If I disabled any automounting in the OS, is it safe to plug in a possibly infected USB drive(whatever the worst case in terms of that) to wipe it?

If the (infected) drive is set to autorun malware after mounting, will erasing or overwriting the partition table prevent it from running?

  • Have you considered BadUSB - a USB stick that pretends to be a USB keyboard, to enter malicious commands? – S.L. Barth Aug 9 '18 at 14:47
  • If it is attached as a USB device, won't something like dd wipe the contents in the same way? – user942937 Aug 9 '18 at 14:50
  • 2
    Have you considered just not bothering? USB thumb drives are pretty cheap these days. Unless you have a particular reason to want to keep that particular drive (other than whatever might be on it), I'd suggest considering to toss it in the electronics recycling bin and just getting a new one to replace it. Now, there might be some reason why that's not desirable; but if so, it might help if you Edit your question to tell us why, so that answers may take it into account. – a CVn Aug 9 '18 at 14:53
  • 1
    I have some drives lying around which I haven't seen in a while. I'd prefer to simply wipe them instead of throwing them out and buying as many if I were reasonably safe enough in doing so . Occasionally, I have friends and relatives who ask me to wipe or reformat their drives for them which I'm sure might have some infection given the average user's penchant for downloading free stuff on the internet. Generally, I'm just curious and want to know how this stuff works. – user942937 Aug 9 '18 at 15:09
  • 1
    @user942937 Not all USB devices are storage devices. If a device tells your system that it's a keyboard, how do you expect your system to be able to "wipe" it? That said, BadUSB seems unlikely here, and wiping the partition table will probably be effective. – AndrolGenhald Aug 9 '18 at 15:19

If automount mount is disabled I don't see how they could infect you. You could even go a step further and boot a live image and run your DD from there.

  • I was going to recommend a live image too, better safe than sorry. – RandomUs1r Dec 7 '18 at 19:05
  • 1
    The drives Firmware can be changed which allows USB protocol violations which in turn could exploit kernel driver weakness. See BadUSB. Also malicious filesystem superblocks have been known tomoverflow kernel buffers in the past (should however bit fixed, but you never know..) – eckes Dec 7 '18 at 19:44
  • 1
    @eckes It was indeed fixed, but that doesn't mean that there aren't more vulnerabilities out there. The partition table scanning code is not the most clean. – forest Dec 8 '18 at 4:46

If this is some USB drive that belongs to you and you know it hasn't been tampered with, you can assume it will be safe after you rebuild the partition table and overwrite it with zeros.

If it doesn't belong to you or you suspect that it might have been tampered with, but you are still sure it is a legit USB device and won't just fry your motherboard with a capacitor discharge the moment you plug it, you should still consider the possibility that it might be not what it looks like. It is possible for an adversary to implant a USB hub, a storage drive and a malicious hardware in the same package (and it was done before), making it into a hardware trojan.

Imagine this: a user plugs in what he thinks is a USB drive, while on the background a malicious device that uses the same hub stealthily installs it's payload through a malicious driver or a keyboard emulator.

If it is some device that you found on the street: JUST DON'T. You can never be sure that it is not something like a USB killer that will fry your 100$ motherboard or 1000$ laptop: https://usbkill.com

  • Hi. Thanks for answering. I'd just like to clarify: you mentioned something about being "sure it is a legit USB device" but then go on to say that it might not be what it looks like. In the first case, if I were sure that it is definitely a USB device harware-wise, though probably tampered with, does clearing wiping the disk make it safe? Is it a safe enough operation to attempt? – user942937 Aug 24 '18 at 5:39
  • 1
    If you are in doubt, toss the drive away. – ThoriumBR Dec 7 '18 at 19:35

Your Answer

