I am trying to understand what generic risks are there in using my thumb drive to transfer files to some untrusted machine and plugging it back to my Windows device. Specifically I am interested in generic threats when I plug my USB Drive to external machine is compromised (like public image printing shop).

As far as I understand 2 main risks are:

A) Malicious files are copied to my pen drive from a compromised system and than

  1. I open them manually on a personal computer.
  2. Viruses are run automatically on usb drive plug in. (obsolete unless autorun is enabled manually on target machine)
  3. Malware is executed without user interaction and with autorun disabled. Such example would be something like buffer overflow in windows image thumbnail generator (CVE: 2010-3970). As far as I understand no user interaction will be needed and machine can be infected on it`s own (besides inserting USB drive, and browsing the folder of course).

B) Automated BadUSB firmware reprogramming. With all the further consequences that BadUSB deliver. But generally this kind of attack is not present in form of generic attack as it would require to support huge amounts of different peripheral manufacturers with different devices.

So my questions are:

Are there any other generic (non-targeted) threats that are similarly widespread in the wild?

In respect to risk 3 - how common are such almost no user interaction vulnerabilities in the wild?

  • 1
    You're probably going to get a few "Too Broad" votes to close this question. It's best to have one clear question per question. Also, questions B and D are off topic... StackExchange sites in general aren't very good for lists of things in a category, that might change over time. It might be best to edit this down to just one well defined question.
    – Ghedipunk
    Oct 28, 2019 at 23:48
  • Also, "Am I right?" questions tend to get ignored -- they're not explicitly off topic, just not well received. You can use what you wrote as background to show your understanding, and if some of your assumptions are wrong, there are plenty of pedants who will love to educate you. Question C might be the best one to concentrate on if you decide to edit your question.
    – Ghedipunk
    Oct 28, 2019 at 23:51
  • @Ghedipunk Thank you for your advice. I have edited the question and elaborated on one key question that is the reason I have this question in first place. By the way, can you please elaborate why do you think that question B is is off topic? I could be wrong with the phasing and if so I will rephrase that.
    – kirilloffs
    Oct 29, 2019 at 0:03


You must log in to answer this question.

Browse other questions tagged .