222

Take a look at this USB keyboard: "But that's not a keyboard! That's an USB drive, silly!" Actually, no. It looks like a USB drive to you, but when it gets connected to a computer, it will report that it is a USB keyboard. And the moment it is installed, it will start typing key sequences you programmed on it beforehand. Any operating system I know ...


88

Recently, a form of attack has surfaced which does not "hack" the computer through code or software vulnerabilities, but instead does actual damage to the electronics. A creator known as Dark Purple created a device known as the USB Killer 2.0 (based on an earlier version created by him based on the same concept) which, when plugged into the USB slot of the ...


83

No logs are recorded on the USB itself around file accesses. At best, you might know if the files were changed by looking at the file timestamps, which can sometimes happen just by opening them, depending on the program opening them. But there will be no way to determine, by looking at the USB, if the files were copied.


76

I'd use a Raspberry Pi, the Model A/A+ without a network connection, as: It (or rather Linux) can read most types of filesystem on a USB stick. The only non-volatile storage it has is an SD card, which can be reformatted (or discarded if you're paranoid) afterwards. If the USB stick turns out to be electrically malicious, you've only lost $20 of hardware. ...


69

Buy a PS2 to USB adapter for keyboards+mice (important: both need to be in one usb port to make sure it's not a naive straight-through connector). They have logic and cost about $10 USD at time of writing. Then buy USB to PS2 adapters for both mice and keyboard (separate adapters). They have no logic, just internal wiring to each connection and they ...


60

You are taking the wrong side of the problem. If someone you do not trust can access to a machine, the machine has been compromised. Full stop. That's the reason why access to server rooms is highly controlled, and why admin normally do not care for the physical security of the connectors: the defense line is not at the connector level but at the room ...


58

You’re misunderstanding what BitLocker is supposed to protect against. The goal of BitLocker is to protect your data from cold boot attacks (as explained in a Technet blog entry). When you unlock a volume protected by BitLocker, the system gains access to the keys necessary to decrypt the drive and behaves as if it was a regular drive. That is necessary to ...


57

Short answer: YES You can be infected even with a full patched Windows system and an updated antivirus. This happened before and can happen again. A few years ago, the Stuxnet worm was specially engineered to attack the Iranian nuclear facilities. They got hit by using infected USB drives, without autorun.inf or executing anything by hand. Those ...


52

There is no way to be sure by strictly technical means. On the one hand, if your friend has antivirus software installed, it would probably scan your USB stick as soon as it was plugged in their machine; and this would be completely indistinguishable from data being read as a part of copy operation. On another hand, if they would like to cover their tracks,...


49

The USB-killer wouldn't kill your PC if you connected it through an opto-isolated hub. They do exist, (search: "opto-isolated usb hub") but as I've never used one myself I'm not going to recommend a specific model. They're not cheap though. Here is an example: Once you've dealt with the hardware aspect, you're then reduced to a more common problem. You've ...


46

You can hack the firmware of a USB device. With that you can tell the OS whatever you want, eg. the device is empty even it is not. Or attack the USB software stack of the OS by sending data that a normal USB device would not send (so the device could even really be empty, the attack comes from the firmware). You can also do other funny stuff, like tell the ...


43

To quote the ISM (Australia's military standards for cyber security). Security Control: 0359; In flash memory media, a technique known as wear levelling ensures that writes are distributed evenly across each memory block. This feature necessitates flash memory being overwritten with a random pattern twice as this helps ensure that all memory blocks ...


39

The "USB stick left outside the power plant" you are talking about sounds a lot like the Stuxnet affair. There was a surprising (and satisfying) amount of detail about the technical aspects in the book Countdown to Zero Day. If you are genuinely curious I would highly recommend reading it. To give you a tl;dr for your question; it's not done with a script ...


38

A cold boot attack is impossible on an offline device. The only way an attacker could use a cold boot attack on your portable storage device is if they also had physical access to your computer as it was plugged in the disk unlocked. A cold boot attack relies on encryption keys being stored in RAM, and the persistence of that RAM once the computer is hard ...


35

If we assume that the stick could have been physically altered for maximum nastiness, then one must take into account the possibility that the alleged "memory stick" will spew out some anthrax spores or a cloud of plutonium oxide when inserted in a computer, so the answer to your question would be: there is no safe way to examine the contents of a memory ...


33

Yes, BadUSB turns benign (USB) devices into malicious monsters by reprogramming the controller chips. This is on a much lower level than the 'autorun' feature that you are talking about. USB Rubber Ducky is another, comparable threat. Like ThoriumBR said, any host machine can be exploited by some unknown zero-day vulnerability. There are not many practical ...


28

You effectively can't. If you're on somebody else's machine and they have administrative rights to it, then that's the game. The quite fancy answer be mandatory access control systems like SELinux which hold a concept higher than root that would at least require a reboot and direct system access to change the settings.


27

A famous example of what you are asking about is this advisory from Microsoft. The vulnerability referred to is triggered just by inserting the USB stick; no other interaction from the user is required. This is how the Stuxnet virus spread - see e.g. reports from Symantec and F-Secure.


27

Referring to my answer to this question (before it was migrated): No, scanning the drive without "opening the folder" isn't a secure way to protect against viruses on the drive. It's very risky to insert what you believe to be a compromised USB device into your PC, no matter what AV you have installed. If you desperately need files from the drive (to quote ...


24

USB works like this, AFAIK, note where lies could lead the system astray. Computer supplies +5V and GND to USB device. Microcontroller in the USB device runs and transmits USB-speak for "This is a type X device" (X is disk, camera, keyboard, mouse, or any device registered with the USB Consortium). Computer takes "appropriate" action. Consider USB devices ...


24

On Windows systems, you've been able to block or restrict USB devices through Local or Group Policy since at least Windows Vista. By setting the "Removable Storage Access" policies, you can disable the attachment of USB storage devices (that category includes a lot of nefarious USB devices). These settings block Windows from interacting with the devices ...


23

These kind of approaches used to work, but due to the high spreading of viruses through pens, the option autorun on operating systems that enabled USBs to run when plugged, was disabled. Before that option was disabled, you could have an EXE file on a USB device that would execute when you plugged the USB into the computer. On recent operating systems the ...


22

Next time you're about to put sensitive data on a flash drive, consider encrypting it first! Strongly encrypted data is useless without the key, and if you securely erase the drive first, all that will be left is an occasional sector of such encrypted data surviving due to wear leveling. If you're still unsatisfied by this technique because there's a small ...


17

A quick check at amazon.com shows 64GB USB drives in non-designer cases go for about $20. Less if you buy in bulk. Since you want "quick and efficient" lets factor in the time needed to overwrite the drive at least twice, and maybe running a drive scanner to verify the erasure. And then remembering to do it each time. A quick check of homedepot.com shows a ...


17

There are several possible attacks on Bitlocker, and apparently a software is available to the police that supports recovery of the password (but requires sniffing the RAM while the device is mounted and unencrypted). The primary weakness is the recovery key stored in both AD and the TPM chip - but if your attacker has only the USB stick, those don't apply. ...


14

The standard approach is to fill the USB ports with epoxy resin. Of course, this must be combined with similar approaches to seal the case, so the attacker can't get in via the PCI bus, etc. Note that even if you do this, law 3 still applies: if a bad guy has unrestricted physical access to your computer, it's not your computer anymore. EDIT: reflecting ...


14

USB devices talk to the computer, not to each other. During the file copy, all the data went through the RAM of the laptop -- and, precisely, through both the OS kernel and the RAM of the file explorer application. The file explorer should not have written a copy of that data anywhere on the laptop disk. However, a copy of the data has been kept in RAM by ...


Only top voted, non community-wiki answers of a minimum length are eligible