1

I bought a USB stick with a hardware switch to enable write protection. I burned a Linux iso on it to make some forensics analysis on my installed OS. Could the write protection be bypassed via software from a remote attacker? Could it be attacked and re-written?

2
  • 1
    Sort of related: The write protect switch on normal SD cards definitely doesn't prevent writes. It just sets a bit that the OS is supposed to honor. (No idea about USB drives. Even though such switches don't seem standard, I wouldn't cite that as proof that a USB drive enforces write protection. And I hope someone else wouldn't accept something that weak as proof.) Apr 7, 2020 at 19:32
  • Depending upon the details of exactly how you "burned a Linux iso on it", it's likely a SquashFS Read Only file system anyway. Rewriting it even with write access would not be easy. Apr 7, 2020 at 20:49

1 Answer 1

1

It depends on whether that switch makes a change to the hardware or it triggers a software change in the stick (or the OS).

Any software-based protection could be manipulated via software. Hardware-based protection cannot be manipulated via software.

3
  • How can I know if the switch is a real hardware or it triggers a software change ? If I try to mount it on openbsd with write protection enabled I can't because the os says "permission denied" Apr 7, 2020 at 17:17
  • 1
    @BiosRootKit There is probably no way for someone to tell without reverse engineering the USB. I think you only need to worry about software on the OS computer. Unless there's something I'm unaware of, like being able to reprogram the USB firmware over USB. Apr 7, 2020 at 19:20
  • what's do you mean with "software on the OS computer" ? I have that usb stick that seems hacked... If I boot from the USB I don't think that the OS software can interfere with the usb stick. The only alternative is the usb firmware reprogrammed or some malware in the laptop firmware. Apr 11, 2020 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.