1

I bought a USB stick with a hardware switch to enable write protection. I burned a Linux iso on it to make some forensics analysis on my installed OS. Could the write protection be bypassed via software from a remote attacker? Could it be attacked and re-written?

Improve this question
2
  • 1
    Sort of related: The write protect switch on normal SD cards definitely doesn't prevent writes. It just sets a bit that the OS is supposed to honor. (No idea about USB drives. Even though such switches don't seem standard, I wouldn't cite that as proof that a USB drive enforces write protection. And I hope someone else wouldn't accept something that weak as proof.)
    – Future Security
    Apr 7, 2020 at 19:32
  • Depending upon the details of exactly how you "burned a Linux iso on it", it's likely a SquashFS Read Only file system anyway. Rewriting it even with write access would not be easy.
    – user10216038
    Apr 7, 2020 at 20:49

1 Answer 1

Reset to default
1

It depends on whether that switch makes a change to the hardware or it triggers a software change in the stick (or the OS).

Any software-based protection could be manipulated via software. Hardware-based protection cannot be manipulated via software.

Improve this answer
3
  • How can I know if the switch is a real hardware or it triggers a software change ? If I try to mount it on openbsd with write protection enabled I can't because the os says "permission denied"
    – BiosRootKit
    Apr 7, 2020 at 17:17
  • 1
    @BiosRootKit There is probably no way for someone to tell without reverse engineering the USB. I think you only need to worry about software on the OS computer. Unless there's something I'm unaware of, like being able to reprogram the USB firmware over USB.
    – Future Security
    Apr 7, 2020 at 19:20
  • what's do you mean with "software on the OS computer" ? I have that usb stick that seems hacked... If I boot from the USB I don't think that the OS software can interfere with the usb stick. The only alternative is the usb firmware reprogrammed or some malware in the laptop firmware.
    – BiosRootKit
    Apr 11, 2020 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .