

share|improve this answer
1  
Was thinking over a Clancy-thriller-worthy scenario when a USB-connected storage device transmutates into something completely different... like a USB keyboard - and sends a crafted key sequence to the OS. –  Deer Hunter May 6 '13 at 19:18
    
@DeerHunter for social engineering purpose i am using a prepared usb stick which is actually a mass storage AND a hid device... ;-) –  Dr.Ü May 6 '13 at 19:39
    
@Adnan, you write "malware can magically"; did you intend to write "malware cannot magically"? –  Eric Rath May 6 '13 at 20:30
    
@EricRath Yes, correct. This is the second time this happens to me today. –  Adnan May 6 '13 at 20:33
    
@Adnan, do you know if the risks vary between USB 2.0 and Firewire 800? I.e. the drive in question offers both types; would connecting with one present different risks than connecting with the other? It seems plausible that the two protocols provide different on-connection behavior. –  Eric Rath May 6 '13 at 20:43
show 4 more comments

I believe all Mac OS 10+ versions disabled the auto run feature so even if there were a virus on it, if you are simply copying files it would never start unless you intentionally ran the program.

I would say you are very safe in attaching and copying the files with no ill effects. If it were Windows I say would there is a lot of worry.

If you are that worried, you can download Kaspersky's bootable USB antivirus and plug the drive in on reboot and scan it with that.

http://www.precisesecurity.com/tools-resources/free-antivirus/virus-scan-kaspersky-usb

share|improve this answer
add comment

One possible scenario:

  1. boot a live distribution from stick (use your fav)
  2. mount your local disc as read-only
  3. copy files from the local disk to your costumers external drive
share|improve this answer
add comment

Another scenario:

  1. Download, install and update a free anti-virus software
  2. Disable autorun from USB on your mac
  3. Connect USB
  4. Run a direct anti-virus scan against the USB drive
  5. Take only the files you require from the USB drive
share|improve this answer
add comment

USB Thumb drives are super super cheap - you can play it safe by eating $2-15 depending on the quantity of data. Alternatively boot up a machine you can wipe, copy the files to it, copy the files, mount the customer drive on the temp box, copy files from temp box to customer drive, reimage (wipe clean) the temp box.

share|improve this answer
add comment

MacOS 10 does not autorun. You should be fine. Just don't go clicking and opening things from the drive of unknown history. If you have pre-Windows-7 Windows machines turn off autorun before connecting random drives to them.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.