At work we mostly use Windows 10, but some co-workers doing design work use Macs. Pen-drives lie around and the only way of knowing what's inside, is to stick it into a PC and read the content?
How high is the risk of getting viruses, backdoors, malware, etc into our computers?
What can be done to mitigate the risk, if high?
TLDR: The risk is very real. It's the equivalent of giving someone with malicious a keyboard, a network interface, storage, etc... but not showing them the screen.
I think @eckes' comment sums it up nicely. True, a USB-kill dongle is of course a real thing, but has indeed limited "damaging" aspects.
If properly setup, USB Dongles can mimic anything USB related (keyboards, NIC's, etc) or a combination thereof. Tools such as the Hak5 rubberducky or Samy Kamkar's PoisoinTap show the possibilities. It can siphon out information, implant malware, etc; which is a significant concern (data, operations-wise), wa more than physical damage.
As already mentioned by CinisSec, the USB drive might not contain a real drive but a USB Kill that can destroy your computer. There are ways to mitigate this but they are usually not worth the time and effort and don't always remove the whole risk.
There are of course – as mentioned by others too – also risks involving software-related harm. From DMA-attacks through Rubberducky to simple "autorun"-like exploits the host might get infected. While you might be able to isolate the drive in a VM, that might not mitigate the risk completely. Also booting from a live CD will not protect you from malware written to your standard drive (so this requires you to unplug those) and exploits that target your motherboard firmware. These days the UEFI is so advanced that it can be easily reprogrammed to download malware onto your hard-drive before booting the normal operating system. A BIOS password might help here, but this mechanism is not designed to be watertight.
In a day and age where exploits can be purchased from the dark web (or even downloaded for free as part of penetration-testing suites) and USB drives are practically free, a "bad guy" can buy a few hundred of these drives and spread them in public. Since most people don't consider the risk and rather trust their anti-virus software to keep them safe, the yield will probably be amazing and pay off the cost for the drives and exploit.
So, a better way to find out what is on the drive without risking ruining your computer or data, is to use a burner computer, that you don't mind if it did get fried. That might be an old computer or a Raspberry Pi, that can be bought for a few dollars. Use that disconnected from the internet with separate accessories to examine the drive. If you think it is safe, you can then proceed to transfer data etc. Since in most situations the burner computer won't be permanently damaged, it can be reused for every time you are unclear about a USB drive. If the drive does contain malware, you can just reflash the SD card of the Raspberry Pi and start over.
This will not prevent any hardware attacks, like a USB-killer, but this should stop (almost?) all software attacks, except for the very most advanced versions where a malicious program is somehow hidden somewhere in the motherboard or something similar.
You need:
What to do:
Follow these instructions to make a bootable Ubuntu (Linux) DVD:
https://tutorials.ubuntu.com/tutorial/tutorial-burn-a-dvd-on-windows#0
When you have a bootable DVD (& have tested that it works), also preferably make sure that the BIOS tries to boot from the DVD reader on the computer that you will disassemble.
then (unplug the power and) open the computer that you choose to disassemble & remove the hard-drive & any (wireless) network cards from the computer.
Now insert the bootable DVD into the disassembled computer & start it up.
Linux have an amazing OS that can run from the DVD, so now you should be able to insert the USB into a port on the disassembled computer.
Assuming that the USB is infected with all kinds of malicious software, now the malwares should not be able to store themselves anywhere, because the only places to potentially be stored at is:
the RAM memories (looses all data as soon as the power is turned off).
maybe some kind off boot-memory on the motherboard (requires a VERY advanced virus. probably specifically designed for EXACTLY that motherboard, since most motherboard types have slightly different programming).
some registers inside the CPU (can only hold a few bytes at a time, and probably(?) forgets everything when the power turns off).
BE CAREFUL with keyboards, mouses & screens that are connected to this computer because they might have some kind of memory inside them, so just assume that they are infected & don't use them anywhere else, I think it's a good idea to also use the oldest keyboard, mouse & screen you have, because I think it's less likely that they have a built in memory (unlike the latest Razor mouses & similar things).
When you are done, just unplug the computer & all memories should be cleared (the motherboard might have a "button cell battery" that keeps the clock ticking even when the computer is underpowered, this battery might also power some memories, so it could be a good idea to remove that battery too for a while (I don't know if this will clear any important "motherboard-booting-memories" or something, does anyone else know?))
Good luck!
Most people think they can only get their PC infected with something via auto-run or something similar but you can't forget USB Kill. Those pendrives charge on the USB port and then discharge everything back at once to fry your computer. Nothing you can do about it but cry if it happens.
You can always run a live USB (with physical write protection) on a computer disconnected from any network & HDD to avoid malware from spreading and then analyze it.
