What security exist when sharing files via an external USB drive?

Question

We have several external sources that send us data via an external hard drive. What security risks are we exposing ourselves to?

Answer 1

As far as I know, there is currently no generic malware targeting desktop Linux systems. However, it is definitely possible. An example has been shown by Jon Larimer at Shmoocon 2011.

By default, Ubuntu auto-mounts inserted USB drives and opens a Nautilus window to show the content. It may also generate thumbnails for pictures found on a drive.

This can be disabled, or it can be configured to do more automatically.

In Ubuntu 12.04 you want to check these options:

• System Settings: go to System / Details and check the actions for "Removable Media"; you may want to select "Never prompt or start programs on media insertion".
• Nautilus preferences: the "Behavior" tab (the "Executable text files" part!)
• Nautilus preferences: the "Preview" tab, and if paranoid, disable "Show thumbnails"

You can also check your settings from a command prompt:

gconftool -S "*autorun*"
gconftool -S "*executable*"

In short, apply the same precautions with Ubuntu as with Windows or Mac:

• disable all autorun mechanisms
• don't give admin rights to normal users
• educate the users to not click "yes" on messages they don't understand

Answer 2

Next to none, as long as you do not run any programs from these sources.

There is no autorun in Ubuntu, so drives attached to the system will not trigger execution of any executable files found on the drives.

Moreover, the drives are automatically mounted for a given desktop user, which makes the scenario of automatic infection of the system unlikely, even in the case that a user runs one of the programs from the drive.

One can imagine the following scenario: someone hides an executable and calls it "portrait.jpg". The user opens the drive, ignores the fact that Nautilus indicates executable (rather than a jpeg), and when the binary asks for password, the user happily types in the password...

Well, you can always make sure that mounting is done with the noexec bit. But then, what is to stop the user from copying data from the hard disk to home directory and running it?