We have several external sources that send us data via an external hard drive. What security risks are we exposing ourselves to?
As far as I know, there is currently no generic malware targeting desktop Linux systems. However, it is definitely possible. An example has been shown by Jon Larimer at Shmoocon 2011.
By default, Ubuntu auto-mounts inserted USB drives and opens a Nautilus window to show the content. It may also generate thumbnails for pictures found on a drive.
This can be disabled, or it can be configured to do more automatically.
In Ubuntu 12.04 you want to check these options:
You can also check your settings from a command prompt:
In short, apply the same precautions with Ubuntu as with Windows or Mac:
Next to none, as long as you do not run any programs from these sources.
There is no autorun in Ubuntu, so drives attached to the system will not trigger execution of any executable files found on the drives.
Moreover, the drives are automatically mounted for a given desktop user, which makes the scenario of automatic infection of the system unlikely, even in the case that a user runs one of the programs from the drive.
One can imagine the following scenario: someone hides an executable and calls it "portrait.jpg". The user opens the drive, ignores the fact that Nautilus indicates executable (rather than a jpeg), and when the binary asks for password, the user happily types in the password...
Well, you can always make sure that mounting is done with the