Is there a way to check if a USB drive is safe?

Ask Fedora
, , ,
1

A few years ago I was gifted a USB flash drive with good capacity. I never used it: the gift seemed random, the person behind it was prone to stalking and I suspected they may have put some spyware to it. They have some subordinates in IT department of their office that I know may follow an illegal request, put advanced malware here and seal the box afterwards.

I heard many times that you should never insert suspicious USB drives into you computer, and that they can run arbitrary programs outside your view. Yet the drive is expensive and it’s a shame I can’t put it to good use.

Is there a way to sandbox a USB port and to make absolutely sure:

  1. No malware gets outside
  2. No malware remains hidden from the scans?
2

Not really. Even the act of plugging in a USB drive could end up frying your motherboard (USB killer - Wikipedia).

Plug it into a device you don’t care about would be a reasonable first move, but if you’re that suspicious, perhaps junking it is the safest option.

3

If you didn’t purchase it from a reputable vendor, it should be considered INFECTED. Physically damage it to prevent a future problem before discarding it. Same goes for USB C cables.

If you plug a hacker-modified USB C cable into your system, even without attaching the other end to anything, the hacker will be able to execute any command that you can from a distance using WiFi.

4

Hi Regan,

I see a few red-flags in your question:

  1. the gift seemed random
  2. the person behind it was prone to stalking
  3. I suspected they may have put some spyware to it
  4. They have some subordinates in IT department of their office that I know may follow an illegal request, put advanced malware here and seal the box afterwards.

So, here is my advice :slight_smile:
Go to the hardware store and buy the least expensive hammer and pretend that USB drive is a nail :slight_smile:

My basic rule-of-thumb, if I am at all suspect of the source of the device then I consider it to be nothing more than garbage-disposal food … no way am I going to plug it into anything that I can’t afford to send with the device to the same destination

5

So software like USBGuard that kernel-level blocks incoming USB traffic won’t do?

I’m not worried this person would put a motherboard fryer there (why would they need it?), I’m just a bit paranoid about the spyware.

It’s a 256 GiB drive so it’s kinda expensive, would be a waste to just kill it for my possibly just paranoia.

1 Like
6

It may do but if you don’t trust the USB disk why would you trust some software you didn’t write any more.

It’s a 256GB stick - they’re 11 GBP. I’d throw it in the bin and buy a new one if I had any doubts.

8

Are you talking about USBGuard? Because it doesn’t seem comparable in the slightest.

9

Regan mentioned USB Guard, not me — I’ve never heard of it, but then again I’m not interested enough in a 10 quid USB stick to do anything with it other than sling it straight in the bin, if I had any doubts about its provenance.

10

It was already written above, if you really really want to reuse the USB drive, find a computer you don’t care about, a computer that is not connected to anything in any way, erase the USB drive file system and create a new different filesystem, like fat32->ext4, format the drive. This would make it safe if the “IT Department” you worry about is not like the Mossad or the CIA. Otherwise who knows what the drive can actually do.
IMHO it is not worth it.

11

I’d plug it into a USB hub from any OS other than Windows, check it out, then wipe it and use it for whatever else later :stuck_out_tongue:

If it’s a USB killer, goodbye hub. If it’s malicious, it’ll likely target Windows via autorun, so mounting from a Linux LiveUSB would probably eliminate most risks from that. After a quick check of file contents, I’d unmount, wipefs it, and use it for whatever else.

That’s for general random USBs with average people involved; state actors or high-value individuals probably would be better off never entertaining the USB in any device let alone on their persons.