4

We're launching a tender for a big project, and some of the businesses who want to make an offer are asking if they can send some brochures together with a USB stick or CD-Rom.

Since we're trying to take more precautions, we don't just want to plug in flash drives from random companies who we don't know whether they can be trusted.

What kind of security precautions can we take in advance? is there anything we can ask them to do that proves their drives or CD's are safe?

Most info I can find is on keeping the data on the drive secure, does it work in a two-way street where encrypted data or read-only drives cannot infect your computer?

Should we ask all of them to send Ironkeys (encrypted USB portable storage devices), or would that not be effective/a waste of money?

thanks for your replies!

2

The standard procedure is to:

  • Use only one PC to plug the sticks and read the CDs/DVDs
  • To have that dedicated PC isolated from the network except one (only one) network share to where the materials are copied
  • To have all Windows Updates and AV updates

The above will help you:

  • Avoid USB and DVD Trojans affecting any PC to where you would plug it in
  • Reliably run AV scan on every new material

The main point is, that you have reliable machine for such operations so you do not risk giving USB sticks and DVDs to random employees where AV may be switched off or not up to date.

And even there might be some advanced USB exploit, you do not risk much as you are isolated from the network (you don't have permission to browse internet except updates and one network share), and when you copy the files, these are AV scanned. The USB stick virus if crafted by hacking company can bypass AV software.

Frankly speaking, this happens sometimes. Depends how much of target you are, so the more you are, the better precautions must be taken.

2

What kind of security precautions can we take in advance? is there anything we can ask them to do that proves their drives or CD's are safe?

CDs and SD cards are less risky than USB devices. CDs are only drives.

USB 'drives' have the same risk, but some devices look like drives, but they actually emulate a keyboard, (or many other possible devices) running pre-programmed keystrokes and/or mouse movements to compromise the machine.

Most info I can find is on keeping the data on the drive secure, does it work in a two-way street where encrypted data or read-only drives cannot infect your computer?

Should we ask all of them to send Ironkeys (encrypted USB portable storage devices), or would that not be effective/a waste of money?

No, encrypted drives and read-only drives is about protecting the drive from the computer, but it does not protect the computer from the drive.

There is some benefit to knowing a name-brand product. You can be more certain that there is no USB exploits and it is a simple 'drive'. However you are much better off using CD or SD Card (drives that have no USB ability) as name brands can be faked.


So in conclusion,

  1. The important thing here is to make sure it is a drive (storage device) and not some more intelligent device which you are connecting to computer. Ask for CDs or SD Cards, no USB.

  2. A properly configured computer will not auto-run files when the CD or SD Card is inserted. You can post a separate question to verify your configuration.

  3. There is still a risk of accidentally running a malicious file, not automatically, but by user input. (ignorance or laziness)

    You must make sure the viewing program (i.e. Adobe PDF reader) is up to date so it is less likely to contain security holes when you open those files.

    If you receive an .exe file, reject it. Some file types cannot be opened safely.

  4. Run this computer isolated on a separate LAN from your other devices, so they cannot communicate directly and potentially infect other machines in the process.

    Avoid sharing these files with other computers, as those computers may not be running the latest security updates.


Other suggestions:

  • Encourage your vendors to share the file online, via an Online File Sharing service. This saves you from steps 1 & 2 above, but you must still follow 3 and 4.

  • Upload the files to an online viewing service, instead of on your local computer. For example, Google Drive will allow you to view Adobe and Microsoft Office documents, very well isolated from your computer.

  • Consider opening the device on a Chromebook, and not a Windows machine. Chromebook was designed from the ground up with better security than a Windows machine. This will give you some coverage.

  • Warning: Do not reboot your device with the external storage still attached. The BIOS may recognize an OS on the foreign device and try to boot to it. You should also reconfigure your BIOS to always treat internal Hard Disk as first choice, and remove the other boot options from automatic selection.

  • Anti-Virus programs will help you, but they have limited potential.

0

there is indeed an advanced USB exploit, check out the research Nohl et Al.

https://opensource.srlabs.de/projects/badusb - some of the links from here are now broken but some work, following is the presentation from Blackhat 2014.

https://www.youtube.com/watch?v=nuruzFqMgIw

Superglue the USB ports then ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.