HarrySBoura_Auckland Posted June 5, 2011 Posted June 5, 2011 Hi All. Does any one have any knowledge about making USB read only using a software or any other method to make an existing USB (without write Protection Switch on it) to make it write protected so that no virus can edit my data on USB? Please advise how you guys secure your valuable software and tools. Cheers:)
Steve21 Posted June 5, 2011 Posted June 5, 2011 If they're being run on only your computers, you could disable write access to USB devices in registry. But then it'll stop all USB devices, not just the one drive. Will these be used outside of school/work? or only on computers you can setup/install software? Steve
HarrySBoura_Auckland Posted June 5, 2011 Author Posted June 5, 2011 I randomly use my tools on clients PC. I was looking for any method to make my USB read only so that if I use my stick on other computers no Virus can edit my softwares on my USB stick. Any suggestions ? Thank you Steve
Steve21 Posted June 5, 2011 Posted June 5, 2011 Well is there any reason you can't just set the files to readonly in Windows? Aswell as making a custom autorun.inf to stop any being added. Steve
HarrySBoura_Auckland Posted June 5, 2011 Author Posted June 5, 2011 I just tried now to make my software folders readonly (Which was showing read only already) and applied settings. I tried to do changes in text files, result = could not save changes, Then I tried to change files format, result= I could do that. Steve how to make Autorun.inf file for my USB to stop viruses as you advised, can you describe in details please if possible. and Isnt that *.inf file going to be detected by my antivirus and deleted? Thanks
Steve21 Posted June 5, 2011 Posted June 5, 2011 I just tried now to make my software folders readonly (Which was showing read only already) and applied settings. I tried to do changes in text files, result = could not save changes, Then I tried to change files format, result= I could do that. Steve how to make Autorun.inf file for my USB to stop viruses as you advised, can you describe in details please if possible. and Isnt that *.inf file going to be detected by my antivirus and deleted? Thanks Well changing file formats isn't writing over your code Just renaming it in a sense. And autorun.infs are the normal files that are used for autorun, you can setup it up such that a flash drive has a portable AV installed on it, and autorun runs it. So it should nuke any virus when you load the drive. Steve
SYNACK Posted June 5, 2011 Posted June 5, 2011 (edited) Although not full proof you can use a dumy file creator to fill up all of the free space on the drive meaning that most viruses will not be able to write to it. This does not protect from all forms but does give a limited bit of extra protection. This was recomended to me by someone else here a couple of weeks ago but I can't find the post. Here are soem links though Make USB drive write protected | Jared Heinrichs - Download NOD32 Dummy File Creator Utility 1.0 Free - This software will help you create dummy items in the folders you choose - Softpedia The other thing that you you can look at for devent capacities with a built in switch is to get a USB SD card reader and some cheap larger SD cards to put in it, slightly bulkier but you do end up with propper write protect switch. Like one of these http://pricespy.co.nz/product.php?e=242900 plus http://pricespy.co.nz/product.php?p=152952 Edit: Heres the original post: There's another trick you can use if you can't find a flash drive with a write-protect switch... http://www.ghacks.net/2011/05/13/usb-dummy-protect-create-fake-files-to-block-viruses/ and the linked tool looks easier to use too. Edited June 5, 2011 by SYNACK 2
Arthur Posted June 5, 2011 Posted June 5, 2011 The USB card reader & SD card combo is a good idea in theory, but it's not actually a proper hardware write-protect switch... SD Cards, while they have a write-protect switch, are actually no good for this purpose because it’s not actually hardware write protection – at best the card reader sends a signal to the operating system that the drive should be treated as read-only. The write-protect switch on the cards is read by a sensor that’s part of the card reader, and the card reader then passes along to the operating system whether the card is read-only. According to the specification from sdcard.org: A proper, matched, switch on the socket side will indicate to the host that the card is write-protected or not. It is the responsibility of the host to protect the card. The position of the write protect switch is unknown to the internal circuitry of the card. Basically this means that either a) cheap card readers that lack the sensor or b) operating systems or malware that don’t respect the “please don’t write to this disk” flag can write to the drive. While this may not be likely, it’s also not as secure as you might think based on the presence of that switch. (Source) From the same website... List of USB Flash Drives with Hardware Write Protection 1
Arthur Posted June 5, 2011 Posted June 5, 2011 The only problem with forensic USB write blockers is their price. WiebeTech's start at $199 USD (unless you know of anything cheaper?). http://www.wiebetech.com/products/USB-WriteBlocker.php http://www.wiebetech.com/products/Forensic_UltraDock.php
CESIL Posted June 5, 2011 Posted June 5, 2011 You can't do it permanently but you can build the stick as if it is a CD-ROM...if I can find the details tomorrow I will post details of some software for formatting the stick as ROM tomorrow...of course nobody can write to it unless they use the same software to undo the lock...
HarrySBoura_Auckland Posted June 6, 2011 Author Posted June 6, 2011 (edited) @ SYNACK Hi Mate. Yea I tried this method before and I think this is the most secured one I came across so far. But even in this method any Virus I think can still delete your files. I was looking to find if we can anyway make our USB just read only so that no machine can edit it which I think could be near to impossible after my research so far but never no if someone got solution for this. Thank you for advise anyways. . cheers Edited June 6, 2011 by HarrySBoura_Auckland
HarrySBoura_Auckland Posted June 6, 2011 Author Posted June 6, 2011 @ CESIL How do you do it? If you don't mind please post it how can you build USB as if it is CD-ROM. Thank you
Arthur Posted June 6, 2011 Posted June 6, 2011 @Cesil. Are you thinking of the U3 method which uses LPInstaller.exe to write a custom ISO image to a U3-compatible flash drive such as the SanDisk Cruzer?
mac_shinobi Posted June 6, 2011 Posted June 6, 2011 This is probably not useful at all and completely wrong but either way just a thought and some confirmation if it would work would be good - similar thought process to the dummy file creator but if you used truecrypt to create an encrypted file that took up all the space on the memory stick and store your files within the encrypted file or something along those lines ? Am guessing there is a down side or something that won't work etc ?
Steve21 Posted June 6, 2011 Posted June 6, 2011 @ SYNACK Hi Mate. Yea I tried this method before and I think this is the most secured one I came across so far. But even in this method any Virus I think can still delete your files. I was looking to find if we can anyway make our USB just read only so that no machine can edit it which I think could be near to impossible after my research so far but never no if someone got solution for this. Thank you for advise anyways. . cheers What is the overall purpose though? I mean if it's just to stop a virus deleting it, any reason you can't just set readonly etc? Sure it could be renamed into a different filetype, but it's not deleted, and easy to set back. + can set an AV on the USB drive. If it's to stop anyone editting it, even manually I'm assuming it's something you'll leave with them, which makes most stuff unsecure as such. And if it's purely going to be staying with you, any reason you can't get one with a write-readonly switch? Or even at the easiest, make a CD etc Just don't see what the overall objective is as such Steve
SYNACK Posted June 6, 2011 Posted June 6, 2011 @mac_shinobi - as soon as the user cracks open the encryption with the truecrypt mounter then the contents can be read, unless there is an option to mount as read-only but the file could still be corrupted or something. I think that you could probably use a tool to create an MD5 checksum on the drive and that way you could at least check if the files had been changed.
CESIL Posted June 6, 2011 Posted June 6, 2011 (edited) I downloaded a utility a while back to do the opposite and remove a CD-ROM partition from a free USB that came loaded with demo software (like the mythical Memory4Teachers stick) so that I could wipe and reuse the stick. The file I got was CBM209XUmptoolV1.8.3.2_1122.rar but I don't know where I found it and having just tried it with a new USB stick here it doesn't seem to work any more...I am trying to find an updated version. Edited June 6, 2011 by CESIL
LeMarchand Posted June 6, 2011 Posted June 6, 2011 I totally see the point of this. I carry a flashdrive with a load of tools with me at all times: more portable + easier to update than a disk. However, stick it in the wrong machine and you're uscwap. A hardware switch would definitely be the best option, as you can easily change things when it is safe to, but they seem virtually extinct (my guess too many "faulty" sticks returned by idiots who had activated write protection). Of the methods I've seen after a spot of research (many of which are mentioned above), the "fill the drive to bursting" ploy seems the easiest, but not that secure. "Read only" is no good - one of the common nasties du jour flips that switch. The U3 idea seems OK, but how do you alter the contents easily when you want to? Truecrypt type encryption may work (IIRC you can do "read only" - if not FreeOFTE will do it) but is a faff, and I'm not sure if it would "stay" read only in the face of a virus assault. Setting arcane file permissions (a specific account as the only one with write/owner perms) may work, but means you need your machine/logon to make changes.
Freedom Posted June 6, 2011 Posted June 6, 2011 I downloaded a utility a while back to do the opposite and remove a CD-ROM partition from a free USB that came loaded with demo software (like the mythical Memory4Teachers stick) so that I could wipe and reuse the stick. The file I got was CBM209XUmptoolV1.8.3.2_1122.rar but I don't know where I found it and having just tried it with a new USB stick here it doesn't seem to work any more...I am trying to find an updated version. I am sorry to highjack the thread, but I have literally hundreds of 1GB sticks that are locked out as 40 odd meg cd-roms and i want and need a way to use them - even if I give them away so if you do find this info out - please pm me into the info :0)
Arthur Posted June 7, 2011 Posted June 7, 2011 What about VHDs? They are supported natively by Vista/7 and can be made read-only. e.g. CreateVHD.cmd - Creates a new 512MB VHD. @echo off && SETLOCAL cd /d "%~dp0" :: Elevation Check whoami /priv | find "SeImpersonatePrivilege" > NUL || color 4f && echo. && echo This script must be executed from an elevated command prompt. &&echo. && pause && exit :: Variables SET VHD="%~dp0MalwareRemovalTools.vhd" SET DPS=CreateVHD.txt :: Create DiskPart Script (echo create vdisk file=%VHD% maximum=[color="red"][b]512[/b][/color] type=fixed) > %DPS% (echo select vdisk file=%VHD%) >> %DPS% (echo attach vdisk) >> %DPS% (echo create partition primary) >> %DPS% (echo select partition 1) >> %DPS% (echo format fs=[color="red"]exfat[/color] quick label=[color="red"]Apps[/color]) >> %DPS% (echo assign letter=[color="red"]M[/color]) >> %DPS% (echo detach vdisk) >> %DPS% (echo exit) >> %DPS% :: Run DiskPart diskpart /s %DPS% :: Delete DiskPart Script echo y | del %DPS% ENDLOCAL AttachVHD-RW.cmd - Mounts the VHD in read/write mode so you can add/update your applications @echo off && SETLOCAL cd /d "%~dp0" :: Elevation check whoami /priv | find "SeImpersonatePrivilege" > NUL || color 4f && echo. && echo This script must be executed from an elevated command prompt. &&echo. && pause && exit :: Variables SET VHD="%~dp0MalwareRemovalTools.vhd" SET DPS=AttachVHD.txt :: Create DiskPart Script (echo select vdisk file=%VHD%) > %DPS% (echo attach vdisk) >> %DPS% (echo exit) >> %DPS% :: Run DiskPart diskpart /s %DPS% :: Open VHD in Windows Explorer %SystemRoot%\explorer.exe /e,M: :: Delete DiskPart Script echo y | del %DPS% ENDLOCAL AttachVHD-R.cmd - Mounts the VHD in read-only mode. Use on infected PC. @echo off && SETLOCAL cd /d "%~dp0" :: Elevation check whoami /priv | find "SeImpersonatePrivilege" > NUL || color 4f && echo. && echo This script must be executed from an elevated command prompt. &&echo. && pause && exit :: Variables SET VHD="%~dp0MalwareRemovalTools.vhd" SET DPS=AttachVHD.txt :: Create DiskPart Script (echo select vdisk file=%VHD%) > %DPS% (echo attach vdisk [color="red"]readonly[/color]) >> %DPS% (echo exit) >> %DPS% :: Run DiskPart diskpart /s %DPS% :: Open VHD in Windows Explorer %SystemRoot%\explorer.exe /e,M: :: Delete DiskPart Script echo y | del %DPS% ENDLOCAL DetachVHD.cmd - Unmounts VHD @echo off && SETLOCAL cd /d "%~dp0" :: Elevation check whoami /priv | find "SeImpersonatePrivilege" > NUL || color 4f && echo. && echo This script must be executed from an elevated command prompt. &&echo. && pause && exit :: Variables SET VHD="%~dp0MalwareRemovalTools.vhd" SET DPS=DetachVHD.txt :: Create DiskPart Script (echo select vdisk file=%VHD%) > %DPS% (echo detach vdisk) >> %DPS% (echo exit) >> %DPS% :: Run DiskPart diskpart /s %DPS% :: Delete DiskPart Script echo y | del %DPS% ENDLOCAL
willtech Posted June 20, 2011 Posted June 20, 2011 (edited) Well is there any reason you can't just set the files to readonly in Windows? Aswell as making a custom autorun.inf to stop any being added. Steve pandasecurity usbvaccine we use this its free it creates a blank autorun.inf file that is readonly to stop viruses writing to the autorun.inf hope this helps Edited June 20, 2011 by willtech
mac_shinobi Posted June 20, 2011 Posted June 20, 2011 If you made a hta to either write a zero or one to this registry key : USB Flash Drive Write Protection Then sent the update hkey local user would that apply the change or not ? Batch files - RUNDLL and RUNDLL32
Arthur Posted June 29, 2011 Posted June 29, 2011 I've just bought one of these from QuietPC. It's an external USB 2.0/eSATA HDD enclosure for 2.5" SATA HDDs and SSDs with a hardware write protect switch and the ability to act as a virtual BD-ROM drive too. The latter feature enables you to place all of your anti-malware/operating system ISOs in a folder called _ISO in the root of the HDD and either boot the computer from any of them or mount the disc images from within your OS. The filenames are shown on the OLED display and you use the jog switch on the side to change between each ISO. http://i.imgur.com/XFwrv.jpg Here's a video of it being used to boot a Linux ISO stored the HDD... * The Zalman ZM-VE200 is a slightly cheaper version of the iodd 2501. 3
LeMarchand Posted June 29, 2011 Posted June 29, 2011 Looks good! I might get myself one of those. Not something you can wear around your neck, though...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now