HackDig : Dig high-quality web security articles for hackers

USB cleaning device for the masses, (Thu, Oct 29th)

2015-10-29 17:35

For so long, USB keys have been a nice out-of-bandinfection vector. People like goodies and people like to plug those small pieces of plastic into their computers. Even if good solutions exists (like BitLocker- the standard solution provided by Microsoft), a lot of infrastructureare not protected against the use ofrogue USB keys for many good or obscure reasons.

There are also multiple reasons to receive USB keys: from partners, customers, contractors, vendors, etc. The best practice should be to scan any suspicious device against malicious documents but how to achieve this in a safe AND not boring way. If you propose atool thatis easy to use, you will increase your chances to have it adopted by more people!

The CIRCL (Computer Incident Response Center Luxembourg) is coming from a very small country but they are very active and renowned. They developed a tool to sanitize USB keys. Its so easy that even non-tech people can use it! The project is called CIRCLean. Its a piece of software that you install on an inexpensive Raspberry computer. You connect the suspicious device in the USB port A, a clean USB device in port B, power the box" />

What does it do? Multiple operations are performed on files, based on their MIME type. Example: Word files are converted to PDF then to HTML. Other files are renamed and prepended with a DANGEROUS_ prefix.Once sanitized (or non dangerous), files are copied to the destination USB key.The code is available on their github repository.

Xavier Mertens
ISC Handler - Freelance Security Consultant
PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.


Source: ssr;pma&51302=diyrots?lmth.yraid/ude.snas.csi

Read:3236 | Comments:0 | Tags:No Tag

“USB cleaning device for the masses, (Thu, Oct 29th)”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud