2

I was having problems with my Kingston 8GB USB drive (it kept saying "write protected"). I solved the problem by first using ChipGenius and then a program called "Restore v3.13.0.0". I downloaded from a Russian website. But along with the program I obviously downloaded a virus too (Kometa virus, a docked toolbar appeared on the right of my screen). Is it possible, despite being formatted, for the USB to be infected and the firmware to be messed up?

Improve this question
3
  • what firmware could be messed up? not on the usb drive, it doesn't have firmware, they use cheap ROM
    – dandavis
    Jan 2, 2018 at 4:38
  • Yes it does - all USB devices have some - it may be read only so not an issue but you need more detail nakedsecurity.sophos.com/2014/10/06/…
    – Nate
    Jan 2, 2018 at 12:23
  • is the drive USB2 or 3? If it's USB2, you're safe. If it's USB3, your still likely safe, but it could be based on the phison2251, the bad usb chipset used a few years back that's now pwned.
    – dandavis
    Jan 4, 2018 at 15:43

2 Answers 2

Reset to default
2

Yes.

Unfortunately, without more specific information on the infection, it's hard to know how likely it is, and it probably isn't likely* that it flashed the firmware in such a way as to infect it, but you can't be 100% sure.

* This is not to say of malware that uses the Autorun feature which hop off of a USB flash drive by using autorun.inf. It's actually not unlikely that malware on the machine may hop onto the flash drive that way.

Improve this answer
12
  • Do you think it is safe to use the usb as a bootable windows 10 on my brand new laptop? I'm afraid of any physical damage that can happen to it, so I try to be cautious. Thanks for the reply.
    – LearningMath
    Jan 2, 2018 at 4:32
  • I wouldn't. It's possible that it's safe, but it can't really be trusted.
    – Justine Krejcha
    Jan 2, 2018 at 4:36
  • @dandavis on the usb.
    – LearningMath
    Jan 2, 2018 at 4:39
  • USBs have firmware and it can be reprogrammed. It's unlikely that this is the case where it's been reprogrammed, but it's still possible. Additionally, while AutoRun is disabled by default, it still is worth mentioning.
    – Justine Krejcha
    Jan 2, 2018 at 4:44
  • can you link to a firmware update for any plain usb thumb drive (no AES, wifi, etc)? i've never seen such...
    – dandavis
    Jan 2, 2018 at 4:46
0

Why wouldn't formatting the USB stick help?

The USB essentially has 2 different storage areas, there is the one that stores your files, and the one that holds the firmware.

If the malware has infected the firmware then it would not be on the normal storage, so formatting the normal storage wouldn't help.

Why wouldn't reflashing the USB stick help?

Reflashing uses the current firmware to update the firmware, so there is no way to be sure that the old firmware hasn't just pretended to update the USB stick.

Is the USB definitely infected?

It is hard to tell if the USB is definitely infected, but it is also hard to tell that the USB is definitely not infected, so it can no longer be treated as safe.

Improve this answer
3
  • can you link to an app, a patch, or any kind of hacking tool that could alter (or even reach) the USB stick "firmware" you speak of? (this i gotta see).
    – dandavis
    Jan 2, 2018 at 21:42
  • More information is available here: nakedsecurity.sophos.com/2014/10/06/…
    – jrtapsell
    Jan 2, 2018 at 22:41
  • For a tool to defend against an infected device here. And here seems to show an attack (although it seems to brick the USB in the process) (Reposted to fix extra characters added to links)
    – jrtapsell
    Jan 4, 2018 at 14:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .