Read only USB stick trick

Published: 2011-03-22
Last Updated: 2011-03-22 10:13:50 UTC
by Chris Mohan (Version: 1)
20 comment(s)

The sad demise of readily available, cheap USB sticks with a switch to flip the device to be read only has caused some problems when dealing with suspicious machines, especial when I’m off duty and I hear the dreaded words “Oow, you’re in IT – could you have a look at my computer quickly?”

Back in the good old days, I could pick them up at nearly all my favourite shops and the vendors gave them away by the bucket load, but alas, they seem to have all but disappeared.

CD/DVD or Blu-ray disks are great, but lugging around a harden CD case really does clash with some of my outfits and doesn’t always send out the right message, particularly at: romantic diners, standing at a checkouts or trying to order drinks at a bar. This is where a small USB key, fitting neatly in to a pocket, helps me blend in with the rest of humanly almost seamlessly.  Almost. 

The standard read/write USB keys fall prey to being infected and compromised the very second they are insert in to a machine, which, as we know is a bad thing.

Stuck with this dilemma, I stumbled upon a neat solution – Secure Digital (SD) Memory Cards.
 
SD Memory cards have a small lock switch on them, making them read only; they can reach up to a whooping 32GB, are only slightly more expensive than similar size USB drives and are common place (I can find them in the petrol stations, corner stores and on aeroplanes). Now add in a small SD reader, around the size of a normal USB drive, and this is perfect for incident response on an untrusted system in a pinch or when a full response kit isn’t viable.

With the size of SD memory cards, it means I can have my favourite recovery [1], incident handling and fun at -someone else’s  - party [2] boot images each on their own SD card, hidden in a wallet, jacket lapel or hat band for ease of use. Producing them, seeming out of thin air, to fix a broken or infected machine amazes and astounds plus get brownie points at unexpected moments in life.

Another option for the uncluttered, nattily dressed Incident-Handler-around-town’s toolkit.

As always, if you have any better suggestions, insights or tips please feel free to comment.

[1] BartPE - http://www.nu2.nu/pebuilder/
[2] Backtrack - http://www.backtrack-linux.org/downloads/

Chris Mohan --- Internet Storm Center Handler on Duty

20 comment(s)

Comments

SD cards only go up to 4Gb - which is enough, frankly.
SDHC support larger sizes, but aren't compatible with all but the latest readers. SD is much more common, and has been around for years and years.

A better fix may be a SD/SDHC card in an appropriate 'mini' card reader - as this gives you both compatibility and the read-only feature you're after.

Share and Enjoy,
Dom
At my work we utilise this trick as well because we needed a large swath of read only USB devices and couldn't buy any so out came the SD cards to save the day. The biggest problem we had was the USB readers didnt fit into the USB slots on the computers so had to use USB extension cables
These Kanguru USB flash drives are pretty good. They have the write lock switch. I recently bought a couple of them. http://www.amazon.com/Kanguru-Solutions-ALK-8G-8GB-Flashblu/dp/B00190IX40/ref=sr_1_3?ie=UTF8&qid=1300792232&sr=8-3
The IronKey USB drive has the ability when unencrypted to be in ReadOnly mode. So you can keep all of your tools and files secure, and then make them available ReadOnly when needed. Not cheap, but so it lost data.
I too have been using a Kanguru (32G) drive and am quite satisfied with it. We got a few of them after extensively searching for hardware write-protect drives and not finding any real alternatives (SD cards did cross my mind a time or two).
They are a little bit bulkier than most of your drives but I have never needed an extension to fit it to a USB slot. The rugged aluminum case and cap design do give me a little peace of mind as it rattles amongst my pocket change that it is not as likely to be damaged as previous drives have...

The IronKey drives do offer a great solution for protecting data on the drive from being destroyed but in this scenario do not offer the desired protection. When dealing with viruses, you need to be sure that the nasties can't be written to the drive and then on to the next computer...
I have considered using SD cards in the past, but I have always preferred my old read-only switchable flash drives. Not too long ago I ran across the write-protection specification for SD cards and decided they are a no-go. Per SDCard.org, "A proper, matched, switch on the socket side will indicate to the host that the card is write-protected or not. It is the responsibility of the host to protect the card. The position of the write protect switch is unknown to the internal circuitry of the card."

With the varied range of host equipment I run into daily, that is too vague for me to feel comfortable with a storage device/medium I use often. I'm now using an 8gb Kangaru drive and it works as advertised.
Eliminate the need for an SD card reader by getting one that has USB compatibility built-in:

http://www.amazon.com/SanDisk-Ultra-Plus-2GB-Card/dp/B000EWI8IK
I use this trick at work for my thumb drives. First I get the number of free bytes and then run this .cmd file on the usb drive. It takes a few minutes but effectively write protects the drive.

@echo off
echo "Enter Size"
set /p len=

fsutil file createnew fillup %len%
PAUSE
After grappling with a pocket full of USB drives and a case full CD's/DVD's I discovered a great little utility called SARDU http://www.sarducd.it/ that lets me build (and maintain) a custom collection of boot disks on a single high capacity USB. Since I'm booting from the USB I'm not so concerned about R/W.
@Danny - no, all that does is preclude new file creation. Edits can take place to your heart's content.

Diary Archives