USB STICK ERASER (Security Related)  - Page 1
Forum section: electronics / projects

author: LaserSteve
author_rank: Super Contributor
timestamp: November 15, 2016, 03:36:26 pm
content: To keep students from infecting a very expensive Win 7 system that runs a very customized data acquisition system, I need a USB stick eraser. Right now I'm hand nuking sticks on a Linux machine. But I'd like a stand alone USB stick formatter/eraser. The maker of the data acquisition system uses a highly customized version of Win 7 that does not play well with Anti-Virus software. 170,000$ laser imaging microscope, but is only barely compatible with Microsoft's Security Essentials. Any virus, malware, or system update results in a 2500$ service call.So data can only be allowed to flow off the machine, no networking is allowed, and files are too big to burn DVDs. Yes, the manufacturer hacked Win 7, for pure system speed, evidently with Microsoft's aid and assistance.Any ideas on where to get a stand alone formatter board without spending a week writing code? I'd like plug and play.Steve

author: CJay
author_rank: Super Contributor
timestamp: November 15, 2016, 03:43:00 pm
content: I've always found this to be an effective data eraser, it tends to stick in people's minds.http://1.bp.blogspot.com/-dGcFboCoOI0/Tx3FVSNebII/AAAAAAAAAEE/Mc8iRwqGBM0/s1600/anvil.jpgOr, if they get pissy about having to buy new sticks every time, perhaps this:https://www.startech.com/uk/HDD/Duplicators/USB-1-to-2-Standalone-Flash-Drive-Duplicator-Eraser~USBDUP12

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: November 15, 2016, 03:51:35 pm
content: As an aside, have you imaged the system?

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 15, 2016, 04:20:11 pm
content: How about (full size) SD cards set read write in that machine and read only anywhere else?

author: LaserSteve
author_rank: Super Contributor
timestamp: November 15, 2016, 04:25:39 pm
content: Yes, I imaged the system. However they have some clever low level tools and hardware that "brick" the machine if drives are tampered with.First time it crashed from a drive error, I tried restoring it myself. I restored the system to a identical drive from the campus surplus service , and that was a good thing, if I had reformatted the D partition, it would have crashed hard and required an even more expensive restoration. I got a week of operations and data recovery before it decided it was tampered with, and turned into a big paperweight. That resulted in service call number one. There is no SD card slot on the customized (Custom BIOS probably) motherboard.I got offered a possible job for my efforts, evidently I made it pretty far into the restore system, which was not intended to be done by mere users.I like the Startech widget.Steve

author: Kalvin
author_rank: Super Contributor
timestamp: November 15, 2016, 04:35:26 pm
content: I am not sure how to do this in practice, but it might be possible to use a raspberry pi or a similar gadget as a proxy which will reflect the Windows 7 machine's drive / folder to the USB memory stick: With a push of a button, the gadget will copy the Windows 7 machine's folder into the USB memory stick.

author: C
author_rank: Super Contributor
timestamp: November 15, 2016, 04:48:06 pm
content: With a separate USB stick eraser, how do you guarantee that only erased USB sticks are connected to your win7 machine?I think I would look again at a network cure, a network of just two computers. The second computer could insure that data can not flow from USB stick to the win7 machine.The win7 machine could see a network drive or iscsi drive that is newly formated each time.A linux computer as second computer could then copy the files from drive location the the win7 computer sees to USB Stick.Note that you could use two separate Linux systems on this computer, one for win7 drive and second for copy to USB. Just connecting a USB stick could shutdown the network connection to win7.You could go a step further and kill power to one of two USB Hubs. One Hub for Usb network adapter to win7 and one Hub for USB Stick.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: November 15, 2016, 04:55:55 pm
content: Quote from: LaserSteve on November 15, 2016, 04:25:39 pmIf it lasted a week it sounds like they're calling home to check hardware IDs periodically. Perhaps a rootkit. Nice business practices there!

author: CJay
author_rank: Super Contributor
timestamp: November 15, 2016, 04:59:48 pm
content: But 'no networking allowed' might it's not able to call home.I'd be curious to see if it would support a USB SD card interface and then try one of those SD WiFi cards to a standalone Linux box but I'm not paying the $2500 service call charges so, I think the OP's call for a USB eraser is a pretty good solution as long as it can be guaranteed that only erased drives are used.

author: RGB255_0_0
author_rank: Frequent Contributor
timestamp: November 15, 2016, 05:03:42 pm
content: Quote from: CJay on November 15, 2016, 04:59:48 pmGood point. Still doesn't mean there isn't some kind of hardware checking "spyware" on the machine.

author: LaserSteve
author_rank: Super Contributor
timestamp: November 15, 2016, 05:11:44 pm
content: After just one such 2500$ ouch, the Ethernet port in the dedicated room is now plugged with chewing gum for a reason.When the previous operator moved on, I was not informed of all little quirks. I was made aware of them during the service call.When I checked the logs, only two things ever tried to phone home. One Windows Update function, and Intel's mysterious "Management Engine" has tried to phone home every two weeks, to no avail. The Windows Update unpleasantness is of course turned off in the menu, for all that is worth.In the past, a previous student did try to establish Ethernet networking and push off data, but that was two years ago, according to the log.My supervisor just approved funds for the StarTech, so thanks, CJAY...I'm personally curious if any other ideas surface, and "diskpart.exe" is a command line function that evidently allows Windows to set up SD card security as needed. I'm not admin on the machine in question, so DiskPart is not available to me. If it were, we would have went SD "READ ONLY" in a heartbeat.As for C's question, I have a key and access is scheduled on a calendar. We still have humans in the loop. However my supervisor would make short work of any disobedient graduate student and bill their PI for the next service call. A 2500$ fine for disobedience seems to work well. Of course there are improved fools being created all the time.Two passwords for access, one on the Windows machine and one in the actual software, with the keys stored (evidently) in deep EEPROM in the system.SteveSteve

author: Fungus
author_rank: Super Contributor
timestamp: November 15, 2016, 05:18:04 pm
content: a) Share a single folder from the PC on the network, read-only. Copy the data files there.b) Connect a Raspberry Pi to the PC using a network cable.c) Use the Pi to copy to files onto USB sticks from the shared folder. Use a Pi distribution of something designed for simplicity/security, eg. FreeBSD.It'sveryunlikely you'll ever see a stick try to infectthat.or,d) Forget the cable, use the RPi to format all sticks before they're allowed in the room.

author: CJay
author_rank: Super Contributor
timestamp: November 15, 2016, 05:26:40 pm
content: Good point. Still doesn't mean there isn't some kind of hardware checking "spyware" on the machine.Oh definitely, it's protecting itself somehow but that's not an unusual thing, there are plenty of copy protection systems out there that lock software to a particular piece of hardware, they're not necessarily spying, just checking for the presence (or lack) of some unique hardware identifier periodically, 'specially when it's a high value system.I think a NAS machine configured with two network cards, no routing between them, NTFS permissions set to make the share on the NAS machine read only for anything other than the machine collecting the data from the instrument could be workable.That way there's only one way data flow from the expensive box to the sacrificial machine.ButI'd want to experiment *lots* before connecting anything to the big expensive box.

author: Kalvin
author_rank: Super Contributor
timestamp: November 15, 2016, 05:32:18 pm
content: Allow to use only one specific USB stick you provide. Use that stick to copy the data from the Windows machine. Attach the stick to Raspebrry Pi, attach the user stick to another raspberry pi's USB port. Copy the data from your stick to the user's USB stick.

author: Fungus
author_rank: Super Contributor
timestamp: November 15, 2016, 05:51:56 pm
content: Quote from: Kalvin on November 15, 2016, 05:32:18 pmAdd a KVM switch (keyboard/video/mouse) to switch between the two RPis and I think that would be about as secure as it gets.(be sure to low-level format the stick on a Pi before you connect it to the PC - USB sticks have been known to be infected at the factory)

author: Kalvin
author_rank: Super Contributor
timestamp: November 15, 2016, 05:54:44 pm
content: Quote from: Fungus on November 15, 2016, 05:51:56 pmActually I thought of using only one raspberry pi and the USB sticks would be plugged into its two USB ports.

author: Kalvin
author_rank: Super Contributor
timestamp: November 15, 2016, 05:59:10 pm
content: Well, using two raspberries could be useful, too.1. Use your own "Golden" USB stick to copy the data from the windows machine into the Golden USB stick.2. Stick the Golden USB stick into the "Golden" raspberry pi.3. Stick the user's dirty USB stick into the "dirty" raspberry pi.4. Copy the data from the Golden raspberry's Golden USB stick to Dirty raspberry's Dirty stick.Use a Wifi to create a wireless network between the two raspberries.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 15, 2016, 06:15:08 pm
content: You could use that eraser as part of a completely hardware solution -You have one exposed USB socket.Initially this is connected to the eraser, via some switching logic ( maybe a relay).This is sequenced so that any newly inserted USB stick is first erased by the eraser, and then an "erase done" signal extracted from the eraser which is used to then connect the USB stick to the PC. Removing the stick resets this process, so the PC can only ever be connected to the socket after an erase cycle.Simple and potentially fairly idiot proof.

author: C
author_rank: Super Contributor
timestamp: November 15, 2016, 06:16:11 pm
content: For security only safe network is hard wire.Here only two computers on network, the win7 & second computer with no way to connect to more.This is still a greater security risk I think then what is exposed via USB Stick interface.WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).A second network card in a computer is also a huge risk as it takes little to enable relay between two network cards..If the USB stick eraser or USB stick copier gets hacked you have a problem.

author: Kalvin
author_rank: Super Contributor
timestamp: November 15, 2016, 06:27:08 pm
content: Quote from: C on November 15, 2016, 06:16:11 pmThis is interesting. I haven't heard that this happens with a properly configured Wifi network and devices. How can you hijack a device which doesn't allow logins from the Wifi interface? How do you hack into an encrypted Wifi connection (let's forget the weak WEP and WPA encryption)?

author: lwatts666
author_rank: Unknown
timestamp: November 15, 2016, 09:28:35 pm
content: I once saw a system where an application running on a computer within a security bunker broadcast data via UDP over an ethernet fibre optic link to a second computer outside the bunker. Since UDP does not require any ACK's, the return fibre was physically removed, ensuring that data could only pass one way. Data was repeated several times, so if a data packet did get a checksum error, the outside app just waited for it to be repeated. Probability of repeated errors on the same packet over a few metres of FO cable is very small.

author: C
author_rank: Super Contributor
timestamp: November 16, 2016, 12:01:26 am
content: Quote from: Kalvin on November 15, 2016, 06:27:08 pmYou are asking the question in the wrong direction.How do you get to an encrypted connection and then maintain the connection.To get encrypted, you have to send some information UN-encrypted or with a predetermined encrypted starting point that both ends of the connection know.How do you know that the radio that sent the data is the proper WIFI radio.The more information you can collect, the better chance to get in. WIFI has all information on radio waves that can be tapped with no knowledge of the WIFI network. The network with more nodes is a greater information source.The thing to think on is at one time WEP and WPA was a properly configured Wifi network. How long did the hole exist before it was closed?How long will the current holes exist before they are known?

author: timb
author_rank: Super Contributor
timestamp: November 16, 2016, 12:33:32 am
content: Here's what I'd do:1) Hook a Raspberry Pi to the Windows machine via a direct Ethernet connection.2) Install "Virtual USB" software on both the Pi and Windows box.3) Setup dev rules on the Pi to only enumerate Mass Storage Class devices.4) Write a simple script that immediately reformats (with FAT32) the newly plugged in drive.5) Allow the Virtual USB software to take control of and share the MSC device with Windows over the Ethernet link.Basically the Pi will format any flash drive plugged in, before sharing it with the Windows box over a direct (machine to machine) Ethernet link. This Virtual USB software actually forwards raw USB packets over TCP/IP, so to the Windows machine it will look like a normal flash drive plugged in via USB. Just setup a static IP on the Pi and Windows systems to keep it simple.

author: timb
author_rank: Super Contributor
timestamp: November 16, 2016, 12:41:22 am
content: Quote from: blueskull on November 16, 2016, 12:36:27 amI've had very good luck withVirtualHere, which is only $39/$49. They have server software for tons of architectures and client software for Mac/Win/Linux, which I might add doesn't require complex installation or anything (it's basically portable).Edit: VirtualHere is free if you only need to share a single device. 3 devices costs $39 and it's $50 for unlimited.

author: Kalvin
author_rank: Super Contributor
timestamp: November 16, 2016, 09:19:52 am
content: Quote from: C on November 16, 2016, 12:01:26 amYes, there are possibilities for a unknown security hole. Using WPA2-PSK (AES) is the best practical solution for simple networks. For more paranoid persons, a wired point-to-point, direct ethernet network is one solution.The user lwatts666 brought up a nice example of increased security so that the data can only travel from one device to another. The wired ethernet can be used in that way, too. Just use the TX-pair from the sender and send the data using UDP, and send it multiple times and add sufficient redundancy for missed packets.An optical solution would be to use an IR/laser transmitter and IR/light receiver, and sending the data over some distance. It won't stop eavesdropping, but sending the data encrypted and using other secure digital measures, the system will be very secure.Using two separate raspeberries (or similar gadgets) make things a bit more secure as the golden raspberry is only used with the golden USB stick, and the dirty raspberry is only used with the possible dirty USB sticks. If a malicious user inserts a infected USB stick the Linux and BSD-based devices will not be infected as they can be configured so that nothing will be executed from the stick. The data will be moving only from the golden device to the dirty device. If the malicious user inserts an USB stick destroying the USB port, replacing a cheap raspberry is not a problem.Running the raspberry pi from a initramsfs and making the system disk read-only by the hardware, nothing will ever be written to its system disk, so resetting the system after each operation will wipe out any history. If you really want to be sure.Edit: The golden USB stick and the USB-ports of the Windows7 machine and the golden gadget could possibly be modified so that only the golden USB-stick will fit into the USB-slots. This would prevent using any other USB-sticks by accident.

author: Kalvin
author_rank: Super Contributor
timestamp: November 16, 2016, 09:50:42 am
content: If the OP could relax "no network allowed" restriction, things will become quite easy. I will push the two raspberry pi (or similar gadgets) solution a bit more.- Wire the Windows 7 machine and the golden raspberry together using a point-to-point Ethernet cable. No data will be leaked outside nor any data will enter the system from outside. No routers, no hubs, no bridges, only an Ethernet cable. Only the Windows and the trusted, golden raspberry will communicate together.- Configure the golden raspberry pi as a network shared disk.- Configure the windows system to store all data to golden raspberry's network shared disk.- The user will attach the dirty USB sticks in the dirty raspberry pi.- The golden raspberry pi will perform secure connection to the dirty raspberry and copy the data to the dirty raspberry pi.- The connection between the golden and the dirty raspberry can take place using a Wifi, optical connection, or any other connection which is suitable.- Make it physically impossible to access the golden raspberry so it cannot be tampered with. Hide it inside the windows machine or something like that.- See my previous post about the initramfs.- Now the users will only interact the dirty raspberry pi, which can be made pretty secure and can be even rebooted after each transaction.

author: Jeroen3
author_rank: Super Contributor
timestamp: November 16, 2016, 10:21:26 am
content: Make a metal box same size as 5.25" bay with one USB A Female plug on the front, and one USB header cable. (to fit to front panel cable)Inside you fit a USB capable micro. Eg: mbed compatible, it has all the usb host libs.Also:- HD3SS6126 USB switch or something alike.-Beyond normal scope beefy surge protection or fuses.- Some software on the micro mounting the USB drive and rewriting it's partition table and thus creating an empty stick.- Then you unmount and switch the stick over to the cable to the protected PC.Could be a great student project perhaps. Maybe there is even a market.Don't forget the sticker: "all drives are nuked before mount".Doing this with SD cards might be easier.

author: MosherIV
author_rank: Super Contributor
timestamp: November 16, 2016, 10:31:57 am
content: QuoteAn alternate solution to your problem is to disable/cripple the USB memory device in Windows.I do not know how to do this - just a suggestion.(FYI - it is possible, I do not know what GE corporate did but my machine at work refuses to allow access to USB memory sticks when I plug them into my work PC. They show up as USB device but drive does not appear)

author: Kalvin
author_rank: Super Contributor
timestamp: November 16, 2016, 10:41:27 am
content: Modified suggestion by Jaroen3 "NukeBox":- Take a metal box with a slot for a USB memory stick.- Insert a raspberry pi inside the metal box.- Take two DPDT signal-relays.- Wire the relays so that the common contacts are connected to the USB stick connector where the user inserts the USB stick.- Wire the normally closed contacts to raspberry pi's USB connector.- Wire the normally open contacts to windows machine's USB connector.- Make a switch which will detect whether the user has placed the USB key into the slot.- Place a push button to front of the box which will notify the raspberry pi and start the erase procedure.- When the erase procedure is completed the raspberry pi will toggle the relay connecting it to windows machine.- Now the user can copy the files from the windows machine into the freshly erased USB stick.- If the user removes the USB-stick at any time, the relays will be powered off, the USB stick will be disconnected from the windows machine, raspberry pi will get a notification, and the USB-slot will be connected to raspberry pi when the next user inserts the USB stick into the NukeBox.

author: Jeroen3
author_rank: Super Contributor
timestamp: November 16, 2016, 10:41:48 am
content: Quote from: MosherIV on November 16, 2016, 10:31:57 amI guess DISKPART> automount disable

author: @rt
author_rank: Super Contributor
timestamp: November 16, 2016, 12:51:58 pm
content: That’s a $10 project, and a Pi is 1000x overkill.Micros have SD Card/USB filesystem libraries, and the resource to detect, erase, rewrite the memory with trash if you like, and format again.

author: Kalvin
author_rank: Super Contributor
timestamp: November 16, 2016, 01:30:06 pm
content: Quote from: @rt on November 16, 2016, 12:51:58 pmSure. The raspberry pi can be purchased with $35, add $10 for the USB power supply, add $5 for a sd-memory card. Download the pre-built binary, configure the damn device and add few scripts detecting a push button and controlling the relays. Add a fet to drive the relay That will take a few hours of work while you are still trying to get the tools installed (do you need an external debugger-device for that) and get your hello world compiled. After that you will spend a pretty long hours getting everything done right. Sure you can do it. But 1000x overkill comparing the time and effort spent in your solution - no way.

author: CJay
author_rank: Super Contributor
timestamp: November 16, 2016, 02:18:02 pm
content: Quote from: MosherIV on November 16, 2016, 10:31:57 amIt's an easy change in the registry and/or group policy to prevent access to USB removeable storage, there's also software out there which can be configured to perform certain actions from benign pop up boxes to locking down the whole machine and requiring IT to manually intervene.

author: LaserSteve
author_rank: Super Contributor
timestamp: November 16, 2016, 06:09:44 pm
content: In case anyone ever needs this again. I learned a few new things:Keywords: One way FTP, Data Diode . One way UDP , unidirectional media converter. Owl Computing.see:https://www.decalage.info/python/blindftphttp://www.bb-elec.com/Products/Ethernet-Media-Converters/IMC-Networks-Unmanaged-Ethernet-Media-Converters/RX-TX-One-Way-Secure-Media-Converters.aspxSteve

author: rainsee
author_rank: Newbie
timestamp: November 17, 2016, 09:38:52 am
content: For security only safe network is hard wire.Here only two computers on network, the win7 & second computer with no way to connect to more.This is still a greater security risk I think then what is exposed via USB Stick interface.WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).A second network card in a computer is also a huge risk as it takes little to enable relay between two network cards..

author: Zero999
author_rank: Super Contributor
timestamp: November 17, 2016, 11:18:41 am
content: Quote from: LaserSteve on November 15, 2016, 04:25:39 pmI hate products with this kind of crap which would be a deal breaker for me, when looking to purchase it in the first place.Quote from: C on November 15, 2016, 06:16:11 pmI would hope that the PC in question doesn't have WIFI for that very reason and if it does, it should be disabled preferably by physically removing it.Quote from: LaserSteve on November 16, 2016, 06:09:44 pmThat looks like an interesting solution.

author: LaserSteve
author_rank: Super Contributor
timestamp: November 17, 2016, 09:36:34 pm
content: Quote "I hate products with this kind of crap which would be a deal breaker for me, when looking to purchase it in the first place."In the academic world, our purchasing decision is usually driven by other factors, and we have to live with the weird stuff. In most cases we never get a chance to evaluate for this kind of annoyance. In this case, what the machine does actually makes living with the security precautions tolerable.Steve

author: Delta
author_rank: Super Contributor
timestamp: November 17, 2016, 10:55:00 pm
content: K.I.S.S.A UART link to a second computer (maybe a RasPi). Unidirectional if needs be.I'd like to see anything infect over THAT!

author: amspire
author_rank: Super Contributor
timestamp: November 17, 2016, 11:28:51 pm
content: Quote from: LaserSteve on November 15, 2016, 03:36:26 pmGiven the delicacy of your Windows 7 system, I would probably run it as a VM under Virtualbox/VMWare/KVM etc.This way you can take snapshots of the Windows 7 and at anytime, restore to an older snapshot.When I am paranoid about infections, I often just put data on an ISO file and mount it as a DVD drive to move data to a VM. The VM can also have a shared data folder on the host. As long as the the VM+shapshots is regularly backed up, then even if the host gets an infection from USB stick, at least you can do a perfect restore as far as the guest Windows 7 is concerned.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: November 18, 2016, 12:56:14 am
content: Quote from: Delta on November 17, 2016, 10:55:00 pmQuoteMight take a while....

author: Delta
author_rank: Super Contributor
timestamp: November 18, 2016, 01:11:42 am
content: Quote from: mikeselectricstuff on November 18, 2016, 12:56:14 amYou can't rush security.... or somesuch...

author: AlxDroidDev
author_rank: Frequent Contributor
timestamp: November 18, 2016, 01:12:42 am
content: I haven't read every single answer to the OP, so please forgive if this has been suggested already.I don't see the need for an external device that will reformat the usb flash drive. All this can be done from within Windows.1) First make sure that Autoplay and Autorun are disabled on Windows, so if by chance there are any virus in the usb stick, it won't run.2) Create a small Win32 program (using Delphi, C++ Builder, C#, VB or whatever) that will receive a WM_DEVICECHANGE message whenever a USB stick is plugged in. Telling if the device is a USB stick or not is as simple as detecting if the device that's been changed has just been plugged in and is removable.3) What happens when the program receives that message can either be handled by the program itself (you'll have to code it) or it can then invoke a .BAT or .CMD script that will erase partitions and perform a quick format using whatever filesystem you wish. Since you mentioned that the files are too large to fit in a DVD, then FAT32 may not be enough, so I suggest exFAT.4) All this can happen without any user interaction, and the program developed in step #2 above can either be created as a service or as a system tray program. In both cases it will be running all the time. The advantage of writing it as a service is that it might required administrator privileges to stop it.Keep in mind that using NTFS on flash drives drastically reduces its life span, because it does a lot more writing than desired, because of journaling and other NTFS features that are irrelevant on a flash drive. That is why I only use exFAT on them: it is faster and allows for huge files.I thing that using an external device for this simple task is a huge waste of time and money, since it can be handled by software with a lot less effort, and the program I suggested above is quite simple to develop (I could possibly do it in a couple of hours in Delphi).

author: Rachie5272
author_rank: Regular Contributor
timestamp: November 18, 2016, 06:25:33 am
content: How about using a one way transfer protocol over CAT5? Snip one pair of wires in a standard patch cable, and it will only be able to send data. No expensive hardware required.

author: @rt
author_rank: Super Contributor
timestamp: November 20, 2016, 05:31:05 am
content: That depends what you’re proficient with. For me, the pi thing would take longer.Format would be an example in any memory disk sample code.Besides for security, you could, at any time, decide to ignore the filesystem and just write gibberish to sectorsprior to the last filesystem format function.This is assuming the Pi talks SPI to the SD Card. If the Pi uses the high speed SD interface it would be faster,but still there are cheap SD controllers for that.The main appeal to me for the streamline solution would be the end result of simply inserting the card and removing it when the LED turns off.Quote from: Kalvin on November 16, 2016, 01:30:06 pm