0

Putting Programs/OS/Files (contain malware) on USB-Stick (USB-stick can do read/write). Let's say this USB stick, after i put Programs/OS/Files on it, is now just theoretically, read-only. I myself still can e.g. copy the programs/OS/Files on the computer where i would connected it, ofc with it the malware. In this scenario, exist malware that can copy itself from USB-stick (which is read-only) to the computer?

The malware has to do at very first step a write execution before it can copy itself on the computer. With Read Only USB stick it can't. True?

Is the computer which the USB-stick is connected too and all the rest of devices that are connected to the computer are relevant for my question? When some malware is allready on the computer or on the connnected devices it can make a copy process (from USB-stick to computer) in any kinda theoretically possible way possbible. True?

Improve this question
1
  • Updated question
    – user183457
    Commented Aug 28, 2018 at 12:12

2 Answers 2

Reset to default
1

If the question is if malware can copy data from USB device to computer, the answer is yes.

If user have read privileges, malware have the same. If the USB device is read-only or read-write does not make any difference.

If the question is about malware writing on a read-only USB device, it depends on the privileges the malware obtained. Usually, a USB device is marked as read-only by the OS, and any program with OS privileges can override the lock and write.

If the device have physical write protect switch, nothing can write on it. There is an astronomically small possibility of a malware written just for your device, that could theoretically bypass the lock exploiting a vulnerability on the device's firmware, but this is so improbable that I would say it's impossible.

Improve this answer
4
  • So what i understand out of this is that the malware can't copy itself on the computer, when: Computer is free from malware, Hardware WP on USB-stick is given. Except from firmware vulanbility. You saying "If the device have physical write protect switch, nothing can write on it." I am a little bit confused about this sentence. Do you just wanted to point that out, because that's obvious, or do you mean by this that the copy process is a write process? But if the copy action is a write process why I can copy data from it then, when the stick has HW-WP?
    – user183457
    Commented Aug 28, 2018 at 13:37
  • 1
    I think you are confusing the direction. If data can be read, it can be copied. If computer is free from malware, but the device is contaminated, malware can go to computer regardless of write protection on the USB device.
    – ThoriumBR
    Commented Aug 28, 2018 at 13:45
  • So the malware told the OS copy "ME" (Malware) to the computer? But when this is true, the malware has to give the command to copy "ME" to the OS, and the command to the OS is a write process (on USB-stick itself) which wouldn't work on USB-stick with HW-WP. Obviously my thinking can't be right.
    – user183457
    Commented Aug 28, 2018 at 14:05
  • 1
    In this case, a copy is not a write process on the USB, is a write process on the computer. Some exploits on the OS side allows for auto-execution of code hosted on the USB device, as on CD or DVD disks as well - this is what makes the OS copy the malware to the computer. Read only on the device has nothing to do with that.
    – ThoriumBR
    Commented Aug 28, 2018 at 14:19
0

Is it possible for malware to replicate it's self from a USB-Stick that cannot be written to?

Yes, but only if you execute a program on your computer that causes this to happen, it cannot happen automatically (assuming there are not any vulnerabilities that are being exploited with the USB firmware on your computer).

In example, it's possible to write a program that will copy a virus from a USB Drive and then execute it. You could also store this program on the theoretical Read-Only USB Drive along with the virus. So then, you could put the USB Drive in your computer, then copy over the program that will, once you execute it, copy the virus that is still on the USB Drive over to your computer and then execute that.

The malware has to initially do a write execution before it can copy itself on the computer. With Read Only USB stick it can't. True?

According to your description of the theoretical USB Drive, the only restriction is writing to the USB Drive, and not to the computer. The computer is actually what handles all of the reading and writing in the first place. So even if the USB Drive is read-only, malware that is on the USB drive could still be executed if you or some other program execute it.

Would other devices connected to the computer in question be effected from the malware on the Read-Only USB Drive?

I can't answer that question fully since it depends entirely on the capabilities included with the malware. The theoretical risk varies depending on what the malware can do. i.e., If the malware is capable of exploiting a remote Windows 7 0day vulnerability over the network, then your Windows 7 machines connected to the same network as your computer may be at risk.

Improve this answer

You must log in to answer this question.