16

Let's say a friend gives me a SD-card which I'm not sure is safe (i.e. it may contain malware), what is the safest way to access this card on a Mac OSX? E.g. is it possible to create a sandbox in Finder?

I know some of you may say, "Just don't access it." But assume this is a scenario where I have to access it.

Improve this question
1

2 Answers 2

Reset to default
9

So you've got yourself a hot agent and want to examine it? This is going to be fun!

First, do not simply plug it in and look around. Even if you were to create a 'sandbox' finder, that would not protect you from potential malware. So how do you actually see the goods? Well you need to perform a forensic examination! Here's what you'll need:

  • A Virtual Machine is crucial so you do not infect your machine. Make sure you configure it so that the VM does not have network access.
  • A forensic imager. I use helix or autopsy suite. FTK imager works well if you have a windows VM.
  • A Write Blocker to protect the integrity of the usb device being examined. This means preventing all writes to the target usb. This keeps a pristine record of the target but also prevents some types of malware from altering themselves on the target usb. Personally I say to use a hardware write blocker because they are more reliable (just go to amazon and find one).

Configure your VM with preferably a linux distro (like helix). Now, you simply attach the write blocker to your pc and set that up. Open your imager program and finally plug in your hot usb stick.

You now take a forensic image of this drive - either directly into RAM (if you have the capacity) or onto another (non-OS) drive. It may take a while depending on how large target is. Once you have the image, you can look through it in any number of ways using that same imager program (FTK makes it super simple).

The whole concept is called incident response and SANS has many good documents on what to do. Here is one. Also, I used this book to learn a lot about forensics. I know a guy taking his CISSP and he also just finished it so it is still relevant.

Good luck and have fun!

In response to your comment, malware can indeed spread without you knowing it once you connect an infected device. The best way to protect against that is to run the examination in a VM with a different OS than the target. The different OS helps in disallowing the malware to run and the VM acts as damage control should the malware break out and run anyway.

The most common and easiest way malware can spread like this would be the 'autoplay' feature but if you actually consider what is happening behind that feature you can see that there are certain things from that external media being loaded into RAM and written to your pc's harddrive (in the form of metadata/logs/etc). All* an attacker has to do is leverage that threat vector. * this is no small feat however :)

It's not all gloom and doom though. All you have to do is toss up a properly configured VM and you've essentially stopped 99.99% of that particular threat.

Improve this answer
17
  • thank you very much for a very comprehensive response. Btw, what do you think of this post (security.stackexchange.com/questions/35420/…). Is it true that malware can't just "transport itself onto your computer", but needs you to actively run it?
    – Honey Badger
    Commented Jul 31, 2014 at 20:19
  • 2
    @HoneyBadger, I posted an answer in that question and downvoted the accepted answer (it's inaccurate). It is a common misconception that malware somehow needs explicit permission to infect. There is a lot to say on that topic though. So I'm updating my answer with some details...
    – Matthew Peters
    Commented Jul 31, 2014 at 20:45
  • 1
    → Honey: it highly depends upon the mechanisms provided by the OS. On MacOS X, and from an USB peripheral, a crapware can't magically transport itself onto your disk, memory or any other peripheral.
    – athena
    Commented Jul 31, 2014 at 22:02
  • 3
    I'm not following how a write blocker can "prevent a device from writing to you". The threat is not that malware resident on a USB device will "magically" write itself into the host system. The threat is that the host system will read the malware from the USB device and then write it to itself. Really, for the sole purpose of protecting oneself from a malware infection, a write blocker is excessive. The write blocker is there to keep your system from altering the contents of the USB drive. The risk here is that the system might be tricked by the USB drive's contents into writing to itself.
    – Iszi
    Commented Sep 11, 2014 at 13:44
  • 5
    Matthew, a write blocker is used during forensic investigations to avoid corrupting evidence. It will absolutely not stop the device infecting you.
    – Rory Alsop ♦
    Commented Sep 11, 2014 at 13:49
1

Since you are dealing with dangerous material I would start by running this process on a dedicated system for this kind of investigation:

  • unplugged from any network connection (MacOS X in isolated network configuration: the equivalent of Airplane mode on an iPhone),

  • a system you can fully erase in case of malware evidence you can't fully erase.

On MacOS X, this task of sandboxing and analysing a suspicious external USB is basically a 2 step process.

Mount this USB key readonly

Please read this answer: How can I write-protect (make read-only) a USB drive in OS X? on Ask Different which is, from my experience the best answer.

This will protect the evidence from being corrupted by any MacOS X daemon (mdworker, Spotlight…) a human error or any forensic tool. This won't protect MacOS X which is still on a read-write filesystem.

Run clamscan and chkrootkit

If your USB storage is now mounted under /Volumes/suspicious_SD, and you have MacPorts, clamav & chkrootkit installed, run:

/usr/bin/sudo /opt/local/bin/clamscan -r /Volumes/suspicious_SD
/usr/bin/sudo /opt/local/bin/chkrootkit -r /Volumes/suspicious_SD

These are just two basics tools to detect publicly known malwares. This doesn't constitute a real forensic analysis which should start from there, based on tools like: find, tcpdump, opensnoop…

Improve this answer
4
  • 3
    You are assuming that clamscan and chkrootkit will detect all or most malware. That assumption is dubious.
    – D.W.
    Commented Aug 1, 2014 at 0:34
  • No one in information security will ever make such an assumption about an anti-virus approach. → D.W.: do you mean I should make the residual risk clear in case dummies would read this technical answer and could hurt themselves :) ?
    – athena
    Commented Aug 1, 2014 at 6:33
  • 1
    @danielAzuelos, what you are suggesting is simply a tool to research potential malware. You still need to conduct that work inside a secure environment which generally includes a write blocker.
    – Matthew Peters
    Commented Aug 2, 2014 at 22:26
  • 3
    @MatthewPeters As noted in comments on your answer, a write blocker (or even mounting as read-only) is to protect the evidence (in this case, the SD card which may contain malware) not you. Additionally, protection of the evidence does not appear to be a major concern here - Honey Badger obviously just has some data they need to get off the drive without getting infected. To be properly protected, a LiveCD or VM should be used instead.
    – Iszi
    Commented Sep 11, 2014 at 14:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .