0

I am trying to distribute a software, a simple exe file, that can be executed directly from an USB drive. I would like to make that USB drive read only to avoid any malware infection and accidental deletion. Another requirements is to update this software using a trusted updater package in the field.

I understand I can use a hardware switched write protect USB drive, but then I am giving an option to the users to flip the switch when updating and I would like to avoid that.

So, is there a way where the USB drive is mounted readonly by default and if I need to write it, I need a password or an unlocking key or similar that can be achieved via a trusted script/package?

2

Completely impossible with standard flash drives. It's possible that a custom flash drive could have a storage controller to support something like this, but they'd be the rare exception and not the rule.

Instead, sign your executable and enable signature verification (such as AppLocker on Windows) on the computers that will run it. Then, if malware infects your executable, it won't run.

  • Thank you. Is it possible to have a time based unlock code for the usb drives? for example something like this - securedrive.com/product/secureusb-kp-encrypted-flash-drive – Manny Jul 5 at 7:25
  • What do you mean by time-based? – Joseph Sible Jul 5 at 13:04
  • What I mean is - the PIN to unlock the drive is time based. Like RSA tokens or similar so that the unlock code (even if shared) wouldn't hurt – Manny Jul 5 at 15:11
  • Also not possible with a standard flash drive. You'd need either custom hardware, or for the actual encryption key to be stored on a server on the Internet that does the time-based token checking. – Joseph Sible Jul 5 at 15:12
  • Thank you very much! – Manny Jul 5 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.