1

There is some debate going on among my peers. With differing opinions regarding risk on infected thumb drive with limiting policies set on it.

Question is Can you still get an infection with read only access, disable write on thumbdrives. How about disable execute access only.

My thoughts is that if you disable write. Higher risk as AV cannot clean the thumbdrives but you can still get an infection from read only drives. Disabling execute reduces the risk but infection can still occur. Plus side is AV can clean/quarantine if required. Read only serve no purpose apart from preventing writing files to the thumbdrives.

Thoughts?

  • "...Read only serve no purpose apart from preventing writing files to the thumbdrives.." - which might be a very important purpose. Assume that your computer is infected but the thumb drive clean. First you plug it into your computer, then you plug the now infected drive into another computer - voila, the malware spread to other systems. – Steffen Ullrich Aug 25 '18 at 14:57
1

You should also be aware that if the thumb drive is malicious (as opposed to having malware on it) then you should be aware of non-malware attacks that impersonate different types of USB device. It could pretend to be a keyboard and type commands onto your system for example.

If you can reliably prevent execution of any files hosted on the drive, then that would be a reasonably effective solution. Execution prevention of untrusted locations (e.g. Downloads, AppData, etc) is by no means 100%, but it's actually quite effective at tripping up various automated exploits and mass-market attacks.

0

First to clarify your point on blocking write: risks of USB drives are both ways, it’s not the only risks are from PC to USB drives.

  1. Risks from USB drives to PC – the USB drives could be malicious, and the threats could be more than we think. It can be used as a remote control/control center for hackers. Similar case happened on ‘Stuxnet’ case.
  2. Risks from PCs to USB/other PCs – your PC could be infected, and it may transfer malicious code to connected USB. It shall spread across other nodes in the network when this USB is connected to other nodes.

Hence the mitigation/controls of threats of USB drives should be selected based on both ways risks in consideration. Following could be some of the possible ways of mitigating these risks:

  • Ensure each PCs have the required security scanners (Example: Aniti Virus Scanner, Malicious Scanner, etc) and up to date with latest updates.
  • Ensure USB drives are pre-scanned before connected to network. You may have a separate scanning node for this purpose.
  • Implement a policy to prevent office USB drives been used for home purpose or connecting to any other nodes outside office network.
  • Implement controls over the files been transferred over USB drives (for example avoid exe files transfer on USB drives).

Hence only limiting the writing will not be adequate to mitigate the risks of thump drives.

0

Are you only accounting for storage USB drives or things like the Rubber Ducky? The Ducky acts as a keyboard and always an adversary to do anything that a person with a keyboard could normally accomplish.

The answer to your original question is yes, you can get infected from a read only drive.

Most people don't execute things from the USB drives themselves, they move the data off and then execute it which would bypass disabling execution. Set drives to take no action and scan them with anti-virus before doing anything with them.

Use a firewall to limit outbound connections when possible.

This isn't bulletproof but to my knowledge no security solution is 100%.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.