I was having problems with my Kingston 8GB USB drive (it kept saying "write protected"). I solved the problem by first using ChipGenius and then a program called "Restore v3.13.0.0". I downloaded from a Russian website. But along with the program I obviously downloaded a virus too (Kometa virus, a docked toolbar appeared on the right of my screen). Is it possible, despite being formatted, for the USB to be infected and the firmware to be messed up?
-
what firmware could be messed up? not on the usb drive, it doesn't have firmware, they use cheap ROM– dandavisJan 2, 2018 at 4:38
-
Yes it does - all USB devices have some - it may be read only so not an issue but you need more detail nakedsecurity.sophos.com/2014/10/06/…– NateJan 2, 2018 at 12:23
-
is the drive USB2 or 3? If it's USB2, you're safe. If it's USB3, your still likely safe, but it could be based on the phison2251, the bad usb chipset used a few years back that's now pwned.– dandavisJan 4, 2018 at 15:43
2 Answers
Yes.
Unfortunately, without more specific information on the infection, it's hard to know how likely it is, and it probably isn't likely* that it flashed the firmware in such a way as to infect it, but you can't be 100% sure.
* This is not to say of malware that uses the Autorun feature which hop off of a USB flash drive by using autorun.inf
. It's actually not unlikely that malware on the machine may hop onto the flash drive that way.
-
Do you think it is safe to use the usb as a bootable windows 10 on my brand new laptop? I'm afraid of any physical damage that can happen to it, so I try to be cautious. Thanks for the reply. Jan 2, 2018 at 4:32
-
I wouldn't. It's possible that it's safe, but it can't really be trusted. Jan 2, 2018 at 4:36
-
-
USBs have firmware and it can be reprogrammed. It's unlikely that this is the case where it's been reprogrammed, but it's still possible. Additionally, while AutoRun is disabled by default, it still is worth mentioning. Jan 2, 2018 at 4:44
-
can you link to a firmware update for any plain usb thumb drive (no AES, wifi, etc)? i've never seen such...– dandavisJan 2, 2018 at 4:46
Why wouldn't formatting the USB stick help?
The USB essentially has 2 different storage areas, there is the one that stores your files, and the one that holds the firmware.
If the malware has infected the firmware then it would not be on the normal storage, so formatting the normal storage wouldn't help.
Why wouldn't reflashing the USB stick help?
Reflashing uses the current firmware to update the firmware, so there is no way to be sure that the old firmware hasn't just pretended to update the USB stick.
Is the USB definitely infected?
It is hard to tell if the USB is definitely infected, but it is also hard to tell that the USB is definitely not infected, so it can no longer be treated as safe.
-
can you link to an app, a patch, or any kind of hacking tool that could alter (or even reach) the USB stick "firmware" you speak of? (this i gotta see).– dandavisJan 2, 2018 at 21:42
-
More information is available here: nakedsecurity.sophos.com/2014/10/06/… Jan 2, 2018 at 22:41
-