A security risk with ordinary flash drives is that they have re-writable (flashble) firmware, which basically lets a hacker replace the operating system of the USB drive with their own.

Are there any USB drives that are guaranteed to be read-only and do not allow their firmware to be re-flashed?

  • I thought there are very less USB drives which have writable firmware. – defalt Nov 5 '17 at 7:21
  • Is it acceptable to have firmware which is write-able, but only if you push a physical button with a paper clip otherwise the firmware is inaccessible. Even then a button push is only good for something like 5 minutes. – cybernard Dec 29 '17 at 22:48
  • @cybernard yes, if the firmware is read only in a way that is physically controllable, then that is good enough. – Tyler Durden Dec 29 '17 at 23:44

Yes: https://www.kanguru.com/storage-accessories/kanguru-flashtrust-secure-firmware.shtml

There exist a few other, mostly encrypted devices uses secure firmware, but this is one unencrypted drive that uses secure firmware with signed firmwares.

  • As far as I could tell, this does not have read-only firmware. Just like every other USB flash drive, it has flashable firmware. It has a write-protect switch, but that prevents anything from being written to the drive at all. I want to be able to write to the drive. I just don't want the firmware to be writable or flashable. – Tyler Durden Nov 5 '17 at 18:38
  • @TylerDurden If you read the description, you will see that the firmware is signed with RSA2048, and the drive will only accept firmware updates signed by the manufacturer. Thats much more secure than a non-updateable drive, as the non-updateable drive could have exploits which cannot be fixed, which FlashTrust can fix after release. The firmware security is present regardless of the position of the write protect switch. – sebastian nielsen Nov 5 '17 at 18:43

http://www.isostick.com https://www.amazon.com/Elegant-Invention-isostick-revC-isostick/dp/B008S4XY08/ref=sr_1_1?ie=UTF8&qid=1514598410&sr=8-1&keywords=isostick

I submit the ISO stick as a candidate for consideration. It is in a USB factor, and you plug an SD card into it for storage. From the computer side it is just a flash drive. This is done so even if the device stops working or gets crushed you can get the SD card out and save your otherwise doomed data.

The firmware is flashable, but only through the use of a physical button. The button is at the bottom of a hole which is only big enough for the tip of a paper clip. It is impossible to accidentally push. Additional, I believe the timeout is short like 5 minutes, after you push the button to flash the firmware or it becomes unreachable again. During the 5 minute interval an additional port is visible which allows the firmware to be flashed.

In addition, it has a second read-only switch to make the USB storage if you choose to use it. Read-only ON plug it into a machine with a virus, and the virus can't touch it.

  • Are you absolutely sure that it is only flashable when you use that button? For example, can it not be modified by writing to a specific, high address as it can for many other drives? – forest Dec 30 '17 at 3:45
  • I know it is supposed to work that way, but lack the software and knowledge to put it to a live fire test. – cybernard Dec 30 '17 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.