2

I was having problems with my Kingston 8GB USB drive (it kept saying "write protected"). I solved the problem by first using ChipGenius and then a program called "Restore v3.13.0.0". I downloaded from a Russian website. But along with the program I obviously downloaded a virus too (Kometa virus, a docked toolbar appeared on the right of my screen). Is it possible, despite being formatted, for the USB to be infected and the firmware to be messed up?

  • what firmware could be messed up? not on the usb drive, it doesn't have firmware, they use cheap ROM – dandavis Jan 2 '18 at 4:38
  • Yes it does - all USB devices have some - it may be read only so not an issue but you need more detail nakedsecurity.sophos.com/2014/10/06/… – Nate Jan 2 '18 at 12:23
  • is the drive USB2 or 3? If it's USB2, you're safe. If it's USB3, your still likely safe, but it could be based on the phison2251, the bad usb chipset used a few years back that's now pwned. – dandavis Jan 4 '18 at 15:43
2

Yes.

Unfortunately, without more specific information on the infection, it's hard to know how likely it is, and it probably isn't likely* that it flashed the firmware in such a way as to infect it, but you can't be 100% sure.

* This is not to say of malware that uses the Autorun feature which hop off of a USB flash drive by using autorun.inf. It's actually not unlikely that malware on the machine may hop onto the flash drive that way.

  • Do you think it is safe to use the usb as a bootable windows 10 on my brand new laptop? I'm afraid of any physical damage that can happen to it, so I try to be cautious. Thanks for the reply. – LearningMath Jan 2 '18 at 4:32
  • I wouldn't. It's possible that it's safe, but it can't really be trusted. – Justin Krejcha Jan 2 '18 at 4:36
  • @dandavis on the usb. – LearningMath Jan 2 '18 at 4:39
  • USBs have firmware and it can be reprogrammed. It's unlikely that this is the case where it's been reprogrammed, but it's still possible. Additionally, while AutoRun is disabled by default, it still is worth mentioning. – Justin Krejcha Jan 2 '18 at 4:44
  • can you link to a firmware update for any plain usb thumb drive (no AES, wifi, etc)? i've never seen such... – dandavis Jan 2 '18 at 4:46
0

Why wouldn't formatting the USB stick help?

The USB essentially has 2 different storage areas, there is the one that stores your files, and the one that holds the firmware.

If the malware has infected the firmware then it would not be on the normal storage, so formatting the normal storage wouldn't help.

Why wouldn't reflashing the USB stick help?

Reflashing uses the current firmware to update the firmware, so there is no way to be sure that the old firmware hasn't just pretended to update the USB stick.

Is the USB definately infected?

It is hard to tell if the USB is definately infected, but it is also hard to tell that the USB is definately not infected, so it can no longer be treated as safe.

  • can you link to an app, a patch, or any kind of hacking tool that could alter (or even reach) the USB stick "firmware" you speak of? (this i gotta see). – dandavis Jan 2 '18 at 21:42
  • More information is available here: nakedsecurity.sophos.com/2014/10/06/… – jrtapsell Jan 2 '18 at 22:41
  • For a tool to defend against an infected device here. And here seems to show an attack (although it seems to brick the USB in the process) (Reposted to fix extra characters added to links) – jrtapsell Jan 4 '18 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.