Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer would intentionally send a drive containing malware, but I don't know that the drive is clean.

I'm using Mac OS 10.8.3; is there a significant risk of malware transfer upon connection? Is there a safe way to inspect the drive before copying the files?

EDIT For clarification, I'm concerned about the risk of triggering malware transfer from the USB drive to my computer upon connection. This might be a real risk; I'm asking for confirmation that this transfer-upon-connection risk is real in this scenario, or imagined.

ANOTHER EDIT @Adnan answered the question as stated, and I agree with his answer. I now realize I was also interested in another possibility -- the device might mask its nature or purpose. The USB page on Wikipedia states that USB 3.0 supports a guest device initiating communication with the host upon connection, and that Fireware has always had this capability, while earlier versions of the USB protocol enforce a "speak-when-spoken-to" behavior on guest devices. An external drive is unlikely to initiate communication, but a malicious device might. So if you trust that the device is just an external hard drive, connecting that drive to a Mac OS or Windows computer (with Autorun turned off) is probably not risky by itself. But if the device is not just an external drive (i.e. it's something like the USB Rubber Ducky), there is some risk.

share|improve this question
    
For the sake of sanity of all us paranoid types, you can also buy a brand-new spring-clean USB 2.0 external drive and give it to the client. :) –  Deer Hunter May 6 '13 at 19:31
    
If you're very concerned, you could boot to a Live CD and copy the files that way. –  John May 6 '13 at 19:55
    
Knowing that it doesn't answer your question, Windows users can hold down the <shift> key, until after the drive is mounted, this should prevent any autoplay and autorun scripts. –  martinstoeckli May 6 '13 at 20:02
    
@DeerHunter, what about supply chain concerns? ;) john, you're halfway there... martinstoeckli, g2k but that's only one threat vector... –  Matthew Peters Jul 31 at 21:07

7 Answers 7

up vote 2 down vote accepted

If you connect the disk, don't open it, and just send the files to it, then there's almost no risk at all. If your system is originally clean, malware cannot magically move themselves from the USB disk to your system. Plus, Mac OS X doesn't have an autorun capability for USB drives. It never has.

The only theoretical risk I can think of, is if the attacker had found a vulnerability in the way Mac handles the drive's names and was able to exploit it and execute some code.

Personally, I wouldn't worry about it. Just make sure you copy without opening it.

Note 1: When I say "don't open it", I don't mean that there's a magical way to get you infected if you open the disk, there isn't. It's just that if you open it, it's more likely that you'll click on something in it.

Note 2: Please don't run an Anti-Virus scan on a disk that is not yours unless you're asked to. Anti-Viruses tend to be stupid, they delete pen. testing tools all the time.

share|improve this answer
1  
Was thinking over a Clancy-thriller-worthy scenario when a USB-connected storage device transmutates into something completely different... like a USB keyboard - and sends a crafted key sequence to the OS. –  Deer Hunter May 6 '13 at 19:18
    
@DeerHunter for social engineering purpose i am using a prepared usb stick which is actually a mass storage AND a hid device... ;-) –  Dr.Ü May 6 '13 at 19:39
    
@Adnan, you write "malware can magically"; did you intend to write "malware cannot magically"? –  Eric Rath May 6 '13 at 20:30
    
@EricRath Yes, correct. This is the second time this happens to me today. –  Adnan May 6 '13 at 20:33
    
@Adnan, do you know if the risks vary between USB 2.0 and Firewire 800? I.e. the drive in question offers both types; would connecting with one present different risks than connecting with the other? It seems plausible that the two protocols provide different on-connection behavior. –  Eric Rath May 6 '13 at 20:43

Respectfully, @Adnan is dead wrong in some key assumptions that it is relatively safe to open an unknown external drive.

As I answered here, it is not safe to connect any infected drive without proper safeguards in place.

In fact, the only way to be 99.99% (nothing is security is certain) sure it's malware free is to actually do a forensic examination on it. At a bare, minimum you should only attach an unknown external device using a proper VM. Ideally, you would take a forensic image of the drive and then examine it in the VM.

Note that you can do this 'safely' but only if precautions are followed.

Here is a simple article that outlines a few real-world examples.

Bear in mind that it is not just limited to autoplay features. There are sooooo many ways to hid things digitally and then execute them (leveraging OS/driver/buffer exploits for example).

update you may want to keep your ears peeled for more information on this as it's presented at Black Hat soon.

share|improve this answer

I believe all Mac OS 10+ versions disabled the auto run feature so even if there were a virus on it, if you are simply copying files it would never start unless you intentionally ran the program.

I would say you are very safe in attaching and copying the files with no ill effects. If it were Windows I say would there is a lot of worry.

If you are that worried, you can download Kaspersky's bootable USB antivirus and plug the drive in on reboot and scan it with that.

http://www.precisesecurity.com/tools-resources/free-antivirus/virus-scan-kaspersky-usb

share|improve this answer

One possible scenario:

  1. boot a live distribution from stick (use your fav)
  2. mount your local disc as read-only
  3. copy files from the local disk to your costumers external drive
share|improve this answer

Another scenario:

  1. Download, install and update a free anti-virus software
  2. Disable autorun from USB on your mac
  3. Connect USB
  4. Run a direct anti-virus scan against the USB drive
  5. Take only the files you require from the USB drive
share|improve this answer

USB Thumb drives are super super cheap - you can play it safe by eating $2-15 depending on the quantity of data. Alternatively boot up a machine you can wipe, copy the files to it, copy the files, mount the customer drive on the temp box, copy files from temp box to customer drive, reimage (wipe clean) the temp box.

share|improve this answer

MacOS 10 does not autorun. You should be fine. Just don't go clicking and opening things from the drive of unknown history. If you have pre-Windows-7 Windows machines turn off autorun before connecting random drives to them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.