Blog | G5 Cyber Security

USB Virus Risk: New Stick Safety

G5 Cyber Security

TL;DR

Yes, a virus can infect a brand new USB stick, but not in the way most people think. The stick itself doesn’t store viruses until you put files on it. However, malicious code can be placed in the firmware of the USB controller, which executes automatically when plugged in. This is rare, but possible. Protecting yourself involves being careful about where you buy sticks and using security software.

How a Virus Can Infect a New USB Stick

  1. Firmware Infection: The biggest risk isn’t the storage space on the stick; it’s the small program (firmware) that controls how the stick works. This firmware can be pre-programmed with malicious code at the factory or during shipping. When you plug in the infected stick, this code runs before your operating system even sees it.
  2. AutoRun (Older Systems): Older versions of Windows used to automatically run programs on USB sticks when they were inserted. This feature has been disabled by default for many years due to security risks, but if enabled or on older systems, a virus could execute this way.
  3. BadUSB: A more advanced attack called BadUSB involves reprogramming the firmware of the stick to act like a keyboard or network adapter. It can then send commands to your computer without you knowing.

Protecting Yourself – Step-by-Step Guide

  1. Buy from Reputable Sources: This is the most important step. Purchase USB sticks from well-known retailers or manufacturers. Avoid buying from unknown online marketplaces where counterfeiting is common.
  2. Scan Before First Use: Even if it’s new, scan the stick with a reputable antivirus program before you put any of your own files on it. This won’t detect firmware viruses directly (see step 5), but will catch anything added during manufacturing or shipping. 
    # Example using ClamAV (Linux) - install first: sudo apt-get install clamav
clamscan /dev/sdb1 --infected --remove # Replace /dev/sdb1 with your USB stick's device name
  3. Disable AutoRun (If Applicable): While largely obsolete, if you are using an older Windows system, ensure AutoRun is disabled. You can do this through Group Policy Editor or the Registry.
    • Group Policy Editor: Search for ‘gpedit.msc’ and navigate to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies. Disable all autoplay options.
    • Registry Editor: (Use with caution!) Navigate to HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer and set the value of ‘NoDriveTypeAutoRun’ to 0x01 (disable AutoRun on all drives).
  4. Be Careful What You Plug In: Don’t plug USB sticks from untrusted sources into your computer. Even if they appear empty, they could contain malicious firmware.
  5. Firmware Scanning (Advanced): Detecting firmware viruses is difficult for standard antivirus software. Specialized tools and hardware are often required. Some advanced security suites may include this functionality. Consider using a dedicated USB device analyser if you suspect a compromised stick.
  6. Keep Your Antivirus Updated: Regularly update your antivirus software to protect against the latest threats.
  7. Use Write-Protected Sticks (If Possible): Some USB sticks have a physical write-protect switch. Enabling this prevents any data from being written to the stick, reducing the risk of infection. However, it also means you can’t use the stick normally until you disable it.

What if I think my stick is infected?

  1. Do not use it: Disconnect the USB stick immediately and do not plug it into any other computers.
  2. Scan with multiple antivirus programs: Use several different reputable antivirus scanners to check for malware.
  3. Consider destroying the stick: If you suspect a firmware infection, the safest option is often to physically destroy the USB stick to prevent further spread of potential malware.
Exit mobile version