7

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be connected to a PC. Isn't it possible for the malware to spread from the drive to the PC? Sure, antivirus programs might help but they aren't perfect. A particularly nasty piece of malware can utilize that time windows to infect the host PC. What's the foolproof way to deal with such an situation?

  • 6
    A hammer. USB sticks are dirt cheap and you don't want to risk your data. – Deer Hunter Aug 24 '15 at 20:09
  • Won't booting into a live CD(Linux) help?In that case,the USB will only have access to the running OS(which isn't the main OS)? – Mayank Singh Aug 24 '15 at 20:13
  • 1
    And the running OS has access to the common hardware. The risk ain't worth it. Of course, if you have a throwaway airgapped rig that can be studied by your forensics team, by all means go for it. – Deer Hunter Aug 24 '15 at 20:17
  • How could you stop the USB from mounting the hard drive or modifying your BIOS? – Neil Smithline Aug 24 '15 at 20:19
9

As USB drives can be compromised in ways that are not identifiable by an antivirus and not corrected by formatting the drive, the only foolproof solution is to destroy the drive.

  • Great, but what if you care about the files that were on it? – phyrfox Aug 24 '15 at 20:15
  • 1
    @phyrfox - there are strategies that will reduce your risk but the question specifically asks for the foolproof way. There is no foolproof way short of destruction. – Neil Smithline Aug 24 '15 at 20:21
  • Unless you're foolish enough to boot from the USB stick that's infected, Linux is the foolproof solution. I've safely recovered many sticks, hard drives, etc, this way. – phyrfox Aug 24 '15 at 20:23
  • @phyrfox - what if the USB pretends to be a USB keyboard or some other non-drive device that the system interacts with automatically? – Neil Smithline Aug 24 '15 at 20:25
  • If you really needed to recover a file, you could always use something really cheap and expendable like a raspberry pi to extract your documents. You just have to make sure the files you retrieve haven't been tampered with. – David Zech Aug 24 '15 at 21:00
1

Honestly, you don't want to stick an infected USB stick into a Windows OS or Mac OS running system, since merely plugging in can cause infection. Instead, if you suspect your drive is infected, grab a Live CD for a specialized Linux distro that has anti-virus capabilities, such as Avira Rescue System, boot your system into that secure environment, and then scan the USB drive that way. You can also safely copy data off the infected USB stick (but be careful for infected applications you might copy). This is assuming you want to rescue your data. The code can't harm your system if it can run in the OS that's provided (e.g. Windows viruses can't run in Linux, as there are binary differences). Otherwise, if you don't care about the data, simply physically destroy the drive and get a new one.

  • 1
    How would you know that the USB won't work on both windows and linux? How could you stop the USB from mounting the hard drive? – Neil Smithline Aug 24 '15 at 20:18
  • 2
    But if the USB drive is modified so that it acts as a USB keyboard, it can execute type commands into Linux. – Neil Smithline Aug 24 '15 at 20:24
  • 2
    phyrfox, please study the matter just a bit more. Your advice is dangerous. It may work 9 times out of 10, but otherwise it'll wreak havoc on the unfortunate person who blindly followed your ill-considered advice. – Deer Hunter Aug 24 '15 at 20:28
  • 2
    Grab a live CD and pull the hard drive. If you leave the hard drive in, all bets are off. – schroeder Aug 24 '15 at 21:06
  • 1
    @DeerHunter I accepted your challenge, and did my reading; I actually perused the BadUSB code and various articles. The entire system is about the infection of devices, not hosts, which is an important distinction. Unless the virus on the USB stick supports a particular flavor of Linux, and Linux chooses to let it run, your actual hardware is safe. Yes, it's possible that BadUSB will make it impossible to recover your data, act like a keyboard, etc. It won't, however, infect the host without the OS's cooperation. I stand by this answer unless you have a specific proof or POC otherwise. – phyrfox Aug 24 '15 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.