connecting unknown USB sticks to computer

Is there any security issue with allowing other users or connecting
unknown USB flash drives to computers? I have not had that many
transactions using USB drive and saw someone take another persons USB
drive and stick it into a computer.
1) I can't readily think of any problem with this as long as the person
in control of the computer is copying files to the drive and not from
the drive.
2) Is there any way to automatically start a program when a flash drive
is installed, similar to a CDROM.
I do recall a time when users would be very reticent to stick a
floppy drive into a computer without knowing something about the
source.
Why have things changed? Is there something different about the way a
flash drive is handled by the computer as compared to a floppy.

jim_patterson@comcast.net

In
Message-ID:< ups.com>,
wrote:

>Is there any security issue with allowing other users or connecting
>unknown USB flash drives to computers? I have not had that many
>transactions using USB drive and saw someone take another persons USB
>drive and stick it into a computer.
>1) I can't readily think of any problem with this as long as the person
>in control of the computer is copying files to the drive and not from
>the drive.
>2) Is there any way to automatically start a program when a flash drive
>is installed, similar to a CDROM.

Yes there are issues. Yes USB drives can auto-run.

See, for instance, Risks Digest at:
http://catless.ncl.ac.uk/Risks/23.41.html#subj4

--
Arthur T. - ar23hur "at" intergate "dot" com
Looking for a good MVS systems programmer position

Arthur T.

On Tue, 12 Sep 2006 21:34:40 -0400, Arthur T. <>
wrote:

>In
>Message-ID:< ups.com>,
> wrote:
>
>>Is there any security issue with allowing other users or connecting
>>unknown USB flash drives to computers? I have not had that many
>>transactions using USB drive and saw someone take another persons USB
>>drive and stick it into a computer.
>>1) I can't readily think of any problem with this as long as the person
>>in control of the computer is copying files to the drive and not from
>>the drive.
>>2) Is there any way to automatically start a program when a flash drive
>>is installed, similar to a CDROM.
>
> Yes there are issues. Yes USB drives can auto-run.
>
> See, for instance, Risks Digest at:
>http://catless.ncl.ac.uk/Risks/23.41.html#subj4


Also risks in the opposite direction:
http://www.schneier.com/blog/archive...bdumper_1.html

--
Stephen Poley

Stephen Poley

wrote:

> Is there any security issue with allowing other users or connecting
> unknown USB flash drives to computers?

That's a bit like asking if any health issues are raised by letting
random strangers stick their unsheathed penises in your daughter.

> I have not had that many
> transactions using USB drive and saw someone take another persons USB
> drive and stick it into a computer.
> 1) I can't readily think of any problem with this as long as the person
> in control of the computer is copying files to the drive and not from
> the drive.

How do you propose that you guarantee this will be the only type of
file movement?

> 2) Is there any way to automatically start a program when a flash drive
> is installed, similar to a CDROM.

Of course. In fact it's the SAME method.

> I do recall a time when users would be very reticent to stick a
> floppy drive into a computer without knowing something about the
> source.

Inserting floppies is considerably MORE safe than inserting CD-ROM or
USB devices. Floppies were phasing out before the autorun nonsense was
becoming popular.

> Why have things changed? Is there something different about the way a
> flash drive is handled by the computer as compared to a floppy.

Things haven't changed. They've gotten worse in fact. And yes there's a
difference, but it's not a good one from your point of view. Back in
the floppy days you not only had to insert and infected floppy, you had
to manually navigate to that floppy and run some program on it. Or
accidentally reboot the machine with the floppy still inserted. With
the advent of autorun/autoplay it became a simple matter of giving your
CD tray a little push, and now, plugging in your dongle.

Non scrivetemi

Thanks for your replies. I appreciate the informative inputs.
Non scrivetemi wrote:
> wrote:
>
> > Is there any security issue with allowing other users or connecting
> > unknown USB flash drives to computers?
>
> That's a bit like asking if any health issues are raised by letting
> random strangers stick their unsheathed penises in your daughter.
>
> > I have not had that many
> > transactions using USB drive and saw someone take another persons USB
> > drive and stick it into a computer.
> > 1) I can't readily think of any problem with this as long as the person
> > in control of the computer is copying files to the drive and not from
> > the drive.
>
> How do you propose that you guarantee this will be the only type of
> file movement?
>
> > 2) Is there any way to automatically start a program when a flash drive
> > is installed, similar to a CDROM.
>
> Of course. In fact it's the SAME method.
>
> > I do recall a time when users would be very reticent to stick a
> > floppy drive into a computer without knowing something about the
> > source.
>
> Inserting floppies is considerably MORE safe than inserting CD-ROM or
> USB devices. Floppies were phasing out before the autorun nonsense was
> becoming popular.
>
> > Why have things changed? Is there something different about the way a
> > flash drive is handled by the computer as compared to a floppy.
>
> Things haven't changed. They've gotten worse in fact. And yes there's a
> difference, but it's not a good one from your point of view. Back in
> the floppy days you not only had to insert and infected floppy, you had
> to manually navigate to that floppy and run some program on it. Or
> accidentally reboot the machine with the floppy still inserted. With
> the advent of autorun/autoplay it became a simple matter of giving your
> CD tray a little push, and now, plugging in your dongle.

jim_patterson@comcast.net