Hacker News Reader

Comment by jonlucc | Hacker News Reader

In a post-Stuxnet world, can we trust flash drives? If I remember correctly, that virus would jump onto flash drives to spread to the next few computers it touched. I think I might prefer an ethernet wire connection without the outgoing wires.

View on HN

Not at all. The microcontrollers on flash drives can be reflashed to do all manner of mean stuff to any host it's plugged in to.

As long as you wipe and format the flash drive from the secure computer every time you use it, there shouldn't be any risk. I don't think even Stuxnet could have infected a linux machine that didn't mount or autorun the partition.

Flash drives are not dumb. I know that Travis Goodspeed has had some success in reflashing their microcontrollers to speak corrupt USB to attack USB stacks of host machines (which of course run in kernel mode).

I guess the only safe options are CDRs and one-way ethernet connections.

A fascinating talk by Travis Goodspeed on the mayhem possible by reprogramming the USB controller in a disk:

http://www.youtube.com/watch?v=D8Im0_KUEf8

Writing a Thumbdrive from Scratch: Prototyping Active Disk Anti-Forensics

Stuxnet was bespoke malware with multiple 0days--the reason it worked like it did was because of how the target's computers were set up. If Iran had used Linux they would have likely used different vulnerabilities to [try and] accomplish the same goal.

Modern ethernet ports will not link over one pair. It breaks autonegotiation.

I'd sooner use a wifi card in monitor-only mode, patching the driver to disable all transmit ability.

You can't do it with Ethernet over copper but you can with fiber.

Reply on news.ycombinator.com