Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There are various ways to verify the validity of a file, usually checking the MD5 checksum or OpenPGP signature. Is it possible to do the same for a full USB Drive?

I'd like to be able send a USB Drive through the post and give the recipient a way to ensure that it hasn't been tampered with along the way (à la NSA's Tailored Access Operations). Part of this thinking relates to a drive of miscellaneous data but would also apply to sending a LiveUSB (e.g. Tails) with the certainty that it arrives clean.

Ideally the solution would be cross-platform open-source & OpenPGP/GnuPG-based. Physical write protection is a nice idea but still doesn't accommodate for verification.

share|improve this question

4 Answers 4

OK, I think I'm missing something, but here's what I understand the question to be:

How do you ensure that a flash drive cannot be tampered with (without the user knowing it) or read?

If that's the question, just encrypt the Flash Drive with a PSK. If the encryption is strong enough it will take even the NSA several thousand years (actually a huge understatement) to break it, and until then that drive can't be modified such that it will decrypt to anything intelligible.* The PSK can be securely communicated using a public-key cryptography scheme.

*Well, OK, it can. But the likelihood of them finding ANOTHER key that works if pretty low, and even then it won't be the key your recipient is using

share|improve this answer

You can't really guarantee that the hardware hasn't been tampered with. Someone intercepting the drive, with enough skill, could either modify the hardware or copy everything off the drive onto custom, malicious hardware that looks like the original drive, forwarding the malicious package on to the recipient.

This probably isn't all that easy, so whether or not you want to worry about this deoends upon whether you think someone targetting your drive has the necessary resources.

If you are willing to trust the hardware, just encrypt and sign all the data on the drive with strong crypto. If yoi choose to split the data into multiple ciphertextx, be sure that everything is included in the signature so that 8t is impossible to add or remove anything.

share|improve this answer

There are really two concerns here. One, whether you can authenticate that the data is both unmodified, and indeed from the intended source? And two: has the storage medium been tampered with in some nefarious way?

For the first concern, I would recommend:

  1. Use dd to create a large file of zeros, absorbing all free space on USB drive
  2. Delete large file of zeros
  3. Create compressed image of drive (i.e., dd if=/dev/usbdrive | gzip > usbdrive.img.gz )
  4. Use GPG to compute a detached signature for the usbdrive.img.gz file.

You can then use GPG to send the detached signature to the recipient, so that they can run the same procedure on their end to verify.

To get the compressed image to be equivalent for both the sender and recipient, you will need to be careful to use the same versions of the above tools. Might be good to use the same version of the Tails LiveUSB OS in order to verify the compressed image.

For the concern about tampering with your storage medium, you might want to consider using a write-once medium like DVD. Not only can you perform the same kind of analysis as above for verifying the data authenticity, but you can place the DVD in a jewel case, and place hard-to-remove seals along the edge, to make any tampering obvious.

share|improve this answer

I'd try like this:

dd if=/dev/sdb | md5sum

I can't try here because I lack a thumbdrive.

If you watch "Writing a thumbdrive from scratch", you might see it with different eyes ;)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.