3

Lets say that I buy a used hard drive on which an attacker has placed malicious files. Might these somehow pose a danger to my machine, e.g. via some other vulnerability such as buffer overflow causing a program to read from arbitrary locations on disk?

I'm no security researcher, but it intuitively worries me to just plug in a hard drive when I have no idea what's on it.

  • 1. That's not really a threat model. 2. It really depends on your setup, OS, auto run options etc. But in general one can say, that a) it's probably a good thing that you are worried and b) you shouldn't plug in a hard drive you know nothing about without taking any precautions. – Tom K. Mar 22 '18 at 11:43
  • 1
    disconnect your main HD, boot linux off a thumb drive, format/wipe the new drive. – dandavis Mar 22 '18 at 12:53
  • From your link: "Commuters use threat modeling to consider what might go wrong during the morning drive to work and to take preemptive action to avoid possible accidents".... sounds like a threat model to me. :) – Scott Mar 23 '18 at 2:47
6

Untrusted hard drives are potentially dangerous. You should make sure to format it (don't forget that there might be more than one partition) before you boot from it. If you want to be extra careful, you could disconnect your old hard drive, boot from a pen drive and format it from there. That way, there is minimal contact.

There are advanced malware that survives formatting by hiding in the firmware. However, it's not likely some random virus the previous owner contracted would have that capability. This would be a more advanced, targeted attack, and not something I would say the normal consumer needs to worry about.

  • Especially for older hard drives, this is a more realistic issue. It doesn't take being the target of an APT to have a hard drive that has been compromised at the firmware level. There are literally tutorials complete with pictures on how to do it. – forest Mar 23 '18 at 6:31
  • @forest Fair point, bringing James Bond into this was a bit silly. I have updated my answer to more clearly reflect what I meant but did not write. Maybe you still think I underestimate the risk, but this is how I'd grade it. Thanks for highlighting this! – Anders Mar 23 '18 at 9:34
  • No, I think your estimation of the risk is perfect. +1 – forest Mar 23 '18 at 9:50
1

I would at least format the drive before you boot from it. Formatting it in Windows should be more than enough or you can use an external tool such as EaseUs. I use that for anything related to disks because I just find it to be a really good tool. But that's my opinion.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.