A "friend" offerred me a USB with files.
I plugged it into my Ubuntu (version 12 or 14, don't remember) PC and an error appeared (don't remember exactly what was written..).
So I wasn't able to browse its content and I returned the USB stick to its owners..
Now I suspect that it contained malicious software.
How certain can I be in the security of Linux/Ubuntu OS from a USB originated threats?

  • too broad .. the only answer is that no system is invulnerable.
    – storm
    May 21 '16 at 10:04
  • @AhmedJerbi You can say that on every question here on this site...
    – Rami
    May 21 '16 at 10:04
  • Especially when you don't have any details , so if you think that just using Linux can prevent you from an infected USB stick .. That's a big NO.
    – storm
    May 21 '16 at 10:08

The only safe thing to do with unknown USB devices is not plug it in, but if you must then plug it into an air gapped freshly installed computer and wipe it again afterwards.

  • even if it's a windows' virus?
    – Rami
    May 21 '16 at 10:29
  • 2
    @Rami 1) you do not know it is a windows virus. It is an unknown. 2) You are also assuming that usb device is just a memory stick with a virus there are ways to emulate keyboards and mice and have it run a scripted set of keystrokes. This can be done in a cross platform way. 3) I have not covered that malicious code might infect firmware in various devices in which case one needs more than just a wipe to get rid of it (this is much rarer, but not impossible) hence why not plugging it in is the safest course of action.
    – ewanm89
    May 21 '16 at 10:34
  • Fundamentally, from a security perspective, USB is fundamentally insecure. We count it as physical access, but there is worse physical interfaces out there (expresscard, thunderbolt and firewire) where something called DMA (Direct Memory Access) exists where the device can directly modify data in main system memory bypassing the operating system entirely.
    – ewanm89
    May 21 '16 at 10:47
  • OK then please answer me this: Would the average person (with average knowledge in technology) could download an extremely sophisticated malware? Is this kind of malware easily available to the "general public" ? ("is it downloadable easily?")
    – Rami
    May 21 '16 at 11:02
  • No, but that wouldn't be how I would get someone infected, an old penetration test trick is to throw a few memory sticks over the fence into some business' carpark and let the employees plug them in "to find a document that would allow them to be returned to the owner). Sometimes such things end up not working quite that way, Stuxnet for example was specifically targeted against a certain power facility in Iran using both USB memory sticks and network as infection vectors to end up on that specific network, However that didn't stop 40% of infections in other countries.
    – ewanm89
    May 21 '16 at 11:13

No usb device is save. Specially this, where software will not protect you from having your computer damaged.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.