3 ms·

The firmware on a USB stick should not be writeable. When will you ever update the firmware on your storage device. Never, USB sticks are cheap and disposable

The firmware on a USB stick should not be writeable. When will you ever update the firmware on your storage device. Never, USB sticks are cheap and disposable. Mass produced ones should have their firmware burned into ROM.

taeric 12y ago
This does nothing to protect you. Malicious users will just make their own usb stick. The parts aren't exactly expensive.
- MereInterest 12y ago
  Of course it does something to protect me. It means that I can plug my USB drive into a friend's computer, then plug it back into my own computer without worry.
  - taeric 12y ago
    Only if you fully trust the entire supply chain down to you. Do you have any way to verify that the mass storage device you bought was not a forgery?
    - MereInterest 12y ago
      I'm not aiming for perfection, just aiming to improve. It is easier for me to trust that the sealed USB drive I bought has not been tampered with than it is for me to trust that all of my friends are knowledgeable and avoid malware.
      - mikemoka 12y ago
        yes I agree that this looks like a good step, vendors should also probably release some tools to verify the integrity of their firmwares if possible.
InclinedPlane 12y ago
When? All the damned time. Maybe you have an external HD or SSD based on USB, updating the firmware is perfectly acceptable. Same thing for HIDs and NICs. High performance USB drives are basically little SSDs, and there's plenty of reasons for wanting to update the controller firmware on them to improve features or performance. It should not, however, be generally possible for arbitrary programs to update the firmware on a USB device without both the consent of the computer host's current user/administrator AND the device's manufacturer (subject to certain hedges and caviats of course). Right now many USB devices are just wide open, allowing this chaos of security vulnerabilities, that should not be.

taeric 12y ago

This does nothing to protect you. Malicious users will just make their own usb stick. The parts aren't exactly expensive.

MereInterest 12y ago
Of course it does something to protect me. It means that I can plug my USB drive into a friend's computer, then plug it back into my own computer without worry.
- taeric 12y ago
  Only if you fully trust the entire supply chain down to you. Do you have any way to verify that the mass storage device you bought was not a forgery?
  - MereInterest 12y ago
    I'm not aiming for perfection, just aiming to improve. It is easier for me to trust that the sealed USB drive I bought has not been tampered with than it is for me to trust that all of my friends are knowledgeable and avoid malware.
    - mikemoka 12y ago
      yes I agree that this looks like a good step, vendors should also probably release some tools to verify the integrity of their firmwares if possible.

InclinedPlane 12y ago

When? All the damned time. Maybe you have an external HD or SSD based on USB, updating the firmware is perfectly acceptable. Same thing for HIDs and NICs. High performance USB drives are basically little SSDs, and there's plenty of reasons for wanting to update the controller firmware on them to improve features or performance. It should not, however, be generally possible for arbitrary programs to update the firmware on a USB device without both the consent of the computer host's current user/administrator AND the device's manufacturer (subject to certain hedges and caviats of course). Right now many USB devices are just wide open, allowing this chaos of security vulnerabilities, that should not be.