0

If I purchase a supposedly brand new USB stick (or micros SD, or similar portable storage devices) online, and I don't quite know the origin where they are produced, and I am a bit paranoid, is there a sure fire way to cleanly wipe it, including removing any hidden codes?

Do applications such as BalenaEtcher or Rufus do such a clean wipe?

On the opposite side, are there techniques where hidden codes are permanently embedded in portable storage devices that cannot be removed. And the only sure fire way is to physically destroy such devices?

1
  • 1
    Firmware can theoretically be infected that can't be "wiped".
    – schroeder
    Apr 16 at 20:23

2 Answers 2

2

The same answer as Sjoerd's, with more details and examples.

1

An USB stick is a storage device with a filesystem on it. Your PC is going to interact with the filesystem. It doesn't expect to find anything else in there but what it put there itself.

So, let's simply imagine you get a second-hand USB stick, which had lots of data on it. Then it gets "quick-formatted", i.e. the index of the filesystem lists the whole space as free. Your PC believes there is nothing in there.

If you want to store a file on that filesystem, the space will be there, your file will be stored in that space in place of whatever was there before. Unbeknownst to you (or the PC), the space is contiguous to a wealth of data which could still be recovered, but neither you nor your PC nor anyone else will normally be able to access it by any normal means, because you can't access space that wasn't officially allocated, but if you allocate it, then that space gets overwritten.

A forensic tool can access that space without re-allocating it, and the old data will come out - what's left of it.

This is a legitimate source of worry if you have reason to believe that a forensic search might be ran on that USB stick. In that case, the natural conclusion of those conducting the search will be that the data recovered belonged to you. Any text, image, or video will be assumed to have been produced by you. This can be understandably awkward.

To avoid this, the "countermeasure" with a plain vanilla, "common" USB stick is straightforward: when you come in possession of a storage device, fill all of its available space with a single large file, full of zeros or hexadecimal 0xFF or 0xA6 or 0x90 depending on several alternative traditions.

For reasons, you'll want to fill the disk with 128 to a bit more than one thousand half-kilobyte files, then delete them, fill the disk again with a single large file, and finally delete that. Your USB key is now clean, all information it contained unrecoverable. The empty file and the names of the small files will be recoverable, but they were empty and pose no issue.

There are tools (e.g. SDelete, DiskWipe, DiskFill, Trasher, ...) that do this automatically and a good bit faster, but you can also do it yourself with a batch file and some time.

2

Then: are there techniques to hide information, etc.? You bet there are. BUT the standard mandates that no storage areas may be protected from writing from the host device, so to have those areas and be sure of not losing them to someone using (1), you need a non-standard USB stick. There are several kinds of those.

An USB stick is simply a flash memory plus a chip with a program that "speaks" the USB language. A "vanilla" USB key translates the whole of that memory into what would be seen if it was a hard disk.

(The important thing: once you no longer have a plain vanilla USB key, but some kind of computationally more advanced gadget, all bets are off. The critter might do anything, absolutely anything. Not that this isn't true of hard disks too, you know).

For example, and this is only one out of dozens of possibilities, such a chip might answer USB queries to make the host PC believe there are actually two - or even three - disks attached to the port, splitting the memory of the chip between themselves. This is absolutely doable.

More: you could write on the third, very small "disk" a file with an encryption key inside, that could never be read again, only rewritten (read requests to that file would be answered with zeroes). Then you write a second file which is temporary, not stored on the flash memory but in the USB controller's RAM - it will be lost when the key loses power. As long as this second file exists, if it matches the key file, then all reads to the second disk are encrypted with that key, all reads from the disk are decrypted with that key. Reads and writes to the first disk are unencrypted. And lo and behold, you have yourself a "Secure USB key" (there are several models on Amazon; none of them use the naive method of writing a key to a file to engage decryption, but they could). Just look for "Encrypted flash drives" and you'll have no end of choice. You can use it as a normal USB key (the first unit), or you can enter the encryption key and gain access to the second unit.

Or you might have a USB key that reports itself as being 16 GB and has "16 GB" etched on the case. And yet it could be that the actual memory chip, if you dismantled the USB key, was 32 GB. When and if (and only if!) you write a very specific data sequence to a very specific sector beyond the 16 GB limit - something an unsuspecting user would never have reason to attempt - ta-da!, the extra 16 GB reappear (until disconnect). But unless you know this is possible and you know the sequence, those 16 GB will be forever out of your reach and ken. Until you open the key and check out the chip's make and model, you'll never know that isn't a real 16 GB disk.

Scammers run this trick in reverse all the time, selling "4 TB" storage keys that are actually 32 GB cheapo units with a hacked firmware that reports 4 TB (this, unfortunately, also can be sometimes found on Amazon).

You might even have a USB key that in particular circumstances reports being a CD-ROM (I have one - a IODD mini crypto drive, my precioussss), a bootable CD-ROM with autoexecute activated. When those "circumstances" are met... your connected PC might start executing code you didn't even know existed.

In all those cases, a "non-standard" USB key cannot be distinguished by a normal, boring one if the manufacturer or the hacker had a minimum of care.

So, if your question is, "I have an unknown USB memory here and I want to be sure that it contains no tricks", the only suggestion I can make involves fire, brimstone and a new USB memory purchased from a reputable seller.

1
  • Thank you. I learned a lot of stuff from your answer. Apr 26 at 20:28
2

For a normal USB stick or microSD card, it's possible to remove or overwrite all data, so that any data it came with is removed.

However, it is not easy to verify that an USB stick will always behave itself as a normal storage device. It could pretend to be a keyboard and type malicious command into your computer. Or it can present different parts of its storage at different times.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .