What is the danger of inserting and browsing an untrusted USB drive?

132

Suppose someone wants me to copy some files to their USB stick. I'm running fully-patched Windows 7 x64 with AutoRun disabled (via Group Policy). I insert the USB drive, open it in Windows Explorer and copy some files to it. I do not run or view any of the existing files. What bad things could happen if I do this?

What about if I do this in Linux (say, Ubuntu)?

Please note that I'm looking for details of specific risks (if any), not "it would be safer if you don't do this".

EM0

Posted 2014-01-30T18:44:56.050

Reputation: 1 703

– Scott – 2017-05-06T22:04:24.840

6Looking at a directory listing is unlikely to be a risk. Opening a malicious PDF in an old unpatched version of Adobe reader could be a big risk. In some cases even an image preview or a file icon could contain an exploit. – david25272 – 2014-01-31T03:58:03.093

@david25272, even looking at a directory listing could be a risk.

– tangrs – 2014-01-31T05:28:01.160

5It's a little bit like getting into an elevator with a stranger, most of the time you're fine, but if the stranger is aka Hannibal Lecter... – PatrickT – 2014-01-31T06:35:02.517

You could break your uranium centrifuge http://en.wikipedia.org/wiki/Stuxnet

– RyanS – 2014-01-31T16:16:35.260

1@tangrs, that's a great example of the sort of thing I was looking for. Why not post it as an answer? – EM0 – 2014-02-01T14:33:26.097

@EM You should probably reevaluate your accepted answer – CodyBugstein – 2014-02-03T15:49:52.060

1@Imray I will if you tell me a reason to. – EM0 – 2014-02-03T17:30:02.813

If I only use USB to push content off my PC, is it safe to quick format the USB before each use ? I use live ubuntu CD to boot up & format the USB. – user – 2014-03-01T05:54:13.077

Answers

Less impressively, your GUI file browser will typically explore files to create thumbnails. Any pdf-based, ttf-based, (insert turing-capable file type here)-based exploit that works on your system could potentially be launched passively by dropping the file and waiting for it to be scanned by the thumbnail renderer. Most the exploits I know about that are for Windows, though, but do not underestimate the updates for libjpeg.

sylvainulg

Posted 2014-01-30T18:44:56.050

Reputation: 573

1That is a possibility, so +1. Does Windows Explorer (or Nautilus) do this even if you never view thumbnails? – EM0 – 2014-01-31T21:53:04.837

1@EM Could happen - recent versions of explorer might, for example, construct thumbnails in sub-folders for pretty folder icons at the root, even if those subfolders are set never to show thumbnails. – Tynam – 2014-02-01T00:03:14.243

Or maybe not try to display thumbnails, but rather some sort of metadata – That Brazilian Guy – 2014-02-03T20:08:36.943

1This is not specific to a USB mounted filesystem. If a file browser has a vulnerability it could be triggered by files downloaded to your computer through other means too, such as email attachments or downloads through browser. – HRJ – 2014-03-02T14:28:19.417

187

The worst that can happen is limited only by your attacker's imagination. If you're going to be paranoid, physically connecting pretty much any device to your system means it can be compromised. Doubly so if that device looks like a simple USB stick.

What if it's this? enter image description here

Pictured above is the infamous USB rubber ducky, a little device that looks like a normal pen drive but can deliver arbitrary keystrokes to your computer. Basically, it can do as it pleases because it registers itself as a keyboard and then enters whatever sequence of keys it wants. With that kind of access, it can do all sorts of nasty things (and that's just the first hit I found on Google). The thing is scriptable so the sky's the limit.

terdon

Posted 2014-01-30T18:44:56.050

Reputation: 45 216

11Nice one, +1! In the scenario I had in mind the USB stick is known to be an actual storage device and I trust the person who gives it to me to not maliciously infect my computer. (I'm mostly concerned they may be the victim of a virus themselves.) But this is an interesting attack I hadn't considered. I suppose with a keyboard emulator like this I'd probably notice something weird going on, but there might be stealthier ways... – EM0 – 2014-01-30T20:42:59.850

3I approve of this answer. Makes the OP think :) – steve – 2014-01-30T20:49:09.480

fyi: https://www.youtube.com/watch?v=D8Im0_KUEf8 https://www.youtube.com/watch?v=CPEzLNh5YIo and other related talks. it might look like a simple usb-stick, but these suckers have their own cpu and their own firmware on board.

– akira – 2014-01-30T21:29:17.373

31+1 "The worst that can happen is limited only by your attacker's imagination." – Newb – 2014-01-31T00:39:46.387

Haha, I saw one of these at school once. Some dude would plug it into computers while we were using them and the mouse would start doing things of its own accord (someone was remote-controlling the device from across the room). – Thomas – 2014-01-31T02:36:36.130

9Hak5 - looks legit! – david25272 – 2014-01-31T04:00:40.700

looks like "BS-USB" from Cloudy with a Chance of Meatballs 2 made by villain inovator Chester_V – kmonsoor – 2014-01-31T11:08:04.957

5Apparently the USB connection protocol is quite similar to the older PS/2 port protocol, which is why USB is commonly used for Mice and Keyboards. (I could be wrong of course - I'm digging this up from my own memory, which features mostly lossy compression) – Pharap – 2014-02-01T13:14:23.743

1This kind of attack is probably a good reason to not give administrator privileges to your usual account, even with UAC set to maximum. Since it emulates a keyboard I presume it could easily say "yes" to any UAC prompt. – EM0 – 2014-02-01T15:01:27.793

Another danger is that Linux will try to mount anything (joke suppressed here).

Some of the file system drivers are not bug free. Which means that a hacker could potentially find a bug in, say, squashfs, minix, befs, cramfs or udf. Then that hacker could create a file system that exploits that bug to take over a Linux kernel and put that on a USB drive.

This could theoretically happen to Windows as well. A bug in the FAT or NTFS or CDFS or UDF driver could open up Windows to a takeover.

Zan Lynx

Posted 2014-01-30T18:44:56.050

Reputation: 1 518

1Windows actually can be crashed just by inserting a badly formatted drive. I did it a couple of times (and that made me really angry) – Display Name – 2015-10-18T12:32:52.257

+1 That would be a neat and entirely possible exploit – steve – 2014-01-31T01:52:57.427

18There is a whole level further down. Not only do file-systems have bugs, but the whole USB stack has bugs, and lots of that runs in the kernel. – Fake Name – 2014-01-31T06:09:09.720

4And even your USB controller's firmware may have weaknesses that may be exploited. There's been an exploit of crashing into Windows with a USB stick merely at device enumeration level. – sylvainulg – 2014-01-31T15:57:34.303

8As for "linux trying to mount anything", this is not the system's default behaviour, but is linked to your file explorer proactively trying to mount. I'm sure spelunking manpages could unveil how to de-activate this and return to "mount only on demand". – sylvainulg – 2014-01-31T15:59:00.997

@sylvainulg: I meant about the filesystem types. While Windows only mounts three or four FS types, Linux will try whatever it has available, which can be a lot of filesystems. – Zan Lynx – 2014-01-31T17:11:33.760

For a moment I thought you were saying that a hacker could write a program that would move your Linux kernel to the USB drive, which would be and awesome (and horrific) way for the malware to defend itself. – Brian – 2014-01-31T18:54:05.240

6Both Linux and Windows try to mount everything. The only difference is that Linux might actually succeed. This is not a weakness of the system but a strength. – terdon – 2014-02-02T15:25:49.500

There are several security packages that allow me to set up an autorun script for either Linux OR Windows, automatically executing my malware as soon as you plug it in. It is best not to plug in devices that you do not trust!

Bear in mind, I can attach malicious software to pretty much any sort of executable that I want, and for pretty much any OS. With autorun disabled you SHOULD be safe, but AGAIN, I don't trust devices that I am even the slightest bit skeptical about.

For an example of what can do this, check out The Social-Engineer Toolkit (SET).

The ONLY way to truly be safe is to boot up a live Linux distribution, with your hard drive unplugged.. And mount the USB drive and take a look. Other than that, you're rolling the dice.

As suggested below, it is a must that you disable networking. It doesn't help if your hard drive is safe and your whole network gets compromised. :)

steve

Posted 2014-01-30T18:44:56.050

Reputation: 612

4ockquote>

The ONLY way to truly be safe is to boot up a live Linux distribution, with your hard drive unplugged… — nope, a rogue software can also infect firmware. They are very poorly protected nowadays.

– Display Name – 2015-10-18T12:34:43.557

3Even if AutoRun is disable there are still exploits that exist that take advantage of certain truths. Of course there are better ways to infect a Windows machine. Its best to scan unknown flash drives on hardware dedecated to that task, which is wiped daily, and restored to a known configuration if rebooted. – Ramhound – 2014-01-30T18:59:28.147

1This is true. Hackers can be great at what they do. It leads back to my previous suggestion that the OP doesn't want to hear... Its safer if you don't trust what is not to be trusted. – steve – 2014-01-30T19:01:25.693

1@Steve- Even the Linux solution has flaws. You won't catch every known malicious file, I would even say, a significant amount will not be caught. The drive should be scanned by several programs. A solution like Hiren BootCD is a start since it gives you access to multiple tools, would not be persistant, and could not infected other systems ( a Linux host can infect a Windows machine ). – Ramhound – 2014-01-30T19:11:55.410

That is also indeed true. I do not claim to be a securty expert as the people that I see at defcon every year manage to drop my jaws every time. That being said your answer is much more complete and should be the accepted answer if you write one. My thought is, if I have to go through such steps just to check it, the answer of if it should be trusted is obvious :) – steve – 2014-01-30T19:14:12.890

2For your final suggestion, you may want to include disconnecting the network too, if the Live CD instance does get infected it could go infect other machines on the network for a more persistent foothold. – Scott Chamberlain – 2014-01-30T19:15:57.167

sorry, as I assumed that would be implied. How ever seeing as though the question is being asked, I guess it would not be. :) – steve – 2014-01-30T19:19:07.363

@steve - You answer is fine. I am not going to post an answer because you already say everything I would have said. There are a few technical points missing but its good enough for this question. – Ramhound – 2014-01-30T19:36:53.973

6Ramhound, I'd like to see examples of the exploits you mentioned (presumably patched by now!) Could you post some as an answer? – EM0 – 2014-01-30T20:46:55.357

1@steve - is it possible for a bad agent to screw up your firmware even when using your 'truly safe' method? (albeit a harder thing to do) – Merk – 2014-01-30T23:47:48.900

@Merk that IS a possibility... if I were an epic hacker... I would target firmware (such as your sound card) that would still be accessible no matter what. I have read only a little about the research into this possibility... best to assume if you can imagine it, smarter people have tried. :) – steve – 2014-01-30T23:54:28.243

1I am not going to talk about patched nor unpatched exploits. They exist and involve tricking Windows into doing things using it shouldn't. Some have been patched others have not been. U3 which has been retired was a horrible idea. Windows treats optical disk differently from removable disks. I will end with that note. – Ramhound – 2014-01-31T04:01:06.483

@EM, there was a zero-day exploit a while ago that took advantage of a vulnerability in how the icon was displayed in a shortcut file (.lnk file). Just opening the folder containing the shortcut file is enough to trigger the exploit code. A hacker could have easily put such a file on the root of the USB drive so when you open it, the exploit code would run.

– tangrs – 2014-01-31T05:25:06.040

The USB stick may actually be a highly charged capacitor... I am not sure if modern motherboards have any protection from such surprises, but I wouldn't check it on my laptop. (it could burn all devices, theoretically)

Update:

see this answer: https://security.stackexchange.com/a/102915/28765

and video from it:

Display Name

Posted 2014-01-30T18:44:56.050

Reputation: 933

This video hurts my soul. – k.stm – 2017-04-14T00:45:10.887

Yes they do. Almost all of them have small resettable fuses. I found this http://electronics.stackexchange.com/questions/66507/usb-fuse-to-protect-usb-ports to be kind of interesting.

– Zan Lynx – 2014-01-31T23:21:31.970

Some malware/virus get activated when we open a folder. The hacker may use the feature of Windows (or Linux with Wine) which start to make an icon/thumbnail of some files (for example .exe, .msi, or .pif files, or even folders with a malware icon) on opening a folder. The hacker finds a bug in programs (like the program that create a thumbnail) to make it possible for the malware to get in action.

Some faulty devices may kill your hardware, especially the motherboard, and most times silently, so you may not aware of it.

totti

Posted 2014-01-30T18:44:56.050

Reputation: 832

Apparently a simple USB device can even fry the entire motherboard:

A Russian security researcher known as "Dark Purple" has created a USB stick that contains an unusual payload.

It doesn't install malware or exploit a zero-day vulnerability. Instead, the customised USB stick sends 220 Volts (technically minus 220 Volts) through the signal lines of the USB interface, frying the hardware.

https://grahamcluley.com/2015/10/usb-killer/

EM0

Posted 2014-01-30T18:44:56.050

Reputation: 1 703

The worst thing which could happen is the infamous BadBios infection. This supposedly infects your USB Host controller by pluging it into your computer regardless of your OS. There are a limited range of manufacturers of USB chips, and so exploiting all of them isn't too far fetched.

Of course not everyone believes BadBios is real, but it is the worst thing which could happen to your computer by plugging in a USB drive.

Nick

Posted 2014-01-30T18:44:56.050

Reputation: 141

This is pretty much how the entire US Department of Defense's classified network was compromised. A USB stick was left on the ground in a car park outside a DOD site. Some genius picked it up took it inside and plugged it in, modern day espionage is so boring. I mean a USB stick in a carpark, bring back 007!

http://www.foreignaffairs.com/articles/66552/william-j-lynn-iii/defending-a-new-domain

screig

Posted 2014-01-30T18:44:56.050

Reputation: 129