Ask HN: How to avoid USB firmware attacks

[bla54321]

I'm aware of USB firmware attacks where a bad actor will leave a stray USB around with the hope of a target using it and compromising their computer.

This basically can be avoided by not plugging in a USB stick you don't own. But what precautions can one take when buying a USB device on a website like amazon?

It's not beyond the realm of possibilities that a potential attack target could be to pre-package USB devices with malicious firmware and sell or re-sell on a site like Amazon.

Is this is known attack vector, and is there anything one could do to prevent something like this?

[1970-01-01]

Use a low-level format tool: https://hddguru.com/software/HDD-LLF-Low-Level-Format-Tool/

[aborsy]

There are a lot of imaginative attacks. The problem is that, you can’t mount most of them without being detected (and arrested).

Somebody is going to find that some of the USBs are malicious and will get to the attacker through Amazon and tracing the exchange of physical goods.

The USB attack used to be used in targeted attacks.

[fallowkevin]

>The USB attack used to be used in targeted attacks.

You are on hacker news. The NSA (and others) target sysadmins.

https://www.zdnet.com/article/nsa-targets-sysadmin-personal-...

[mikequinlan]

Filling the usb slots on your computer with superglue should guarantee safety from USB firmware attacks.

[ecpottinger]

Turn off Auto-Run.

Use an OS where common commands in Windows/Linux do not work.

Use an OS that can not/will not run the virus code these USBs try to plant.