We have several external sources that send us data via an external hard drive. What security risks are we exposing ourselves to?


As far as I know, there is currently no generic malware targeting desktop Linux systems. However, it is definitely possible. An example has been shown by Jon Larimer at Shmoocon 2011.

By default, Ubuntu auto-mounts inserted USB drives and opens a Nautilus window to show the content. It may also generate thumbnails for pictures found on a drive.

This can be disabled, or it can be configured to do more automatically.

In Ubuntu 12.04 you want to check these options:

  • System Settings: go to System / Details and check the actions for "Removable Media"; you may want to select "Never prompt or start programs on media insertion".
  • Nautilus preferences: the "Behavior" tab (the "Executable text files" part!)
  • Nautilus preferences: the "Preview" tab, and if paranoid, disable "Show thumbnails"

You can also check your settings from a command prompt:

gconftool -S "*autorun*"
gconftool -S "*executable*"

In short, apply the same precautions with Ubuntu as with Windows or Mac:

  • disable all autorun mechanisms
  • don't give admin rights to normal users
  • educate the users to not click "yes" on messages they don't understand
| improve this answer | |

Next to none, as long as you do not run any programs from these sources.

There is no autorun in Ubuntu, so drives attached to the system will not trigger execution of any executable files found on the drives.

Moreover, the drives are automatically mounted for a given desktop user, which makes the scenario of automatic infection of the system unlikely, even in the case that a user runs one of the programs from the drive.

One can imagine the following scenario: someone hides an executable and calls it "portrait.jpg". The user opens the drive, ignores the fact that Nautilus indicates executable (rather than a jpeg), and when the binary asks for password, the user happily types in the password...

Well, you can always make sure that mounting is done with the noexec bit. But then, what is to stop the user from copying data from the hard disk to home directory and running it?

| improve this answer | |
  • Can Nautilus be made to crash with a specially crafted file system on the external drive? How can this be detected? And what are the risks? – Hendré Oct 22 '12 at 14:58
  • No idea. Probably yes; if you need to be very cautious (for some reason), then the data would have to be mounted, checked and copied by another subsystem (e.g. a script called from udev), and automatic mounting by gvfs should be disabled. I don't think that it is a real danger, though, given that it is hard to craft a such a filesystem which would work on all the existing versions of Nautilus and would work for longer than until the next daily update. – January Oct 22 '12 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.