Protection from Malware on USB Sticks

Yes the possibilities are scary, and obviously if it at some point tells the OS it is a also a keyboard, or perhaps a usb hub with multiple devices attatched it can behave as any or all, including sending commands to the OS to install payloads from its own storage.

 

There are times that in my job I have to plug in many USB flash drives (literally hundreds over the last 12 years) and carefully check their contents, I'm not a technician but in my experience they are the most common carriers of malware.

I do use Sandboxie for browsing safety, but for flash drives in this particular situation whereby I have to save their contents, a combination of virtualization (Shadow Defender) an updated antivirus (Avira) would be my preliminary action. Once I finish my session, I would transfer all these new files (often 2GB) from my virtualized machine to an external drive.

Once at home the external drive would be further scanned with other tools to make sure it is clean. It goes without saying that most USB sticks were infected, although in the last 5 years they have been fairly clean probably due to the protection afforded by Windows Defender.

 

What we need is a way to transfer files securely between devices, specifically online to offline device and vice versa without exposing the offline device to potentially catastrophic malware carrying transfer media. I have an idea, im going to create an android app to test it.

 

My post No 52 is the way I deal with the problem, using virtualization. Obviously against a flash drive that might fry your machine, there isn't much that one can do except ask the owner of the USB to pay for your damages or have an insurance (I don't).

 

Interesting analogy.

 

The current state of USB data protection

https://www.helpnetsecurity.com/2018/03/30/usb-data-protection/

 

Journalists covering the Trump-Kim summit were given free USB fans — but security experts warn they may be trojan horses full of malware

http://uk.businessinsider.com/usb-fans-journalists-malware-trump-kim-jong-un-summit-2018-6

 

The press kit from the Trump-Kim summit included a USB fan. Experts don't think it's safe

 

Good to see that people are still sharp, I must admit that even I could have made this mistake. But I do use EXE Radar to block executables from running from USB drives.

 

What was on a USB fan given at the Trump-Kim summit? Security experts say nothing —  but don’t plug it in.

https://www.washingtonpost.com/tech...security-experts-say-nothing-but-dont-plug-it

 

USBHarpoon Is a BadUSB Attack with A Twist
August 20, 2018
https://www.bleepingcomputer.com/news/security/usbharpoon-is-a-badusb-attack-with-a-twist/

 

Schneider Electric may have shipped USB drives infested with malware
The flash drives were "contaminated" during the manufacturing process.
September 7, 2018
https://www.zdnet.com/article/schneider-electric-shipped-usb-drives-infested-with-malware/

 

Hi guys

Long time lurker who wanted to help answer this question. There are some projects out there that are looking to mitigate these trust based attacks (as USB as a standard has implicit trust/no defined security measures).

One is this project on github
https://github.com/JLospinoso/beamgun

Totally not the author, but it does seemingly work as even when I’ve plugged in non-malicious USB-Ethernet or USB HIDs it has waited for user authentication. There are also other variations of this software around.

 

Thanks for your attention to this and sharing. Might be of some use for some.

 

USB threats from malware to miners

https://securelist.com/usb-threats-from-malware-to-miners/

 

Anyone know anything about USB Disk Security?