Hot answers tagged

191

Take a look at this USB keyboard: "But that's not a keyboard! That's an USB drive, silly!" Actually, no. It looks like a USB drive to you, but when it gets connected to a computer, it will report that it is a USB keyboard. And the moment it is installed, it will start typing key sequences you programmed on it beforehand. Any operating system I know ...


75

Recently, a form of attack has surfaced which does not "hack" the computer through code or software vulnerabilities, but instead does actual damage to the electronics. A creator known as Dark Purple created a device known as the USB Killer 2.0 (based on an earlier version created by him based on the same concept) which, when plugged into the USB slot of the ...


67

Best stop doing that. Never overwrite an SSD/flash storage device completely in order to erase it, except as a last resort. NVRAM has a limited amount of write cycles available. At some point, after enough writes to an NVRAM cell, it will completely stop working. For modern versions, we're in the ballpark of an estimated lifespan of 3,000 write cycles. ...


65

I'd use a Raspberry Pi, the Model A/A+ without a network connection, as: It (or rather Linux) can read most types of filesystem on a USB stick. The only non-volatile storage it has is an SD card, which can be reformatted (or discarded if you're paranoid) afterwards. If the USB stick turns out to be electrically malicious, you've only lost $20 of hardware. ...


56

Short answer: YES You can be infected even with a full patched Windows system and an updated antivirus. This happened before and can happen again. A few years ago, the Stuxnet worm was specially engineered to attack the Iranian nuclear facilities. They got hit by using infected USB drives, without autorun.inf or executing anything by hand. Those ...


55

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


42

The USB-killer wouldn't kill your PC if you connected it through an opto-isolated hub. They do exist, (search: "opto-isolated usb hub") but as I've never used one myself I'm not going to recommend a specific model. They're not cheap though. Here is an example: Once you've dealt with the hardware aspect, you're then reduced to a more common problem. You'...


33

The "USB stick left outside the power plant" you are talking about sounds a lot like the Stuxnet affair. There was a surprising (and satisfying) amount of detail about the technical aspects in the book Countdown to Zero Day. If you are genuinely curious I would highly recommend reading it. To give you a tl;dr for your question; it's not done with a script ...


32

Yes, BadUSB turns benign (USB) devices into malicious monsters by reprogramming the controller chips. This is on a much lower level than the 'autorun' feature that you are talking about. USB Rubber Ducky is another, comparable threat. Like ThoriumBR said, any host machine can be exploited by some unknown zero-day vulnerability. There are not many ...


31

If we assume that the stick could have been physically altered for maximum nastiness, then one must take into account the possibility that the alleged "memory stick" will spew out some anthrax spores or a cloud of plutonium oxide when inserted in a computer, so the answer to your question would be: there is no safe way to examine the contents of a memory ...


29

You effectively can't. If you're on somebody else's machine and they have administrative rights to it, then that's the game. The quite fancy answer be mandatory access control systems like SELinux which hold a concept higher than root that would at least require a reboot and direct system access to change the settings.


26

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very risky to insert what you believe to be a compromised USB device into your PC, no matter what AV you have installed. If you desperately need files from the drive (to quote ...


25

A famous example of what you are asking about is this advisory from Microsoft. The vulnerability referred to is triggered just by inserting the USB stick; no other interaction from the user is required. This is how the Stuxnet virus spread - see e.g. reports from Symantec and F-Secure.


22

These kind of approaches used to work, but due to the high spreading of viruses through pens, the option autorun on operating systems that enabled USBs to run when plugged, was disabled. Before that option was disabled, you could have an EXE file on a USB device that would execute when you plugged the USB into the computer. On recent operating systems the ...


15

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


14

When you plug a USB key in, a considerable amount of things happen. The OS first talks to the USB device to know what kind of device it is and what it can do. Then, if the device says that it is a kind of disk, the OS will look for a filesystem on it, then mount it, and explore some of the files. Depending on what files were found and their name, the OS will ...


13

There are several known ways that a malicious USB device can compromise your computer: Autorun. The USB device can contain software that Windows will automatically run when you plug in the USB device, if you have autorun enabled. Input device emulation. As @TobyS says, the malicious USB dongle might physically look like a small flash storage device (a ...


13

USB devices talk to the computer, not to each other. During the file copy, all the data went through the RAM of the laptop -- and, precisely, through both the OS kernel and the RAM of the file explorer application. The file explorer should not have written a copy of that data anywhere on the laptop disk. However, a copy of the data has been kept in RAM by ...


13

Yes there's a way to hide the a file from Windows' and Linux's file explorers, which is to start the file name with a dot . and set the h and s flags. In Windows that can be done by using the command line ren file .file attrib +h +s .file Now the file cannot be seen by File Explorer, Nautilus, or Konqueror in their default settings on clean machines. ...


12

It all depends on the configuration of your OS, be it USB "stick-ed" or not. If your live system enable you to write in one way or an other to the physical disk of your home computer, then there is a non null probability that the computer could get infected. Take for example a virus that would copy itself on the MBR of your main disk. Concerning infection ...


12

A USB device with "manipulated firmware" can sure do evil things. For an extreme case, see this answer: the USB device may tell to the OS "hey, I am the FireWire-to-USB converter X.Y, please download my driver from your vendor, then grant me full DMA access when I say so". Though theoretical yet, this is not science-fiction, and it sure is scary. For more ...


11

Physical write protect on a USB drive should work in all cases. The write controller is in the drive itself. Thus, excepting a wholly insane implementation, the physical write protect switch is secure. Physical write protect is always kind of a semi-soft thing, but it's usually at the drive internals. With a floppy drive where the controller is external to ...


11

Seems pretty obvious that you could just disconnect the network cable. Plug in the USB, Dump/Upload files, eject the USB, then reconnect to the network. This should prevent them from having any kind of access to the drive (read or write) Unless they own the computers AND have some mechanism to download everything on any connected usb device (which is ...


11

While above the electrical aspects were covered many are concerned by a malware infecting your BIOS. Well, then plug it into a machine which doesn't have a BIOS and won't run anything on the stick: use a SPARC machine. I see Sunfire V100 machines on eBay for $50-60 in uncertain conditions, less than $200 for so called "seller refurbished". It is possible ...


10

Actually quantum computers are not that much a threat for symmetric encryption. To put it in simple (and somewhat simplistic) terms: A quantum computer, if it ever exists, will totally break the most used asymmetric encryption and key exchange algorithms (RSA, ElGamal, Diffie-Hellman...) but not all asymmetric algorithms (QC does not break the concept of ...


10

A combination of two USB drives and a hub might be a good solution Use the write-protected USB drive for any data that you dont want to get sabotaged and the other USB drive for anything you want to save and take with you home.


9

I think this question is asking a bit more about what happens when you encrypt data on a device where that data was previously unencrypted. SSD units and HDD units suffer from different possible compromises related this. This is basically referred to (at least on the venerable Wikipedia) as data remanence. That article offers lots of information about the ...


9

Truecrypt, with an executable of the installer in the thumb drive (unencrypted ofc) so you can install it on any computer you plug your thumb drive. If it's possible encrypt with a pass in the form of HA&%^&G^ARELIBSFhahdjag62r&^^^5129380y. Drawback of this is that you'll have to carry another thumb drive with you to contain your password in ....



Only top voted, non community-wiki answers of a minimum length are eligible