Hacker News Reader

Comment by detaro | Hacker News Reader

most paranoid I can think of: Use an Atmel AVR (Harvard architecture means no code execution, and it doesn't have low-level firmware that could be vulnerable) to read the filesystem and sanitize data, then feed it over serial to a host machine to analyze?

If you trust your hardware and VM hypervisor to be secure, pass the USB controller to a VM?

View on HN

I'm wondering if even this route is no longer safe - stcredzero comment [1] points out things that could be added to completely circumvent even a system that is essentially "off-the-grid" or just uses the USB for power.

[1] https://news.ycombinator.com/item?id=12694843

Right, you can't tell if there is a hidden malicious component that hasn't been activated yet. You can extract assumed non-malicious data without giving a malicious component the ability to do anything, if it hasn't an build-in data exfiltration channel (microphone and wireless transmitter could spy on you without attacking your system)

I guess one could setup a jammer or some room that could completely cut off any signal possibility. However then they could put something even more malicious then just spying into the device. As much as a tin foil hat theory that is, maybe it's just best to not know what's on the drive cause it's more than likely not worth even the slightest bit of trouble. Sad the world has come to this

...or you could just plug it in a public PC (eg library ones) and that's it.

That's not a very responsible thing to do if you believe the drive could be malicious.

It's easy enough to get free or cheap computers off craigslist. Don't need a modern one to see whats on a thumb drive.

Reply on news.ycombinator.com