6 ms·

"the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize". Get to wor

by gluejar 13y ago

"the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize". Get to work, people!

chiph 13y ago
There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.
- podperson 13y ago
  Including all SD cards.
  - FedRegister 13y ago
    Most SD card "write prevent" tabs are suggestions only. From Wikipedia: The presence of a notch, and the presence and position of a tab, have no effect on the SD card's operation. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it. In most cases the switch is just software detectable. Some prosumer cameras use this switch to indicate there is a firmware update on the card and that the camera should try to apply it when it is powered up.
    - emillon 13y ago
      Interestingly enough, the switches are not electric ones. It's just something that can be physically (maybe even optically) detected by the device.
- nimble 13y ago
  Why do you write 'at least'? Isn't this strictly superior to Schneier's light idea?
  - hyperpape 13y ago
    Probably better on balance, but not strictly better. On the one hand, it gives you greater security when used perfectly. On the other hand, it has a cognitive overhead, and a worse failure mode (you forget that you've left it writeable, and won't have the light to give you feedback). So even better would be a hardware lock for writes and a light indicating when writes happen.
- sneak 13y ago
  Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.
  - jessaustin 13y ago
    What you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.
    - fest 13y ago
      Some microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB. I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).
      - jessaustin 13y ago
        Oh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement: Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.
      - deleted 13y ago
        [deleted]
unwind 13y ago
How about an inline protocol analyzer that knows the USB mass storage device class protocol, and can detect when a write request is being sent? That would perhaps also make it possible to optionally prevent such requests from ever reaching the USB stick, thus adding write-protection to legacy sticks. Probably not 100% trivial given the signalling speed and general complexity of USB, but perhaps solvable using an FPGA? There is a software-only USB stack for 8-bit AVR:s, so it doesn't seem totally impossible, either. No, I don't have a startup manufacturing such a device. :) UPDATE: Ah, I just reinvented the WriteBlocker: http://www.wiebetech.com/products/USB-WriteBlocker.php http://www.wiebetech.com/products/USB-WriteBlocker.php. Sigh.
- deleted 13y ago
  [deleted]
- zokier 13y ago
  No reason to involve FPGAs (beyond performance concerns). Eg FTDI makes Arduino-like boards with host+device USB connections, seem to cost $35 at their store. With this specific device you are limited to full-speed USB which is slight inconvenience for storage use. But it's also the first product I happened to stumble upon, there probably are better alternatives out there. http://www.ftdichip.com/Products/Modules/DevelopmentModules.htm#Vinco http://www.ftdichip.com/Products/Modules/DevelopmentModules....
jonnycowboy 13y ago
www.youtube.com/watch?v=LZXaYLVFdcQ‎

by gluejar 13y ago

"the first company to market a USB stick with a light that indicates a write operation -- not read or write; I've got one of those -- wins a prize". Get to work, people!

chiph 13y ago

There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.

podperson 13y ago
Including all SD cards.
- FedRegister 13y ago
  Most SD card "write prevent" tabs are suggestions only. From Wikipedia: The presence of a notch, and the presence and position of a tab, have no effect on the SD card's operation. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it. In most cases the switch is just software detectable. Some prosumer cameras use this switch to indicate there is a firmware update on the card and that the camera should try to apply it when it is powered up.
  - emillon 13y ago
    Interestingly enough, the switches are not electric ones. It's just something that can be physically (maybe even optically) detected by the device.
nimble 13y ago
Why do you write 'at least'? Isn't this strictly superior to Schneier's light idea?
- hyperpape 13y ago
  Probably better on balance, but not strictly better. On the one hand, it gives you greater security when used perfectly. On the other hand, it has a cognitive overhead, and a worse failure mode (you forget that you've left it writeable, and won't have the light to give you feedback). So even better would be a hardware lock for writes and a light indicating when writes happen.
sneak 13y ago
Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.
- jessaustin 13y ago
  What you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.
  - fest 13y ago
    Some microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB. I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).
    - jessaustin 13y ago
      Oh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement: Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.
    - deleted 13y ago
      [deleted]

unwind 13y ago

How about an inline protocol analyzer that knows the USB mass storage device class protocol, and can detect when a write request is being sent? That would perhaps also make it possible to optionally prevent such requests from ever reaching the USB stick, thus adding write-protection to legacy sticks. Probably not 100% trivial given the signalling speed and general complexity of USB, but perhaps solvable using an FPGA? There is a software-only USB stack for 8-bit AVR:s, so it doesn't seem totally impossible, either. No, I don't have a startup manufacturing such a device. :) UPDATE: Ah, I just reinvented the WriteBlocker: http://www.wiebetech.com/products/USB-WriteBlocker.php http://www.wiebetech.com/products/USB-WriteBlocker.php. Sigh.

deleted 13y ago
[deleted]
zokier 13y ago
No reason to involve FPGAs (beyond performance concerns). Eg FTDI makes Arduino-like boards with host+device USB connections, seem to cost $35 at their store. With this specific device you are limited to full-speed USB which is slight inconvenience for storage use. But it's also the first product I happened to stumble upon, there probably are better alternatives out there. http://www.ftdichip.com/Products/Modules/DevelopmentModules.htm#Vinco http://www.ftdichip.com/Products/Modules/DevelopmentModules....

jonnycowboy 13y ago