Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is often suggested, for air-gapped PC's, to use CD/DVD's as a transfer medium between machines instead of USB sticks or portable hard-drives as it is difficult to write data to a CD/DVD without the user noticing.

I am wondering if there are any known attacks against this type of scenario? I'm not sure its possible but i'd be interested to see if there's been any research into such attacks. Schneier's article (linked above) seems to suggest it is possible by saying:

If you've only written one file, but it looks like three-quarters of the CD was burned, you have a problem.

Is it possible to write data (even a small amount) to a CD/DVD that wouldn't, under normal circumstances be read/recognized by the operating system but could potentially be accessed by malware?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

It is totally feasible to write appreciable amounts of data in a "covert" fashion under these conditions. What is written on the disc is a filesystem: a sequence of bytes which encodes a number of files and directories. There are two main places where covert data would be hidden:

  1. In the "holes" in the filesystem. In particular, files will use an integral number of sectors (2048 bytes on a CD), so if a file length is not a multiple of 2048 then there is some "padding" at the end, i.e. bytes which the OS will simply ignored as long as it reads the data as files. But reading the CD as a "raw device" will allow access to these bytes. Note that filesystems meant to allow read-write operations (e.g. UDF, as opposed to ISO9660), there are bigger holes which an be used as well.

  2. Beyond the filesystem. A filesystem begins with a header which specifies a number of things about it, in particular its total size. But on the disc, there may be extra bytes afterwards, which are readable by accessing the "raw device", but ignored by the OS for all filesystem-related accesses. You can easily sneak up megabytes of data there.

The two methods above are generic to any storage device with a filesystem, so it applies to USB flash drives as well. There are other methods which depend on the actual device; for instance, on a CD, you can have multiple sessions with multiple tracks in each of them, allowing you to play a lot of sneaky games (and this has been used at times as basic protections against copying).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.