USB STICK ERASER (Security Related)

[LaserSteve]

To keep students from infecting a very expensive Win 7 system that runs a very customized data acquisition system, I need a USB stick eraser.  Right now I'm hand nuking sticks on a Linux machine.  But I'd like a stand alone USB stick formatter/eraser.  The maker of the data acquisition system  uses a highly customized version of Win 7 that does not play well with Anti-Virus software.  170,000$ laser imaging  microscope, but is only barely compatible with Microsoft's Security Essentials.   Any virus, malware, or system update  results in a 2500$ service call.

So data can only be allowed to flow off the machine, no networking is allowed, and files are too big to burn DVDs.  Yes, the manufacturer hacked Win 7, for pure system speed, evidently with Microsoft's aid and assistance. 

Any ideas on where to get a stand alone formatter board without spending a week writing code?   I'd like plug and play. 

Steve



 

[CJay]

I've always found this to be an effective data eraser, it tends to stick in people's minds.

http://1.bp.blogspot.com/-dGcFboCoOI0/Tx3FVSNebII/AAAAAAAAAEE/Mc8iRwqGBM0/s1600/anvil.jpg

Or, if they get pissy about having to buy new sticks every time, perhaps this:

https://www.startech.com/uk/HDD/Duplicators/USB-1-to-2-Standalone-Flash-Drive-Duplicator-Eraser~USBDUP12

[RGB255_0_0]

As an aside, have you imaged the system?

[NiHaoMike]

How about (full size) SD cards set read write in that machine and read only anywhere else?

[LaserSteve]

Yes, I imaged the system. However they have some clever low level tools and hardware that "brick" the machine if drives are  tampered with. 
First time it crashed from a drive error, I tried restoring it myself. I restored the system to a identical drive from the campus surplus service , and that was a good thing, if I had reformatted the D partition,  it would have crashed hard and required an even more expensive restoration.   I got a week of operations and data recovery  before it decided it was tampered with, and turned into a big  paperweight.   That   resulted in service call number one.   There is no SD card slot on the customized (Custom BIOS probably)  motherboard.

I got offered a possible  job for my efforts, evidently I made it pretty far into the restore system, which was not intended to be done by mere users.

I like the Startech widget.

Steve

[Kalvin]

I am not sure how to do this in practice, but it might be possible to use a raspberry pi or a similar gadget as a proxy which will reflect the Windows 7 machine's drive / folder to the USB memory stick: With a push of a button, the gadget will copy the Windows 7 machine's folder into the USB memory stick.

[C]

With a separate USB stick eraser, how do you guarantee that only erased USB sticks are connected to your win7 machine?

I think I would look again at a network cure, a network of just two computers. The second computer could insure that data can not flow from USB stick to the win7 machine.
The win7 machine could see a network drive or iscsi drive that is newly formated each time.
A linux computer as second computer could then copy the files from drive location the the win7 computer sees to USB Stick.
Note that you could use two separate Linux systems on this computer, one for win7 drive and second for copy to USB. Just connecting a USB stick could shutdown the network connection to win7.
You could go a step further and kill power to one of two USB Hubs. One Hub for Usb network adapter to win7 and one Hub for USB Stick.

 
 

[RGB255_0_0]

Yes, I imaged the system. However they have some clever low level tools and hardware that "brick" the machine if drives are  tampered with. 
First time it crashed from a drive error, I tried restoring it myself. I restored the system to a identical drive from the campus surplus service , and that was a good thing, if I had reformatted the D partition,  it would have crashed hard and required an even more expensive restoration.   I got a week of operations and data recovery  before it decided it was tampered with, and turned into a big  paperweight.   That   resulted in service call number one.   There is no SD card slot on the customized (Custom BIOS probably)  motherboard.

I got offered a possible  job for my efforts, evidently I made it pretty far into the restore system, which was not intended to be done by mere users.

I like the Startech widget.

Steve

If it lasted a week it sounds like they're calling home to check hardware IDs periodically. Perhaps a rootkit. Nice business practices there!

[CJay]

But 'no networking allowed' might it's not able to call home.

I'd be curious to see if it would support a USB SD card interface and then try one of those SD WiFi cards to a standalone Linux box but I'm not paying the $2500 service call charges so, I think the OP's call for a USB eraser is a pretty good solution as long as it can be guaranteed that only erased drives are used.

[RGB255_0_0]

But 'no networking allowed' might it's not able to call home.

I'd be curious to see if it would support a USB SD card interface and then try one of those SD WiFi cards to a standalone Linux box but I'm not paying the $2500 service call charges so, I think the OP's call for a USB eraser is a pretty good solution as long as it can be guaranteed that only erased drives are used.

Good point. Still doesn't mean there isn't some kind of hardware checking "spyware" on the machine.

[LaserSteve]

After just one such 2500$ ouch, the Ethernet port in the dedicated room is now plugged with chewing gum for a reason.
When the previous operator moved on, I was not informed of all little quirks.  I was made aware of them during the service call.

When I checked the logs, only two things ever tried to phone home.   One Windows Update   function, and Intel's mysterious "Management Engine" has tried to phone home every two weeks, to no avail.  The Windows Update unpleasantness  is of course turned off in the menu, for all that is worth.

In the past, a previous student did try to establish Ethernet networking and push off data, but that was two years ago, according to the log.

My supervisor just approved funds for the StarTech, so thanks, CJAY...

I'm personally curious if any other ideas surface, and "diskpart.exe" is a command line function that evidently allows Windows to set up SD card security as needed.  I'm not admin on the machine in question, so DiskPart is not available to me. If it were, we would have went SD "READ ONLY"  in a heartbeat. 

As for C's question, I have a key and access is scheduled on a calendar.  We still have humans in the loop.  However my supervisor would make short work of any disobedient graduate student and bill their PI for the next service call. A 2500$ fine for disobedience seems to work well.  Of course there are improved  fools being created all the time.
Two passwords for access, one on the Windows  machine and one in the actual software, with the keys stored (evidently) in deep EEPROM in the system. 

Steve
 

Steve

[Fungus]

a) Share a single folder from the PC on the network, read-only. Copy the data files there.

b) Connect a Raspberry Pi to the PC using a network cable.

c) Use the Pi to copy to files onto USB sticks from the shared folder. Use a Pi distribution of something designed for simplicity/security, eg. FreeBSD.

It's very unlikely you'll ever see a stick try to infect that.

or,

d) Forget the cable, use the RPi to format all sticks before they're allowed in the room.

[CJay]

Good point. Still doesn't mean there isn't some kind of hardware checking "spyware" on the machine.
[/quote]

Oh definitely, it's protecting itself somehow but that's not an unusual thing, there are plenty of copy protection systems out there that lock software to a particular piece of hardware, they're not necessarily spying, just checking for the presence (or lack) of some unique hardware identifier periodically, 'specially when it's a high value system.

I think a NAS machine configured with two network cards, no routing between them, NTFS permissions set to make the share on the NAS machine read only for anything other than the machine collecting the data from the instrument could be workable.

That way there's only one way data flow from the expensive box to the sacrificial machine.

But

I'd want to experiment *lots* before connecting anything to the big expensive box.

[Kalvin]

Allow to use only one specific USB stick you provide. Use that stick to copy the data from the Windows machine. Attach the stick to Raspebrry Pi, attach the user stick to another raspberry pi's USB port. Copy the data from your stick to the user's USB stick.

[Fungus]

Allow to use only one specific USB stick you provide. Use that stick to copy the data from the Windows machine. Attach the stick to Raspebrry Pi, attach the user stick to another raspberry pi's USB port. Copy the data from your stick to the user's USB stick.

Add a KVM switch (keyboard/video/mouse) to switch between the two RPis and I think that would be about as secure as it gets.

(be sure to low-level format the stick on a Pi before you connect it to the PC - USB sticks have been known to be infected at the factory)

[Kalvin]

Allow to use only one specific USB stick you provide. Use that stick to copy the data from the Windows machine. Attach the stick to Raspebrry Pi, attach the user stick to another raspberry pi's USB port. Copy the data from your stick to the user's USB stick.

Add a KVM switch (keyboard/video/mouse) to switch between the two RPis and I think that would be about as secure as it gets.

(be sure to low-level format the stick on a Pi before you connect it to the PC - USB sticks have been known to be infected at the factory)

Actually I thought of using only one raspberry pi and the USB sticks would be plugged into its two USB ports.

[Kalvin]

Well, using two raspberries could be useful, too.

1. Use your own "Golden" USB stick to copy the data from the windows machine into the Golden USB stick.
2. Stick the Golden USB stick into the "Golden" raspberry pi.
3. Stick the user's dirty USB stick into the "dirty" raspberry pi.
4. Copy the data from the Golden raspberry's Golden USB stick to Dirty raspberry's Dirty stick.

Use a Wifi to create a wireless network between the two raspberries.

[mikeselectricstuff]

You could use that eraser as part of a completely hardware solution -
You have one exposed USB socket.
Initially this is connected to the eraser, via some switching logic ( maybe a relay).
This is sequenced so that any newly inserted USB stick is first erased by the eraser, and then an "erase done" signal extracted from the eraser which is used to then connect the USB stick to the PC. Removing the stick resets this process, so the PC can only ever be connected to the socket after an erase cycle.
Simple and potentially fairly idiot proof.

[C]

For security only safe network is hard wire.
Here only two computers on network, the win7 & second computer with no way to connect to more.
This is still a greater security risk I think then what is exposed via USB Stick interface.
WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).
A second network card in a computer is also a huge risk as it takes little to enable relay between two network cards..

If the USB stick eraser or USB stick copier gets hacked you have a problem.
 

[Kalvin]

WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).

This is interesting. I haven't heard that this happens with a properly configured Wifi network and devices. How can you hijack a device which doesn't allow logins from the Wifi interface? How do you hack into an encrypted Wifi connection (let's forget the weak WEP and WPA encryption)?

[lwatts666]

I once saw a system where an application running on a computer within a security bunker broadcast data via UDP over an ethernet  fibre optic link to a second computer outside the bunker. Since UDP does not require any ACK's, the return fibre was physically removed, ensuring that data could only pass one way. Data was repeated several times, so if a data packet did get a checksum error, the outside app just waited for it to be repeated. Probability of repeated errors on the same packet over a few metres of FO cable is very small.

[C]

WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).

This is interesting. I haven't heard that this happens with a properly configured Wifi network and devices. How can you hijack a device which doesn't allow logins from the Wifi interface? How do you hack into an encrypted Wifi connection (let's forget the weak WEP and WPA encryption)?

You are asking the question in the wrong direction.
How do you get to an encrypted connection and then maintain the connection.
To get encrypted, you have to send some information UN-encrypted or with a predetermined encrypted starting point that both ends of the connection know.

How do you know that the radio that sent the data is the proper WIFI radio.

The more information you can collect, the better chance to get in. WIFI has all information on radio waves that can be tapped with no knowledge of the WIFI network. The network with more nodes is a greater information source.

The thing to think on is at one time WEP and WPA was a properly configured Wifi network. How long did the hole exist before it was closed?
How long will the current holes exist before they are known?

[timb]

Here's what I'd do:

1) Hook a Raspberry Pi to the Windows machine via a direct Ethernet connection.

2) Install "Virtual USB" software on both the Pi and Windows box.

3) Setup dev rules on the Pi to only enumerate Mass Storage Class devices.

4) Write a simple script that immediately reformats (with FAT32) the newly plugged in drive.

5) Allow the Virtual USB software to take control of and share the MSC device with Windows over the Ethernet link.

Basically the Pi will format any flash drive plugged in, before sharing it with the Windows box over a direct (machine to machine) Ethernet link. This Virtual USB software actually forwards raw USB packets over TCP/IP, so to the Windows machine it will look like a normal flash drive plugged in via USB. Just setup a static IP on the Pi and Windows systems to keep it simple.

[timb]

Here's what I'd do:

1) Hook a Raspberry Pi to the Windows machine via a direct Ethernet connection.

2) Install "Virtual USB" software on both the Pi and Windows box.

3) Setup dev rules on the Pi to only enumerate Mass Storage Class devices.

4) Write a simple script that immediately reformats (with FAT32) the newly plugged in drive.

5) Allow the Virtual USB software to take control of and share the MSC device with Windows over the Ethernet link.

Basically the Pi will format any flash drive plugged in, before sharing it with the Windows box over a direct (machine to machine) Ethernet link. This Virtual USB software actually forwards raw USB packets over TCP/IP, so to the Windows machine it will look like a normal flash drive plugged in via USB. Just setup a static IP on the Pi and Windows systems to keep it simple.

Starting from Linux 3.xx, USBIP no longer works with Windows client, and you need to pay for a commercial USBIP software.
My USBIP in Linux 4.40 definitely won't work with Windows clients.

I've had very good luck with VirtualHere, which is only $39/$49. They have server software for tons of architectures and client software for Mac/Win/Linux, which I might add doesn't require complex installation or anything (it's basically portable).

Edit: VirtualHere is free if you only need to share a single device. 3 devices costs $39 and it's $50 for unlimited.

[Kalvin]

WIFI is a huge risk with little control, This enables long range hidden hacking of computer(s).

This is interesting. I haven't heard that this happens with a properly configured Wifi network and devices. How can you hijack a device which doesn't allow logins from the Wifi interface? How do you hack into an encrypted Wifi connection (let's forget the weak WEP and WPA encryption)?

You are asking the question in the wrong direction.
How do you get to an encrypted connection and then maintain the connection.
To get encrypted, you have to send some information UN-encrypted or with a predetermined encrypted starting point that both ends of the connection know.

How do you know that the radio that sent the data is the proper WIFI radio.

The more information you can collect, the better chance to get in. WIFI has all information on radio waves that can be tapped with no knowledge of the WIFI network. The network with more nodes is a greater information source.

The thing to think on is at one time WEP and WPA was a properly configured Wifi network. How long did the hole exist before it was closed?
How long will the current holes exist before they are known?

Yes, there are possibilities for a unknown security hole. Using WPA2-PSK (AES) is the best practical solution for simple networks. For more paranoid persons, a wired point-to-point, direct ethernet network is one solution.

The user lwatts666 brought up a nice example of increased security so that the data can only travel from one device to another. The wired ethernet can be used in that way, too. Just use the TX-pair from the sender and send the data using UDP, and send it multiple times and add sufficient redundancy for missed packets.

An optical solution would be to use an IR/laser transmitter and IR/light receiver, and sending the data over some distance. It won't stop eavesdropping, but sending the data encrypted and using other secure digital measures, the system will be very secure.

Using two separate raspeberries (or similar gadgets) make things a bit more secure as the golden raspberry is only used with the golden USB stick, and the dirty raspberry is only used with the possible dirty USB sticks. If a malicious user inserts a infected USB stick the Linux and BSD-based devices will not be infected as they can be configured so that nothing will be executed from the stick. The data will be moving only from the golden device to the dirty device. If the malicious user inserts an USB stick destroying the USB port, replacing a cheap raspberry is not a problem.

Running the raspberry pi from a initramsfs and making the system disk read-only by the hardware, nothing will ever be written to its system disk, so resetting the system after each operation will wipe out any history. If you really want to be sure.

Edit: The golden USB stick and the USB-ports of the Windows7 machine and the golden gadget could possibly be modified so that only the golden USB-stick will fit into the USB-slots. This would prevent using any other USB-sticks by accident.