27

I'm a school teacher and I'd like to share files in a USB stick among students and so among different OS.

In particular I would like to set a password for writing/changing, while the content of USB can be readable from everyone. This is for preventing the diffusion of malware.

Is it possible?

  • 6
    Not possible anyone with root access on any machine can change rw permissions. – Panther Sep 10 '17 at 20:45
  • 15
    This is one of those relatively few times where "share it from the cloud" type answers would work. You get the students to "save" a copy to their own cloud space, whether its google drive, one drive/skydrive, dropbox, etc and then share the link back to you. – Criggie Sep 10 '17 at 22:37
  • 1
    @LasVegasCoder Doesn't provide a read-only option like the OP wants. Also, TrueCrypt is also replaced by VeraCrypt now. Same issue applies. – Thomas Ward Sep 11 '17 at 3:04
  • 2
    A few answers have suggested you use a DVD. I would advise you don’t - very few students have an old enough computer to be able to read one. – Tim Sep 11 '17 at 9:22
  • 2
    This is exactly the use case that the World Wide Web was intended for, two decades before "cloud" meant anything. – dotancohen Sep 12 '17 at 11:55
39

Because this drive is going to be used on systems you do not control, or that are not Linux and don't otherwise support the Linux permissions scheme, you're a bit out of luck here.

There's no real way to do the password protection you're looking for on a disk without specialized equipment, though, and that's usually not cost-effective as a solution (as detailed below).

Note that I am an IT Security Professional, so if I seem demeaning or berating in my message and response here, I don't mean it that way, I'm just hypercritical when it comes to security, as it's my job to be that way.

(Scroll down to the "If you really want a secure method for sharing a flash drive around..." section below if you don't want to hear my rant about all the security risks you're introducing.)


System Security Rule 0: NEVER share around USB drives if you want to limit the risk of malware!

I say this is Rule 0, but this is really Rule 0B - Rule 0A is about physical access to systems.

But to put it simply, this is a MAJOR security risk. By attempting to use a USB to distribute data around, you immediately run the risk of not being able to control whether malware is put on the stick or not. This is partially circumvented by USB sticks with a read-only lock switch on them, such as the Kanguru FlashTrust 3.0, but they can easily be turned to read/write by flipping the switch.

As a security professional I strongly suggest you provide a non-USB-stick alternative method for access to the items for your class, such as a Box account or files served from a site within your educational institution's web space.

Another alternative is a fully-written-to, fully-locked CD/DVD, which would work just as well, and because it'd be fully written to and have no extra open space on it when you fully lock down the device, the disk would already be considered 'read-only'. Unless you need to share huge files, though, in which case the DVD option might not work well. More and more devices, however, are being released into the market without CD/DVD drives, however, which means this is not the most ideal solution either.

I'll also bet that by distributing this flash drive around, you break a few rules about "authorized devices" on your school's computer systems, but I can't speak to that.


If you really want a secure method for sharing a flash drive around...

... you start going into the world of very expensive equipment, such as the Apricorn Aegis SecureKey 3 which is a hardware encrypted thumb drive which permits you to set a passcode for admin mode but also provide read-only user passcodes as secondary codes on the device. That way, the disk is locked into read-only mode for non-admins, and read/write mode for the admin code user.

The problem with this, is it's expensive - $129US for just a 16GB secured stick - this is mostly due to the cost of hardware encrypted devices (but devices such as these are designed for a very special set of potential use cases and as such the availability of cheaper products is zero due to the lack of industry demand). So this is usually not a cost-effective option especially if you don't trust your students.


Ultimately, though, there's really no easy no-cost or cost-effective way to achieve what you want with just a plain USB stick, while maintaining OS cross-compatibility, and even then you can't guarantee the security.

The problem is that many different OSes are used and at play. Even if OSes weren't a factor, any user with root power would be able to give themselves access if it were a Linux formatted stick with Linux permissions even set. There's just no way to achieve USB stick security with no-cost or low-cost solutions.

This is one of the few times in the earth, though, that sharing via the cloud (Dropbox, Google Docs, Box, even an OwnCloud instance) is the proper solution, because there's no risk of malware infection just by downloading the file (unless the file itself is malware). (And the likelihood of one of the aforementioned cloud services being infected by such malware that you're trying to shield against is extraordinarily low)

  • 2
    As a University student, I have no way to read a disk drive. None of the devices I have with me at University have a drive slot. This is not an unusual scenario - a significant proportion of students use only laptops. – Tim Sep 11 '17 at 9:18
  • 1
    "The problem is that many different OSes are used and at play." No, it isn't, and the answer itself explains why not. The problem is economics: there's negligible demand for a device with these characteristics, so they don't benefit from economies of scale and are expensive. – Peter Taylor Sep 11 '17 at 11:20
  • 1
    @PeterTaylor Actually part of it is the OSes - you can do a rudimentary control if it's a Linux formatted disk and the end-users are using school-issued Linux laptops without root access. At which point standard controls for access lists, etc. would be able to work. Because we have to support other OSes then it becomes economics – Thomas Ward Sep 11 '17 at 13:54
  • 4
    Note that a $129 drive only protects against students who wouldn't spend $129 to play a trick on their mates. – Dmitry Grigoryev Sep 11 '17 at 16:44
  • 1
    @amorvincomni Windows can't read Linux or Mac hard disk formats but can read cross-platform compatible formats (FAT/FAT32/exFAT); Linux can read them all; Mac can only read HFS and cross-platform formats (FAT/FAT32/exFAT); you can only give root restrictive access to a given disk for a compatible filesystem (ext4, or similar). But I'll bet you that only a very VERY small subset of your students use Linux systems and don't have admin privileges (if they have sudo or superuser access your protection step is irrelevant because they have superuser on that system and connected devices.) – Thomas Ward Sep 14 '17 at 16:55
12

Share a CD or DVD disk.

Writable disks are really cheap. Drives are cheap too. Buy an external USB DVD writer for less than 30 USD, it will work on any modern computer, and you can lend it to students that don't have their own drive.

All but expensive disks are write-once, so the data you write onto the disk can't be rewritten. You have to make sure you write the disk to its full capacity though, or else the file system on the disk can be modified or replaced by writing more data in the empty regions. Even if you do leave empty space, there's fewer malware that will spread on an optical disk than on a flash drive.

The drawback of this is that if you want to share data that's larger than what fits on a few disks (a writable DVD has about 4 gigabytes of capacity), then a large capacity flash drive is much more convenient than lots of disks. I don't expect that would apply in your case though.

  • Actually it won’t work on any modern computer - if even go as far as saying it will work on very few modern computers. Given that university students mostly use laptops, very few would be able to read it. Even I, as a fairly technically minded computer Science student have no way of reading a disk. – Tim Sep 11 '17 at 9:21
  • 3
    @Tim That's why I explicitly recommended an external disk drive you plug into the notebook through USB. It's cheap enough that you can reasonably buy one (with cables) and lend it to students. aqua.hu/… is an example of such a drive with price, but that link probably won't live for longer than a few months. – b_jonas Sep 11 '17 at 9:25
  • @ZsbánAmbrus Please expand your answer, then, on that. Also consider that modern Mac devices don't have USB (USB-C only) so this isn't easily doable for them either. – Thomas Ward Sep 11 '17 at 15:53
  • 2
    @ThomasWard As for the modern Mac, OP says he wants to distribute an USB stick, he doesn't seem to mention that he had problems with modern Macs that don't have a USB port to plug such a stick into them. But if this is a problem, then I can't give good advice, because I'm not familiar with modern Macs. – b_jonas Sep 11 '17 at 20:28
  • @ZsbánAmbrus: I don't know a priori which OS or device students can have and as commented by Tim it is not an unusual scenario that not everybody could read a DVD – amorvincomni Sep 13 '17 at 13:27
6

Sharing a physical media is a terrible idea security-wise. Even if you share a read-only CD, your students could simply buy a blank CD of the same brand and write the original content + malware on it. You'd have to sign, stamp or otherwise make your media unique to prevent this, and ideally your students should only accept it from your hands, not from each other. Otherwise the original media could circulate among one group of students (and you), while a fake media would be given to another group.

A similar trick could be played on encrypted drives with read-only passcode: one of the students could save a drive image, write an infected image with the same read-only passcode and circulate the drive among the rest. The original image could then be restored before the drive is given back to you.

To prevent such threats, your students would have to obtain a digital signature of the original data from somewhere else, like a school server, and know how to verify it. Indeed it would be much simpler to store the files you want to share on the server where you'd store the signature, making the sharing process as simple as giving your students a download link.

  • I think I will adopt this solution. – amorvincomni Sep 13 '17 at 13:29
2

People have already answered your literal question. Let me try to take a stab at the real issue.

I'm assuming you have internet constraints that prevent you from having them download the files.

What you can do in this case is to provide an image (.iso file) on the USB, then tell students to run sha256sum on the file and check its hash against one that you provide via other means before they open the file.

Those who cooperate and don't do anything else should not get a virus.

  • I think the OP wants to limit the risk of malware being added to the USB stick. Using an ISO file doesn't erase this risk, nor does it protect against what it seems the OP is trying to protect against. (They're at a school, my guess is that the school can provide ample bandwidth or storage space for storing the file if they ask) – Thomas Ward Sep 11 '17 at 21:04
  • @ThomasWard: Malware isn't a problem if it's never executed though. The point here is if they do the steps I've listed then they are guaranteed to never execute any malware, so it certainly protects against what the OP wants to protect against, doesn't it? – Mehrdad Sep 11 '17 at 21:31
  • 2
    @Mehrdad The problem is that on some operating systems--including some versions of Windows--the OP can't really prevent malware from running automatically when the device is attached. It seems the device may be used on such systems. With that said, I this answer might be useful. Checking a SHA-256 hash as you recommend can at least help mitigate risk, especially if students are advised to disable "autorun" on affected OSes. – Eliah Kagan Sep 11 '17 at 21:49
  • 1
    @Mehrdad In my view the question is on-topic because, as least as I understand it, the goal is to prepare the storage medium in Ubuntu. People often have questions about what file ownership and permissions in Ubuntu can and cannot do. Unix-style permissions are often (rightly) said to be among the benefits of Ubuntu and other GNU/Linux systems, but sometime people hope/think permissions can solve problems that really can only be solved at different level. If we did close it, I suspect we'd just get more questions like it, asked by other Ubuntu users who want to control devices they distribute. – Eliah Kagan Sep 11 '17 at 22:00
  • 1
    @Mehrdad: I forgot to write that your real issue is quite good. of course is that the real issue is that not all the families have the ability to download something using the service of the institution, and I cannot use a different service. The use of a shared physical devices would help me in reaching all the students. – amorvincomni Sep 14 '17 at 16:11
0

why don't you just upload the material to some site and share it with a password ?

if you are in the same network make it local site other wise the free upload sites are a lot

  • This is the solution that I'm using. Unfortunately not all the students (I'm an High school teacher) can download the files. Moreover these students are the ones that should read the material.... – amorvincomni Sep 28 '17 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.