A customer provided an external drive (USB 2.0 and Firewire 800 connections), and wants me to copy files onto the drive. The drive is not new. I have no particular reason to suspect the customer would intentionally send a drive containing malware, but I don't know that the drive is clean.

I'm using Mac OS 10.8.3; is there a significant risk of malware transfer upon connection? Is there a safe way to inspect the drive before copying the files?

EDIT For clarification, I'm concerned about the risk of triggering malware transfer from the USB drive to my computer upon connection. This might be a real risk; I'm asking for confirmation that this transfer-upon-connection risk is real in this scenario, or imagined.

ANOTHER EDIT @Adnan answered the question as stated, and I agree with his answer. I now realize I was also interested in another possibility -- the device might mask its nature or purpose. The USB page on Wikipedia states that USB 3.0 supports a guest device initiating communication with the host upon connection, and that Fireware has always had this capability, while earlier versions of the USB protocol enforce a "speak-when-spoken-to" behavior on guest devices. An external drive is unlikely to initiate communication, but a malicious device might. So if you trust that the device is just an external hard drive, connecting that drive to a Mac OS or Windows computer (with Autorun turned off) is probably not risky by itself. But if the device is not just an external drive (i.e. it's something like the USB Rubber Ducky), there is some risk.

  • For the sake of sanity of all us paranoid types, you can also buy a brand-new spring-clean USB 2.0 external drive and give it to the client. :) Commented May 6, 2013 at 19:31
  • 1
    If you're very concerned, you could boot to a Live CD and copy the files that way.
    – John
    Commented May 6, 2013 at 19:55
  • 2
    Knowing that it doesn't answer your question, Windows users can hold down the <shift> key, until after the drive is mounted, this should prevent any autoplay and autorun scripts. Commented May 6, 2013 at 20:02
  • @DeerHunter, what about supply chain concerns? ;) john, you're halfway there... martinstoeckli, g2k but that's only one threat vector... Commented Jul 31, 2014 at 21:07
  • You also need to think about USB keys that are not just data devices. Take a look at hakshop.com/products/usb-rubber-ducky-deluxe for example. Commented Oct 18, 2017 at 23:45

7 Answers 7


If you connect the disk, don't open it, and just send the files to it, then there's almost no risk at all. If your system is originally clean, malware cannot magically move themselves from the USB disk to your system. Plus, Mac OS X doesn't have an autorun capability for USB drives. It never has.

The only theoretical risk I can think of, is if the attacker had found a vulnerability in the way Mac handles the drive's names and was able to exploit it and execute some code.

Personally, I wouldn't worry about it. Just make sure you copy without opening it.

Note 1: When I say "don't open it", I don't mean that there's a magical way to get you infected if you open the disk, there isn't. It's just that if you open it, it's more likely that you'll click on something in it.

Note 2: Please don't run an Anti-Virus scan on a disk that is not yours unless you're asked to. Anti-Viruses tend to be stupid, they delete pen. testing tools all the time.

  • 1
    Was thinking over a Clancy-thriller-worthy scenario when a USB-connected storage device transmutates into something completely different... like a USB keyboard - and sends a crafted key sequence to the OS. Commented May 6, 2013 at 19:18
  • @DeerHunter for social engineering purpose i am using a prepared usb stick which is actually a mass storage AND a hid device... ;-)
    – Dr.Ü
    Commented May 6, 2013 at 19:39
  • @Adnan, you write "malware can magically"; did you intend to write "malware cannot magically"?
    – Eric Rath
    Commented May 6, 2013 at 20:30
  • @EricRath Yes, correct. This is the second time this happens to me today.
    – Adi
    Commented May 6, 2013 at 20:33
  • @Adnan, do you know if the risks vary between USB 2.0 and Firewire 800? I.e. the drive in question offers both types; would connecting with one present different risks than connecting with the other? It seems plausible that the two protocols provide different on-connection behavior.
    – Eric Rath
    Commented May 6, 2013 at 20:43

Respectfully, @Adnan is dead wrong in some key assumptions that it is relatively safe to open an unknown external drive.

As I answered here, it is not safe to connect any infected drive without proper safeguards in place.

In fact, the only way to be 99.99% (nothing in security is certain) sure it's malware-free is to actually do a forensic examination on it. At a bare minimum you should only attach an unknown external device using a proper VM. Ideally, you would take a forensic image of the drive and then examine it in the VM.

Note that you can do this 'safely' but only if precautions are followed.

Here is a simple article that outlines a few real-world examples.

Bear in mind that it is not just limited to autoplay features. There are sooooo many ways to hide things digitally and then execute them (leveraging OS/driver/buffer exploits for example).

Update: you may want to keep your ears peeled for more information on this as it's presented at Black Hat soon.

  • Re "Ideally, you would take a forensic image of the drive"; Isn't this hen-and-egg problem? How do you take a forensic image of the drive?
    – Pacerier
    Commented Mar 6, 2018 at 8:06

I believe all Mac OS 10+ versions disabled the auto run feature so even if there were a virus on it, if you are simply copying files it would never start unless you intentionally ran the program.

I would say you are very safe in attaching and copying the files with no ill effects. If it were Windows I say would there is a lot of worry.

If you are that worried, you can download Kaspersky's bootable USB antivirus and plug the drive in on reboot and scan it with that.



One possible scenario:

  1. boot a live distribution from stick (use your fav)
  2. mount your local disc as read-only
  3. copy files from the local disk to your costumers external drive

Another scenario:

  1. Download, install and update a free anti-virus software
  2. Disable autorun from USB on your mac
  3. Connect USB
  4. Run a direct anti-virus scan against the USB drive
  5. Take only the files you require from the USB drive

USB Thumb drives are super super cheap - you can play it safe by eating $2-15 depending on the quantity of data. Alternatively boot up a machine you can wipe, copy the files to it, copy the files, mount the customer drive on the temp box, copy files from temp box to customer drive, reimage (wipe clean) the temp box.


MacOS 10 does not autorun. You should be fine. Just don't go clicking and opening things from the drive of unknown history. If you have pre-Windows-7 Windows machines turn off autorun before connecting random drives to them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .