2

I have a used rewritable DVD that I want to wipe and use to store new data. The DVD has been written to before by someone I don't know and can't necessarily trust. Is there a safe way to use the disc? I can do this in either Windows 10 or Ubuntu and am just looking for general best practices rather than NSA-level protective measures.

  • If you're that concerned about it, the simple solution is to buy a new DVD. – AndrolGenhald Nov 16 '18 at 21:58
  • Can you define your adversary? For "best practices", isn't disabling autoplay enough? – forest Nov 16 '18 at 22:01
  • @AndrolGenhald right. So if it is a pain I will have to do that. It would save a trip to the store and I am also curious. – Zach Boyd Nov 16 '18 at 22:01
  • I don’t think anyone is hunting for the info on my computer, so the model is random troublemaker I guess? – Zach Boyd Nov 16 '18 at 22:02
  • @ZachBoyd Do you work in any highly-competitive industry? If so, is the disc located in a place where, if someone did want to compromise your computer, they know you would see the disc (e.g. in your work place), or is it really totally random (e.g. in a corner on the street)? – forest Nov 16 '18 at 22:04
3

Best practices

For best practices, rather than for defending against a highly sophisticated adversary, it should be enough to just disable autoplay/automount. This will prevent any malicious content on the DVD from being processed by the operating system, but will still allow you to write a new image to it.

There is some informational data that is read unconditionally whenever a new disc is inserted into a reader/burner. This data identifies, among other things, the make and model of the disc, its capacity, and various burner features that it is compatible with. This data could, in theory, be maliciously designed to trigger a security bug in either the drive firmware itself or an operating system driver. Utilizing this as an attack vector is, however, quite difficult and would only be a risk to a high-priority target due to the level of sophistication required to pull it off.

But to answer the heart of your question... You work in a highly competitive field and have access to corporate and government data, as well as sensitive new research. You have found a disc just lying around in your new office. These are all red flags: Don't insert the disc!

This should be sufficient as an answer, but if you want to know the details, read on...

Risk of reading the disc

If the disc is malicious and is designed to compromise your system, it will most likely try to do so through contents on the disc itself rather than metadata. This relies on the assumption that you'll be curious about what was written to it. Possible attack vectors include:

  • Corrupt filesystems - The filesystems for discs is typically UDF, a simple filesystem with only basic feature support. However, mounting a device causes your operating system to process the filesystem, which comes from an untrusted source. I have actually seen this used as an attack vector in the wild against a Linux system, where a malicious disc filesystem was used to attempt code execution in the kernel via an iso9660 0day (which may or may not be fixed).

  • Icons or previews - Many operating systems will display previews of files that it finds in a new mount point. The decoders that read the icon information embedded in the file, or which read the file contents itself to generate a preview, may contain security bugs. Exploiting these bugs can result in code execution with the privileges of the previewing software.

  • Autoplay and autorun - While this is not a common issue for modern systems, older versions of Windows would automatically open a disc and execute the file specified in autorun.ini. However, although new systems are not going to do this, they still may be configured to open the disc and play video or audio data if present. Video and audio decoders parse complex data formats in unsafe languages, making them a prime target for exploitation.

All of these exploitation vectors are mitigated by disabling autoplay and automount. This will prevent your computer from viewing anything contained in the disc's filesystem or the filesystem itself. It will not, however, prevent the drive firmware from checking the disc metadata and related information and sending that information to the operating system, which could still be exploitable.

Risk of reusing the disc

The metadata information is automatically read by the drive and delivered to the operating system. Typically, it is burned in by the manufacturer and cannot be changed by an end-user (though a sophisticated attacker could still provide you with a disc with customized metadata). An example of what the data looks like as reported by wodim when burning a disc:

Device type    : Removable CD-ROM
Vendor_info    : 'MATSHITA'
Identification : 'DVD+-RW UJ8C7'
Revision       : '1.00'
Drive id       : 'WQ36  064543'
Driver flags   : BURNFREE
Supported modes: TAO SAO

All this information is read unconditionally as soon as the disc is inserted into the drive. This is also the reason why the disc spins up the second you insert it, even if you do not read or write to it immediately. It's a result of the drive trying to understand what has just been put in it. I am not aware of any specific vulnerabilities that could be exploited this way, but that does not mean they do not exist.

Analyzing your situation

Regarding your recent comments answering whether or not you work in a competitive industry:

I work in academia as a research math. So probably not competitive in the sense you are thinking. I found it in my office among a the random stuff left by the previous office user.

Research can be extremely competitive, and the fact that you saw this disc left over in your own office could be a red flag. If someone wanted to compromise your computer to obtain valuable information, one of the easiest and most common techniques is to leave media "lying around", since chances are, the target will take the device and use it. This is most commonly done with flash drives, since no one can resist plugging in a random flash drive (or inserting a random disc) just lying around.

I have access to the data of a large corporation, which is the most sensitive data available to me. Also some official-use-only data from the government, so it is conceivable that someone would want it. As for ideas, there are one or two hot ideas that are developed in some of my files that I am keeping quiet about until I publish.

This makes you a prime target. You say you just want best practices and do not need to defend against an NSA-level adversary, but the kind of information you possess could be extremely valuable. You may have to defend against highly sophisticated adversaries near the level of a nation-state. You should always be weary of tempting devices lying around, as this could very possibly be an attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.