5 ms·

The problem of optical drives is the size limit and the time to make them. They can contain malicious code just as well as a thumbdrive. The concern with USB i

by 1996 8y ago

The problem of optical drives is the size limit and the time to make them. They can contain malicious code just as well as a thumbdrive. The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Purchasing many similar drives of a well known brand in a random supermarket is a reasonable alternative. Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid.

craftyguy 8y ago
> They can contain malicious code just as well as a thumbdrive Of course. > The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media. > Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid. This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.
- 1996 8y ago
  > This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong Security is in the spotlight, not in the shadows Prefer tools that everyone else uses, unless you have a very compelling reason not to (windows: too many 0 days, complexity, and surface of attack ; wifi: too easy to start a rogue network) Because when these popular tools get hacked, you will know it. I keep an eye on rogue firmware. I have not seen a real world threat yet, but I do expect spear fishing attacks for people involved in crypto (fortunately, not for us just writing software)

by 1996 8y ago

craftyguy 8y ago

> They can contain malicious code just as well as a thumbdrive Of course. > The concern with USB is the firmware, and the thumbdrive pretending to be a HID device or having an extra partition with malicious code. Right, that's the concern I was alluding to above. You'd still be better off burning optical media (and disabling any autoplay crap on the target system). You can still store severl GB of data on optical media. > Just keep them for 1 year before using them, in case an exploit becomes popular - but this is extremely paranoid. This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong.

1996 8y ago
> This may work if you only stick with very popular makes/models, since they would have a higher chance of being 'noticed' for doing something wrong Security is in the spotlight, not in the shadows Prefer tools that everyone else uses, unless you have a very compelling reason not to (windows: too many 0 days, complexity, and surface of attack ; wifi: too easy to start a rogue network) Because when these popular tools get hacked, you will know it. I keep an eye on rogue firmware. I have not seen a real world threat yet, but I do expect spear fishing attacks for people involved in crypto (fortunately, not for us just writing software)