18

I have an USB drive which I know is virus infected (an anti-virus on my friend's machine detected it). Unfortunately neither of us know the virus name and I don't want to take the risk of plugging it to my Windows box again.

Of course, in all probability the virus affects only Windows. (But I'm not sure) I want to know if I can safely plug the USB into my Ubuntu Lucid laptop and copy the stuff I need from the drive. If there are some precautions I need to follow what would they be?

1

4 Answers 4

15

Linux systems usually do not execute code from a USB stick when just connecting it. Thus copying stuff from it should be safe.

Keep in mind that the copied files may contain malicious code. For example, some evil java-script inside a html file or an evil office-script inside you word/open-office-writer documents. That means, you should be careful with these files - don't open these files with programs that are known to execute embedded scripting code.

Well, and don't directly execute binary executables that are copied from that stick.

4
  • Javascript in HTML files can not harm your system because they can't access anything outside of a browser. The worst that can happen is that there is an intentional infinite loop that eats CPU (then you just close the browser).
    – dv3500ea
    Sep 21, 2010 at 17:01
  • 2
    @dv3500ea that's not entirely true. The JavaScript could execute an exploit in an number of softwares other than the browsers (Flash, Java, etc) that ends up infecting a computer. However - the likelihood of it being an infection for Linux computers is very slim. Linux has the mantra "Security through obscurity". With such a relatively small market share most viruses are produced for Windows machines not Linux. Sep 21, 2010 at 17:06
  • @dv3500ea: for an example how java-script can harm you - check out en.wikipedia.org/wiki/Cross-site_scripting and get scared ;) Sure, your system is not necessarily harmed, but perhaps some homebanking data is transfered ... Sep 21, 2010 at 17:17
  • 8
    @Marco Ceppi: Linux does not have any security-by-obscurity mantra. Linux systems implement a lot of stuff that goes quite in the opposite direction: user separation, make it hard to surf as root, convenient system wide security upgrading including application programs, a major ban on proprietary software, etc. And keep in mind that the market share of linux is quite different between the (web-)server and desktop market. Sep 21, 2010 at 17:26
7

Viruses that work on Linux are rare, but they do exist. I would recommend scanning the USB volume with ClamTk (It's just called "Virus Scanner" in Software Center). This will help you to identify the virus, which may be useful information. You might consider re-scanning the volume after reformatting it as well. It's probably overkill, but it shouldn't take long.

1
  • 3
    Useful tip. ClamTk would not install on my system due to some locale issues with Perl. However I Googled and found BitDefender. They provide a software repository for easy installation as well. Bitdefender quickly identified the Trojan - (It was lurking inside an mp3 file) and offered to clean/delete/quarantine. So this might be a good solution for those who want to use Ubuntu to clean up their Windows drives/partitions safely.
    – suhridk
    Sep 22, 2010 at 7:21
4

There is very little to worry about. Just copy the files you need to your laptop then format the drive. Don't copy files if you don't know what they are because these are likely to be the virus. Make sure you don't execute anything on the drive just to be safe.

2
  • 1
    There is nothing wrong with just copying a file, even a virus file. It only has an effect when you execute it. You just have to make sure that, in the process of copying the file, the OS doesn't also execute it without your permission. (Linux systems in general are usually relatively good about only running things when explicitly asked to.)
    – David Z
    Sep 21, 2010 at 20:11
  • 1
    The idea was to leave infected files on the drive so that they are deleted when it is reformatted.
    – dv3500ea
    Sep 21, 2010 at 21:01
0

How to "safely" plug in a usb drive to Linux.

Here are my approaches. This is especially useful if you're worried about the USB "drive" actually being a microcontroller which identifies itself as a USB HID device like a keyboard and mouse combo and starts running commands on your computer by typing and using a mouse--same as you would. One example of this is the Hak5 "USB Rubber Ducky. An 8-bit Arduino Leonardo or Pro Micro (ATmega32U4 mcu) can be made to do this too using the USB Keyboard and Mouse libraries. Most 32-bit microcontrollers can do this too.

So, if that kind of stuff happens, you want to wipe your whole OS when done, and you want to be running a "blank" OS with nothing personal on it at the time you plug in the device. Here are some options.

  1. Preface notes:
    1. If you need the internet at any point on your "throw-away" OS while using the questionable thumb drive, connect only to a guest home WiFi network, which restricts access from the rest of your network. Do NOT connect to your main home WiFi network, as that would open up vulnerabilities to other systems on your network, since being on the same wifi network as them would make their IP addresses accessable.
  2. Option 1 (safest option I think): use a virtual machine
    1. Install Ubuntu into a fresh virtual machine in Virtual Box (no cost to use), running in Ubuntu.
      1. ie: In Ubuntu, install Virtual Box, into which you install another Ubuntu system as a virtual machine.
    2. In the Virtual Machine, plug in the USB drive and copy files to/from it as needed.
    3. Reset or delete the virtual machine when done.
    4. Note: if you need to share files between the virtual machine and your real, host computer, you can copy files to and from a shared folder that is shared between the virtual machine and your host computer.
  3. Option 2: boot from an Ubuntu live USB which is run from RAM
    1. Note: if you choose this option, I recommend you have your main, internal hard drive LUKS encrypted so that even if a program tried to mount and read from or write to your internal disk, it couldn't. LUKS encryption is an option when installing Ubuntu as your main OS, for instance.
    2. Install Ubuntu or similar to a live USB, intended to install Ubuntu.
      1. You can also use Parted Magic instead, for $13~$49. It's a great tool! (I'm not affiliated in any way; I just like the tool and frequently use it for computer restore and repair).
    3. Boot from the live USB, but choose the option to "run from RAM" (assuming you have enough RAM).
    4. Once the OS boots and has copied everything needed from the thumb drive to RAM, unplug your boot drive.
    5. When done, just turning off the computer "wipes" the whole OS you just used, since it was all in RAM only.
    6. Note: if you need to get files to or from the thumb drive you are plugging in, you may be opening up a security vulnerability, which is why I feel like Option 1 above is better. You could, however:
      1. Mount your main drive.
      2. Plug in another USB drive.
      3. Leave the boot drive plugged in and use it to share files.
      4. I don't think any of these are super secure options, so do them only if you can't do Option 1 above.

See also:

  1. I also shared this here: Information Security: Safe to connect a USB to Linux?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .