Convenient Write Once Media to attach to a computer: A USB stick or device?

Question

What is a convenient write once media to use with a Computer, preferably via the USB interface.

I often see this use-case in several ways:

1. I have a server whose logs need to be on a medium that cannot later be erased or changed by an adversary to hide his tracks
2. There's photos or other media that need to be dumped for long term archival use without the risk of e.g. the recent "ransomware" trojans that encrypt data and then blackmail the user for money to give him the decryption key

Traditionally a CD / DVD would have catered to at least some of these use cases but now they are somewhat limiting in terms of size / usability etc.

I know SanDisk offers a MemoryVault Product with what they call their "preserve only" mode.

http://www.sandisk.com/memoryvault

But I'm not sure if this is a software protection or at the level of the hardware. What is even more confusing is that their Chronoprotect technology seems to actually allow a certain number of writes and then goes into a Read Only mode which seems weird.

Another option is this Magneto Optical Disk from HP:

http://www8.hp.com/us/en/products/storage-media/product-detail.html?oid=62378#!tab=specs

But that seems a little too specialized and possibly expensive. And I'm not sure how it is better than, say, a DVD.

The ideal combination seems a USB-stick / flash drive with write disabled internally at the controller level on the stick itself so that one doesn't have to depend on any host computer specifics to protect the data and yet the data itself is readable on any generic host / OS so long as standard USB access is allowed.

SD Cards often come with a write protect tab, but unfortunately that seems not mandatory and depends on the host controller obeying the "Read Only" suggestion. e.g. This StackExchange Question: Is the SD card write protection hard-wired or optional?

Also, a write protect tab seems iffy in some cases because it is still subject to a very likely human error. Otherwise I could use something like this USB stick: http://www.amazon.com/Kanguru-Solutions-Flash-Write-Protect-KF3WP-32G/dp/B008OGNMEI/ref=pd_sim_147_2?ie=UTF8&refRID=166NN5XXCH7FBCHNJTXW

PS. I'm assuming my adversaries are only software based. i.e. Let's ignore an adversary who might have physical access to the medium to insert into his dedicated hardware rig.

Answer 1

These WORM (write once read many) devices are by definition inconvenient and that's why there are very few of them and rather expensive. The expensive part is because it has to have hardware support.

You could try doing it on the same system with read-only rights for certain users and harden it with the immutable attribute. Even root cannot delete those files, but an attacker with full access can stop setting the immutable attribute for future files. But in the end, low level writes to the disk could change anything, so software can't be tamper proof.

Even forensics teams that deal with very sensitive electronic evidence use normal drives combined with other physical security measures like storing offsite and using fireproof safes. Keeping multiple copies of evidence and using hashes to prove they were not tampered with is another method they employ. This has the obvious downside that the data being protected is static.

Full disk encryption (FDE) serves the same purpose and that might give you some more flexibility. Although some FDE software offers read-only options on mounted volumes, in certain use cases the whole encrypted volume can be deleted.

My best advice is to send the data over a network to a different device.

• If you care about logs, Synology offers syslog servers on their NAS devices.
• Build your own NAS with FreeNAS that speaks syslog.
• Get a cheap Raspberry PI and hook a hard-disk to it then sftp any files to it.
• It can also be done more elegantly with network file systems.

To actually answer your USB requirement, I found a company that sells USB drives with WORM capabilities.