How to use untrusted USB devices?

Off Topic
1

What should I do if I have to access a USB drive that is untrusted?

2

Its not really a privacy question but I think it is important to answer this.

Best case you just throw the USB stick in a certified shredder but that might not always work out.

So what I do is in these cases, take an old empty laptop and remove the network card. Then boot in UEFI/Bios, make sure to also disable networking there, some laptops have network chips soldered or part of the motherboard so this step is not to be skipped. Boot the laptop, preferably also a non-persistent system like Tails on another USB drive. Only after plug in the suspected drive. Check contents. If you suspect anything actually malicious you are advised to throw both the USB and the laptop in the shredder after.

8 Likes
3

Apologies if this is a stupid question, but what does a certified shredder refer to? Iā€™m assuming itā€™s not a physical shredder, but Iā€™m not succeeding in finding a good answer.

4

depending on how it was go in order of priority:

  • Wipe the drive in the OS
  • if thatā€™s dangerous wipe it in a live usb
  • if thatā€™s dangerous shred the drive
  • if the drive is not even in question, solder a new BIOS or replace the motherboard
  • If none of those options work then shred the laptop
1 Like
5

Well it is actually probably both a device and a company offering that service to use such device.

Obviously depends on your situation but I personally never want to be responsible for something not being adequately destroyed. So I like to ā€˜transferā€™ that risk.

Definitely not a stupid question.

1 Like
6

No.

Wiping a drive is the worst advice you could give, sorry.

Wiping drives is near impossible. In most cases forensic tools can easily recover data.

If you find anything seriously suspicious, you should not take any risk and discard the device completely. Persistent malware exists in far to many ways to make assumptions about where it will reside. You should always treat the hardware as compromised.

If the hardware you use to test is not worth the test in the first place, just shred the USB drive right away.

1 Like
7

What if you put the USB in a little bit of gasoline and light it up?

8

I cannot really say all that much about it. It might work but i would never take that risk when providing advice. I guess all depending on threat model like with anything is the case.

In forensic studies, I did, we found quite nifty ways to recover data from even disks who got recovered from burned down buildings. Take that for what you will.

The question to ask is how much money/effort is someone in the worst case going to invest in getting that data?

1 Like
9

ive proposed an order of magnitude

if you think those are dangerous then its those last three ive mentioned

10

Sorry but still no. Malware can have persistence in many chips these days, so if it is actually sophisticated you should shred the whole thing.

11

How does it escalate to shredding the laptop?

3 Likes
12

Is there in general no way to restrict a USB device from acting as keyboard/mous/monitor and limiting it to data transfer only?

2 Likes
13

What exactly does untrusted mean for you?
Is it are drive you found on the street?
A drive ordered from Amazon?
Something different?

1 Like
14

Either

  • Use an old laptop bought from craigslist to access the content, and destroy the laptop immediately afterwards, or

  • Throw it to the trash. Usable size thumb drives cost next to nothing these days (10-15 dollars for 32GB). The cost of ensuring itā€™s not malicious USB killer and not loaded with some Stuxnet trying to get to your system, is way too high. Thereā€™s also the attack vector of USB rubber ducky where the thumb drive pretends to be keyboard and runs scripts at superhuman speed. Those scripts can perform UAC privilege escalation on Windows trivially and on unpatched Linux by typing exploit code.

15

why not use an old laptop with no hardrive, boot from Tails and acess the USB drive.

Flash the bios afterward, this is not a perfect method but that would adress common threats.

16

yes, but thoses forensic devices are expensives.

edit: I think I misunsterdood, the forensic devices I was refering too, are read-only device for HDD and USB-drive. They disable writing and protect the integrity of file for court. But read-only is dangerous for virus other malware.

Sorry.

17

ask @ph00lt0 not me

18

Using no hard drive surely is fine but malware can also persist in firmware of your motherboard and other chipsets or in your memory. So if it is serious malware it cannot be trusted after.

1 Like
19

The main attacks of concern i think are

  • malicious hid/ducky attack (most oses trust the usb device as a legit keyboard, that can run a command to download malware. It can even target multiple oses. I think thats your main concern
  • electrical. This requires the device to have a battery or a power input, but it can output voltage that will destroy your usb receptacle or your motherboard.
  • autorun (no modern os is weak against that)
  • malware injection trough code injection thumbnails or file properties (most oses are good against that)
    To be honest this seems like it would be a cool ā€œusb testerā€ project.

A esp32-s3 with two ports can do it fine and it costs like 8usd to replace. Even less if you buy in bulk or use one of the cheaper esp32 or similar controllers or even solder an extra usb receptacle.

The hardware can run a simple webserver that allows you to inspect the usb device and, if its a mass usb, to acess it over network.

The only attack that would work on that device is electrical, and that is not a hard or expensive device to replace.

1 Like
20

But why are they?

Is it so hard to build a software/hardware that blocks the types of inputs that are used to attack the host, like keyboard/mouse input or monitor output but let normal storage data flow through?