If you had to access an unfamiliar flash drive (or other data storage), what safety precautions would you take?
If you had to access an unfamiliar flash drive (or other data storage), what safety precautions would you take?
The safest option is obvious, don't try to access its contents, but if you absolutely had to, what steps would you take to minimize/contain any potential harm to your device/network?
A computer I don't like very much, booted into some sort of Linux live environment, and zero network connectivity to anything: physically disabled if at all possible (like I mean a switch, not prying your wifi chipset out or whatever).
34Linux live USB, plug the drive into a sacrificial hub that can eat a bus kill if needed
20A what that can eat a what?
5I think something to protect against this https://usbkill.com/products/usbkill-v4
8They mean the USB bus. But killing the bus is a driver-level thing that the kernel controls, not the user. You can disable the port with CLI commands or a GUI depending on the OS, but killing the bus requires uninstall of the driver or manually shorting the caps directly on the mainboard, which is dumb.
5
Boot a PC with no hard drives with a live CD so there is no storage to write to. connect the drive and see what there is.
19Hard drives (SSDs, etc) are not the only durable storage that can be written to
2
I would play it safe and test it on my work PC in case there's anything that can cause trouble.
13Boot a Linux livecd on a computer with storage unattached. Connect USB through a hub.
11I'd get a computer from my local ewaste center, strip any wireless functionality from it, load it with Linux, and use that
10Rpi, fresh Linux, offline.
9Throw it into the fires that forged it
9To do it right, use a write blocker and clone it. Then lock the original away and have fun with the copy.
9You can use https://tails.net/ booting from another flash drive in memory only.
8Hit it with a hammer
2AFAIK computers with normal setups won't auto-run anything on a flash drive you insert. At most they'll prompt you to ask if you want to run something. (Say no.)
So, it's pretty safe to look at what files exist on the flash drive. Then you just have all the various exploits that exist with unknown files. Obviously, don't run any executables on the drive. Don't double-click on anything that looks like it's a document (say PDF or word doc) because it might not be. To be extra safe, even if it is actually a PDF or word document, don't open in the standard program (word or acrobat) because there's a slight chance it might be an actual PDF that exploits an unpatched vulnerability in that program.
If I work in Iran's nuclear program, and found this flash drive on the ground outside, I'd be a lot more cautious and maybe do some of these extremely paranoid things people here are suggesting. But, if Aunt Jenny was just over for a visit and I found a flash drive in the hallway near her room and want to check to see if it might be hers, it's probably safe just to insert the drive take a quick look and not click on anything.
1The problem is - is it just a mass storage device? Or is it maybe also a USB keyboard that will try to enter some payload? Or maybe it even contains a radio, and can communicate with an attacker nearby?
You can't tell from the outside which protocols a USB device implements.
You can fit all of that functionality into the space of a USB-A plug - so if it is a thumbdrive you have way more space to work with than you ever need.
At minimum restrict your computer to only loading mass storage drivers - but as you quite likely habe USB input devices it is just a lot easier to investigate such a device on something like a raspberry pi.
26That keyboard thing was pretty clever. I would not have thought of that.
1Or, maybe it's a tiny thermonuclear device cleverly disguised as a flash drive. Or, it might be a living, breathing creature that has evolved to mimic the look and feel of a flash drive but will detach itself from the computer and attack you at night while you're asleep.
If you're working with the Men In Black, you might have to consider these things. For the average person, it's almost certainly just a flash drive and you can take reasonable precautions and be more than reasonably safe.
-3
It doesn't have to be a drive though. A random USB stick could actually be a virtual keyboard in disguise, ready to execute a scripted payload by simply injecting all the keystrokes as if it's any other ordinary keyboard.
15Note to self: leave malware-infested flash drives lying around nursing homes
2
Take it to the library and plug it into one of their computers.
-22Please don't do this. People working at libraries aren't paid enough to deal with that bullshit.
37Am librarian. It’s ok. Nothing is going to sneak out into the wild from that USB. People plug USBs into our computers every day that are probably way worse than anything you pick up on the street.
1