5 ms·

But is the switch just an input that is read by the software on the device, or does it actually interrupt e.g. a data line, making it impossible for even hacked

by Luc 3y ago

But is the switch just an input that is read by the software on the device, or does it actually interrupt e.g. a data line, making it impossible for even hacked software on the USB device to write to memory? I can't really find a conclusive answer.

1970-01-01 3y ago
It physically switches some circuit to disable the ability for data to be written onto the device. Why not contact them and get the details?
- Luc 3y ago
  I was just attempting to restate neilv's question in a different way. If you don't know that's fine.
  - neilv 3y ago
    Thanks, I should've been more clear. Maybe someone can put in an epic weekend, to determine technical and market and logistics feasibility for a trustworthy USB flash drive product, in time to apply for the YC W24 extended deadline. From there, maybe Kickstarter to enthusiasts to fund the Mk. I manufacturing run. With Mk. I for experience and credibility, do enterprise marketing&sales, and/or SBIR to develop solution for possible sale to Federal gov't and contractors. :)
    - 1970-01-01 3y ago
      Add AI and blockchain, so I know I can safely invest millions into it.
      - neilv 3y ago
        "It's Uber for bytes."
transpute 3y ago
> making it impossible for even hacked software on the USB device to write to memory? Signed firmware to prevent BadUSB-style attacks, price starts at $40 for 16GB, https://www.kanguru.com/products/kanguru-flashtrust-secure-firmware-usb-3-0-flash-drive https://www.kanguru.com/products/kanguru-flashtrust-secure-f... They have other models with signed firmware + FIPS 140 certified encryption + tamper resistance + physical write-protect switch. They also sell an SSD enclosure with write-protect switch.
- yencabulator 3y ago
  Signing firmware might help prevent replacing the firmware, but it doesn't do anything to protect against exploiting a security vulnerability in the current firmware. The marketing is a little too breathless to assure me that they did anything to actually make the firmware trustworthy: "Digitally Signed, Trusted Secure Firmware (RSA-2048 Bit)". Signing something doesn't make it secure against exploits.
  - transpute 3y ago
    Signing firmware is step 1 in raising the bar for attackers, since most flash drives have unsigned firmware which presents little barrier to attacks. If you could recommend other commercial flash drives with signed firmware, they could be compared for security vulnerabilities. Some models have FIPS-certified encryption, so they may have customers who are high-value targets, motivating attacks/testing for security vulnerabilities.
helsinkiandrew 3y ago
Most USB media control chips have hardware write protect pins that will physically prevent writing to memory, for example: https://eu.mouser.com/datasheet/2/268/MCHP_S_A0001038949_1-2520612.pdf https://eu.mouser.com/datasheet/2/268/MCHP_S_A0001038949_1-2... Obviously if someone has physical access they could take the unit apart and circumvent this (but then they could flip the switch too)
- yencabulator 3y ago
  Which, as far as I know, is only an input read by the firmware. If there's an exploitable bug in the firmware, that signal means nothing. Here's some exploits against flash controllers: https://www.bunniestudios.com/blog/?page_id=3592 https://www.bunniestudios.com/blog/?page_id=3592
light_cone 3y ago
I have some of these usb keys, and I remember having remounted the device rw on linux, and the device failed with an io error when I attempted to write. So if I'm correct, the driver was configured as if the key was rw, but it failed because the hardware switch was ro. So I believe that it is an actual hardware lock, in addition to the os having the ro/rw status info. If someone is interested, Kanguru have faster models than the one linked (which I have too), which is a little slow by today's standard.

by Luc 3y ago

1970-01-01 3y ago

It physically switches some circuit to disable the ability for data to be written onto the device. Why not contact them and get the details?

Luc 3y ago
I was just attempting to restate neilv's question in a different way. If you don't know that's fine.
- neilv 3y ago
  Thanks, I should've been more clear. Maybe someone can put in an epic weekend, to determine technical and market and logistics feasibility for a trustworthy USB flash drive product, in time to apply for the YC W24 extended deadline. From there, maybe Kickstarter to enthusiasts to fund the Mk. I manufacturing run. With Mk. I for experience and credibility, do enterprise marketing&sales, and/or SBIR to develop solution for possible sale to Federal gov't and contractors. :)
  - 1970-01-01 3y ago
    Add AI and blockchain, so I know I can safely invest millions into it.
    - neilv 3y ago
      "It's Uber for bytes."

transpute 3y ago

> making it impossible for even hacked software on the USB device to write to memory? Signed firmware to prevent BadUSB-style attacks, price starts at $40 for 16GB, https://www.kanguru.com/products/kanguru-flashtrust-secure-firmware-usb-3-0-flash-drive https://www.kanguru.com/products/kanguru-flashtrust-secure-f... They have other models with signed firmware + FIPS 140 certified encryption + tamper resistance + physical write-protect switch. They also sell an SSD enclosure with write-protect switch.

yencabulator 3y ago
Signing firmware might help prevent replacing the firmware, but it doesn't do anything to protect against exploiting a security vulnerability in the current firmware. The marketing is a little too breathless to assure me that they did anything to actually make the firmware trustworthy: "Digitally Signed, Trusted Secure Firmware (RSA-2048 Bit)". Signing something doesn't make it secure against exploits.
- transpute 3y ago
  Signing firmware is step 1 in raising the bar for attackers, since most flash drives have unsigned firmware which presents little barrier to attacks. If you could recommend other commercial flash drives with signed firmware, they could be compared for security vulnerabilities. Some models have FIPS-certified encryption, so they may have customers who are high-value targets, motivating attacks/testing for security vulnerabilities.

helsinkiandrew 3y ago

Most USB media control chips have hardware write protect pins that will physically prevent writing to memory, for example: https://eu.mouser.com/datasheet/2/268/MCHP_S_A0001038949_1-2520612.pdf https://eu.mouser.com/datasheet/2/268/MCHP_S_A0001038949_1-2... Obviously if someone has physical access they could take the unit apart and circumvent this (but then they could flip the switch too)

yencabulator 3y ago
Which, as far as I know, is only an input read by the firmware. If there's an exploitable bug in the firmware, that signal means nothing. Here's some exploits against flash controllers: https://www.bunniestudios.com/blog/?page_id=3592 https://www.bunniestudios.com/blog/?page_id=3592

light_cone 3y ago

I have some of these usb keys, and I remember having remounted the device rw on linux, and the device failed with an io error when I attempted to write. So if I'm correct, the driver was configured as if the key was rw, but it failed because the hardware switch was ro. So I believe that it is an actual hardware lock, in addition to the os having the ro/rw status info. If someone is interested, Kanguru have faster models than the one linked (which I have too), which is a little slow by today's standard.