4 ms·
There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.
by chiph 13y ago
There are sticks out there that have hardware write-enable switches (I keep my medical records on one), so that you can at least control when writes occur.
- podperson 13y agoIncluding all SD cards.
- FedRegister 13y agoMost SD card "write prevent" tabs are suggestions only. From Wikipedia: The presence of a notch, and the presence and position of a tab, have no effect on the SD card's operation. A host device that supports write protection should refuse to write to an SD card that is designated read-only in this way. Some host devices do not support write protection, which is an optional feature of the SD specification. Drivers and devices that do obey a read-only indication may give the user a way to override it. In most cases the switch is just software detectable. Some prosumer cameras use this switch to indicate there is a firmware update on the card and that the camera should try to apply it when it is powered up.
- emillon 13y agoInterestingly enough, the switches are not electric ones. It's just something that can be physically (maybe even optically) detected by the device.
- nimble 13y agoWhy do you write 'at least'? Isn't this strictly superior to Schneier's light idea?
- hyperpape 13y agoProbably better on balance, but not strictly better. On the one hand, it gives you greater security when used perfectly. On the other hand, it has a cognitive overhead, and a worse failure mode (you forget that you've left it writeable, and won't have the light to give you feedback). So even better would be a hardware lock for writes and a light indicating when writes happen.
- sneak 13y agoNothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. They aren't appliances.
- jessaustin 13y agoWhat you propose is probably possible for many USB sticks, but I don't think it's possible in general. Flashing a microcontroller often requires access to a serial interface like SPI, I2C, or JTAG. That's typically on different pins than USB (which pins can be buried in potting or otherwise inaccessible to compromised hosts). In addition some models can have particular pins connected to disable flashing.
- fest 13y agoSome microcontrollers I've been working with, that had USB capability also supported DFU- flashing new firmware via USB. I have also resurrected a write-broken flash drive, by re-flashing it's firmware (a tool for which was provided by microcontroller vendor, which I found out by looking at VID/PID values and googling them).
- jessaustin 13y agoOh definitely it's possible for many microcontrollers. DFU is very handy during development. I was just reacting to this statement: Nothing is stopping a compromised host system from flashing the microcontroller on the USB stick to make it lie to you. Nothing, that is, except possibly a complete absence of such a facility! It depends on the microcontroller and how it has been wired into the USB device.
- deleted 13y ago[deleted]