PDA

View Full Version : Protecting a USB Key from Viruses, Etc


allanc
06-01-2009, 04:07 PM
What is the best way to protect my USB key from being infected by viruses on client's PCs?
Model number of USB keys available in Canada that offer that capability are appreciated.
Thank you in advance.

NYJimbo
06-01-2009, 04:14 PM
Any USB drive with a actual write protect switch is your best bet. I love the kangaru's:

http://www.kanguru.com/flashblu2.html

allanc
06-01-2009, 04:19 PM
Any USB drive with a actual write protect switch is your best bet. I love the kangaru's:

http://www.kanguru.com/flashblu2.html
I cannot seem to locate that one at my suppliers' WEB site.
What I have found are 'hardware encrption' and 'password protection'.

angry_geek
06-01-2009, 04:28 PM
http://www.newegg.ca/Product/Product.aspx?Item=N82E16820208362

It's purple, but it has write protection and is on the ca site.

TimeCode
06-01-2009, 04:36 PM
I cannot seem to locate that one at my suppliers' WEB site.
What I have found are 'hardware encrption' and 'password protection'.

You can't buy it from the manufacturer's site?

purple_minion
06-01-2009, 04:43 PM
I just bought a usb/sdhc adapter and a 32gb sd card. The adapter I got off amazon, and read through a lot of reviews to hopefully find a good one. I believe it was a sandisk model, and it looked pretty close to a thumb drive form, all white too. It also said it supported 32GB cards, so I should be good on that front. Hopefully the usb adapter will listen to the lock switch, as some of them ignore it. If not, well it'll make sweet extra space for my eeepc... or a ****-ton of photos for my 6MP camera. I will also be able to pop any card into the adapter, to perhaps store updates, or usb boot options like a linux distro.

purple_minion
06-01-2009, 04:45 PM
http://www.newegg.ca/Product/Product.aspx?Item=N82E16820208362

It's purple, but it has write protection and is on the ca site.

The ones I found on newegg were only one model, icruzer or something, and the reviews said it had HORRIBLE speeds. I simply went with an adapter and SD card.

allanc
06-01-2009, 04:51 PM
The ones I found on newegg were only one model, icruzer or something, and the reviews said it had HORRIBLE speeds. I simply went with an adapter and SD card.
I have never had any issues with Kingston products (USB, RAM, etc).
I *do* have a Kingston 19-in-1 reader but I do not think that it offers write protection.
Also, I would rather carry one USB key than a reader, usb cable, sd card, etc.

allanc
06-01-2009, 04:52 PM
You can't buy it from the manufacturer's site?
I just found out that they are available from D&H.
I completed their new customer app. last week and am waiting to hear back from them.

Keegan
06-01-2009, 06:25 PM
here is a great tool for protecting usb sticks from virus:

http://research.pandasecurity.com/archive/Panda-USB-and-AutoRun-Vaccine.aspx

purple_minion
06-01-2009, 06:36 PM
I have never had any issues with Kingston products (USB, RAM, etc).
I *do* have a Kingston 19-in-1 reader but I do not think that it offers write protection.
Also, I would rather carry one USB key than a reader, usb cable, sd card, etc.

This was no cable needed, and the card stays in the usb drive, just like a thumb drive.

purple_minion
06-01-2009, 06:37 PM
here is a great tool for protecting usb sticks from virus:

http://research.pandasecurity.com/archive/Panda-USB-and-AutoRun-Vaccine.aspx

This will not protect your files on the drive from becoming infected.

PatrickB
06-01-2009, 08:59 PM
here is a great tool for protecting usb sticks from virus:

It is the other way around. Since this Panda software neuters autoplay on Windows, that means that a virus on the thumb drive could not autoplay and infect the machine it is plugged into.

On the other hand, an infected computer could infect the USB thumb drive whether autoplay is enabled or not.

-- Patrick B.

purple_minion
06-01-2009, 09:12 PM
My SanDisk Micromate arrived today, and it doesn't write to the SD card when it is locked. It's not ideal, it's wider then a thumbdrive, the lanyard is on the cap, which could get lost, and the sd card isn't protected when the cap isn't on the back. I suppose time will tell if I can forgive these short comings. In my mind there really isn't much in the way of options of write protected flash, at least on the limited set I ever found.

Keegan
06-02-2009, 06:46 PM
It is the other way around. Since this Panda software neuters autoplay on Windows, that means that a virus on the thumb drive could not autoplay and infect the machine it is plugged into.

On the other hand, an infected computer could infect the USB thumb drive whether autoplay is enabled or not.

-- Patrick B.

i don't know which viruses you normally get on a usb stick, the only ones i have ever got is the one who makes a autorun.inf whith a link to the virus.
After i used this no more viruses on my usb pen
so yes this works

allanc
06-02-2009, 06:59 PM
i don't know which viruses you normally get on a usb stick, the only ones i have ever got is the one who makes a autorun.inf whith a link to the virus.
After i used this no more viruses on my usb pen
so yes this works
I am concerned that a virus could infect an .exe on the USB stick.

PatrickB
06-02-2009, 10:30 PM
Thank you Keegan for making me take a closer look at the Panda USB and Autorun Vaccine. It actually does turn off autorun on the computer and will also lock the Autorun.inf on a USB stick to prevent it from being redirected to autostart a new EXE on the stick. However, it still will not prevent the USB stick from being infected.

A virus, like Conficker on a computer, will infect a USB stick by creating/altering the Autorun.inf to start up the virus from the USB stick. Then, if the infection goes unnoticed, when that USB stick is plugged into another computer that allows Autorun to work, then that computer becomes infected.

So, Panda keeps Windows from Autoplaying USB sticks. That means that the infection on the USB stick will not start and infect the computer. That Panda utility appears to do nothing from keeping a virus already on the computer from infecting the USB stick. What Panda does claim is that their software will lock the existing Autorun.inf on the USB stick so that it cannot be modified to run a virus on the stick. That is good that the virus will not autostart. However, if any program on the USB stick has been infected and is then run, then the virus will still do its nasty work.

What exactly does Panda do to lock the autorun.inf file on the USB stick under Fat or Fat32?



On a related subject, I understand that, by default, Windows 7 disables Autorunning from a thumbdrive. (Security Now http://www.grc.com/sn/sn-197.htm)

Microsoft actually did a study which showed, I think it was 17 percent of viruses, yes, 17.7 percent of malware was propagating through autorun. And so they said, okay, this is wrong, let's turn that off. So that's another improvement. So CDs and DVDs by default will still launch when you install them. But no other removable drives will. You don't even get the pop-up that prompts you for what action to take because users tend to take the wrong action. It's just silent. It's like, nope, we're not going to have that. That does mean, though, that simulators of CDs and DVDs, like U3, they do still work. They look like a CD, like a removable optical drive, specifically in order to get that autoplay functionality. And so those will still work.


For Windows XP and Windows Vista, you can disable them using information from Microsoft:
http://support.microsoft.com/kb/967715

... and from Security Now:
http://www.grc.com/sn/sn-187.htm



-- Patrick B.

Bobbing
06-06-2009, 06:46 PM
Imation makes USB drives that have a write protect switch.
You can find those at Grand & Toy, and Corporate Express (Staples).

http://www.imation.ca/en_CA/products/flash/swivel/flashdrives.htm

stevenamills
06-06-2009, 07:21 PM
Imation makes USB drives that have a write protect switch.
You can find those at Grand & Toy, and Corporate Express (Staples).

http://www.imation.ca/en_CA/products/flash/swivel/flashdrives.htm

Thanks for pointing that out. It seems makers that have the switch don't say much about it.

From the prices I'm seeing the Imation is competitive through 8GB, but gets stupid at 16gb.

The Kanguru is under $50 (US) for their 16GB Blu II. Has anyone tried it?

Vicenarian
04-28-2010, 09:17 PM
I own a Kanguru Flashblu II 4 GB, and it's fantastic. Seems very sturdy. Very good read/write speeds too. Bought it for like $40.00 off onhop.ca or something. Ncix has it too, but was backordered when I checked.

tf76
05-02-2010, 12:53 PM
I read on a site sometime ago that all you have to do is create a folder called autorun.inf and create a text file in the folder named something.txt and then just right click both folder and text file and give them read only attributes.

Nakin
05-26-2010, 03:22 PM
I've tried something on an usb key without a protection switch:
Format your key in NTFS mode, once it's done, right click on it, select properties, then go in the security tab. Now, just choose the rights given (like unchecking the "write"' box). Your key is write protected: ;)
You can test on another computer, and another OS, the rights will remain the same.

Puff
05-26-2010, 03:31 PM
I use a USB write blocker. Works great with hard drives/flash drives.

http://www.wiebetech.com/products/USB-WriteBlocker.php

jmanibusan
06-05-2010, 02:23 AM
do you have a spare SD card with a USB thumb drive reader? take a look on the side of your SD card it might have a little switch to move it write protect.

Peaceful
06-05-2010, 03:18 PM
I use a USB write blocker. Works great with hard drives/flash drives.

http://www.wiebetech.com/products/USB-WriteBlocker.php

199 smackaroons!!! :eek:

Bobbing
06-05-2010, 04:47 PM
The one hassle I have found is that with the USB drive write protected, programs will throw errors. I have to copy the program to the infected computer and run it from there. I find it much easier to run it from CD/DVD-RW media.

Cambridge PC Support
06-05-2010, 06:45 PM
I have about 7 or 8 USB flash drives and once one has been in a machine, then it gets formatted and my toolkit copied across to it - one box of clean flash drives and one box of potentially dirty ones plus a couple of clean ones always in my pocket ready for action :)

PcTek9
06-05-2010, 06:48 PM
Puff, you should post that device for bryce to use in tools of the week. B/c so many people ask about that device. This is the first time I have ever seen or heard of this device.

I like it a lot. I clicked the little scale on the upper right of your post and gave you credits for that post, b/c i like it that much. :)

HubCityPC
06-05-2010, 11:33 PM
I use a USB write blocker. Works great with hard drives/flash drives.

http://www.wiebetech.com/products/USB-WriteBlocker.php

I like this device but :eek:, at $199 it's a little pricey!

Kevin

Corbin
06-06-2010, 03:59 AM
I use a USB write blocker. Works great with hard drives/flash drives.

http://www.wiebetech.com/products/USB-WriteBlocker.php
Awesome, a bit pricey, I'm sure I can take my piggy bank in and get one of these.

Skyhooker
06-06-2010, 04:42 AM
I have about 7 or 8 USB flash drives and once one has been in a machine, then it gets formatted and my toolkit copied across to it - one box of clean flash drives and one box of potentially dirty ones plus a couple of clean ones always in my pocket ready for action :)

Not a bad idea at all. Do you format them on a Windows machine with USB autorun disabled, or on a non-Windows machine?

Puff
06-07-2010, 12:56 PM
do you have a spare SD card with a USB thumb drive reader? take a look on the side of your SD card it might have a little switch to move it write protect.

That's what I use to do until one day I noticed by accident (forgot to unlock the card when adding software) that even though the Transcend SDHC card I was using was locked, I could still write to it.

For that reason, I personally will not trust the write protection on SD cards.

Cambridge PC Support
06-07-2010, 01:10 PM
Not a bad idea at all. Do you format them on a Windows machine with USB autorun disabled, or on a non-Windows machine?

yup on XP with AutoRun disabled and now my new Win7 machine

mind you my toolkit directory has an empty autorun.inf folder on it - fooled me the first few times that I thought it was infected!

Skyhooker
06-07-2010, 05:20 PM
That's what I use to do until one day I noticed by accident (forgot to unlock the card when adding software) that even though the Transcend SDHC card I was using was locked, I could still write to it.

For that reason, I personally will not trust the write protection on SD cards.

From what I've gathered, it's not the card itself but the card reader that bypasses or doesn't respect the write protect switch on the card. Apparently, most do not. Someone else here mentioned this pocket card reader:

Kingston FCR-MLG2 MobileLite G2 USB 2.0 Multi-card Reader
(http://www.tigerdirect.com/applications/SearchTools/item-details.asp?EdpNo=5286071&CatId=381)

as a good one that does not bypass write-protect, but I haven't been near the TD warehouse lately to pick one up.

Vicenarian
06-07-2010, 06:18 PM
I own a Kanguru Flashblu II 4 GB, and it's fantastic. Seems very sturdy. Very good read/write speeds too. Bought it for like $40.00 off onhop.ca or something. Ncix has it too, but was backordered when I checked.

Seriously, this is the answer to all your problems. It's cheap, reliable, and looks cool too :D

Plus, Kanguru even offers branding

Cambridge PC Support
06-07-2010, 06:23 PM
Anyone got a supplier for the Kanguru's in the UK?

Vicenarian
06-07-2010, 06:47 PM
Might be able to find one here: https://www.kanguru.com/index.php/resellers

PR Tech
06-08-2010, 06:31 AM
Sold Vicenarian. Just bought a Kanguru 4GB on eBay for a little over $20.00.

exo
06-12-2010, 12:37 PM
Hi, found an up to date article about write protected USB drives here:

http://www.fencepost.net/2010/03/usb-flash-drives-with-hardware-write-protection/

Peeps using SD Cards may stop after reading it...

Anyone got a supplier for the Kanguru's in the UK?

I've not used them but limitedgoods.com supply Kanguru drives:
http://www.limitedgoods.com/itemView.php?ProdID=655740

Comet for the PQI's:
http://www.comet.co.uk/shopcomet/category/2358/USB-Sticks/n/1002358+4294962899

Don't make the same mistake as me and order 3 Easy Disk flash drives from amazon:
http://www.amazon.co.uk/Easydisk-4GB-USB-Flash-Drive/dp/B000MLPTH6/ref=pd_bxgy_ce_text_c

A customer review stated that they had a hardware write protect switch and the image even looks like it has one on the side. Alas the latest batch of them no longer have it...

Skyhooker
06-12-2010, 01:24 PM
I just picked up that Kingston Mobilelite card reader (mentioned above), and can now report that it works perfectly and respects the card's write-protect switch. I had purchased an 8GB card specifically for use in my biz as a toolkit, so it was worthless to me without write-protection, but I couldn't see buying a new flash drive to replace it.

Vicenarian
06-12-2010, 04:31 PM
Sold Vicenarian. Just bought a Kanguru 4GB on eBay for a little over $20.00.


I'm sure you'll love it. :D

Graystar
06-12-2010, 06:36 PM
I just picked up that Kingston Mobilelite card reader (mentioned above), and can now report that it works perfectly and respects the card's write-protect switch. I had purchased an 8GB card specifically for use in my biz as a toolkit, so it was worthless to me without write-protection, but I couldn't see buying a new flash drive to replace it.

Does the SD card stick out un-protected? From the photos it looks like it does. To me this means the card cannot "ride" in the device all the time.

I have been using the Mediagear XTRA drive which the lock switch works all the time, but having had three of them fail on me this last year and the fact that I cannot find them readily I am looking for a different solution.
Please advise

Skyhooker
06-12-2010, 11:33 PM
Does the SD card stick out un-protected? From the photos it looks like it does. To me this means the card cannot "ride" in the device all the time.


No, there's a protective shell that retracts into the device on both ends to cover both the card and the USB jack - it's not built like a brick, but should travel fairly well.

FOLLOW UP: OK, this is bad - I just tried removing my card from the reader, and it's stuck. It feels like it's hanging up on the write-protect switch itself. AAAARRRRGGGGGHHHH!!! I may have to break it just to remove my card.

Vicenarian
06-14-2010, 03:13 PM
I bet that Kanguru drive is looking more and more attractive LOL :)

Skyhooker
06-19-2010, 11:37 PM
I contacted Kingston regarding my Mobilelite G2 pocket card reader that basically ate my SD flash card - they gave me an RMA because their engineers want to see WHY the Transcend card got stuck inside, and they're sending me a new reader along with an 8GB Kingston card.

Bravo, Kingston!

Vicenarian
06-20-2010, 01:34 AM
So, did anybody buy the Kanguru drive? And, if so, what do you think of it?

kagman
06-20-2010, 03:45 AM
I am going buying 3 Kanguru Flashblu II drives right now. Thanks guys. Needed some flash drives with write protection.. :)

norm1320
06-28-2010, 06:37 PM
Vicenarian, I'm going to go out on a limb here and guess that you really like the Kanguru drive. lol

Seriously, I would consider this (or something like it) except that I like a bit more breathing room. I bring a 500GB drive in a Rocketfish usb/esata enclosure with me instead of a thumb drive. Allows me to carry ISOs of XP, Vista, and Win7 for OS reinstalls if the client has lost their media, plus UBCD, BartPE, a few different malware/virus scanners, and other assorted utilities while still having plenty of room to backup client data right on the spot if I need to do a format/reinstall.

I know this may seem excessive, but most of my clients are older retired people who don't mind one bit if I remain onsite for a prolonged period, but don't like having their computers taken offsite unless absolutely necessary. I think a lot of them just enjoy having the company for a while.

I'm just getting started, so I can't afford to do a proper hardware write blocker solution, but would love it if I could find an inexpensive way of getting at least some protection without sacrificing drive capacity.

Vicenarian
06-28-2010, 08:46 PM
haha yeah I love the drive...so for those who got them, what do you think? :)