0

I know that plugging in some random SD card or USB drive in a system can be a bad idea because you may get malware on your system. Now imagine you found a storage device either a memory card or flashdrive, you want to check it's contents without having to worry about being infected, now you look at the device and sees it has a write protection switch, so you move it to turn it on and the storage media is now read only.

Now does that mean malware can't spread from it, can the malware bypass that protection?

Also I know it prevents the system from accessing the storage media, but I'm not sure if it prevents the storage media from accessing the sytem.

1

you look at the device and sees it has a write protection switch, so you move it to turn it on and the storage media is now read only.

Now does that mean malware can't spread from it, can the malware bypass that protection?

No. Malware acts by being read and executed from media, not by being written to it. Setting the media to read-only merely guarantees you can't add or delete anything from it. If your operating system wants to, or is tricked into, reading and running code from that device, you're vulnerable.

  • guarantees you can't add or delete anything from it: not quite. It tells the OS you don't want to write, but it can do as it pleases. – ThoriumBR May 27 '19 at 18:54
1

As @gowenfawr explained setting the write protection switch will not prevent your computer from reading and executing anything on the storage media.
It would only work the other way around: if your computer is already infected, the malware could not spread onto the storage media.

But even if the switch would prevent the malware from spreading, ask yourself: if you do not trust the content of the card, why would you trust the write protection switch to work as it suggests.

1

Not at all. Write protection is not read protection, and it's more likely a flag saying "I prefer not being written" than a switch. And the OS or card reader can ignore that and write anyway.

According to Wikipedia:

The presence of a notch, and the presence and position of a tab, have no effect on the SD card's internal operation. Rather, it relies on the host. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it.

Now, on malware. If you can read any file from the card, the OS had access before you. Any malware exploiting a bug on the OS can execute and modify data anywhere, even on the card itself.

Think about putting an infected CD on your drive. If your OS is vulnerable, malware on the CD will spread to your system.

And how could you read the contents of the card without infecting yourself? An easy way is to unplug your HD, boot from a live Linux distribution, and plug the card. Linux can read almost any partition and filesystem out there. Read what you want, copy what you want, shutdown and plug your HD back.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.