Hacker News Reader

Comment by a3n | Hacker News Reader

"I bought a new computer that has never been connected to the internet. If I want to transfer a file, I encrypt the file on the secure computer and walk it over to my internet computer, using a USB stick."

Wasn't this one transfer mechanism for stuxnet? Once a computer is infected, you have to at least suspect that anything that touches it directly or indirectly is infected. It's like an STD.

View on HN

Format the thumb drive before mounting it on the airgapped computer. It is cheaper than using CDs.

It looks like you can DVDs in bulk for between 20c and 10c per disc. If you're really serious about protecting your airgapped computer, this is a very reasonable price to pay.

Sure, so is using a rewriteable DVD, but neither is much more secure than formatting thumb drives before mounting them. Convenience is the only argument, and it is not all that hard to set things up so that you always format thumb drives that are plugged in.

A thumb drive is, or can be, a tiny computer that can lie about its contents depending on what's asking. I don't see a particular exploit in Schneier's case, but a thumb drive could be made that behaved differently depending on whether a Mac or Windows PC was trying to talk to it.

APT in a flash drive is just a cute trick. Just because you wrote zeros over it doesn't mean that the APT thumb drive firmware won't give you a trojan next time you read a the right kind of file off of it.

Or maybe it waits a week before it starts injecting binary, just to wait out your test and validation procedures...

You could use a computer that doesn't try to run arbitrary programs from the USB stick for a start.

stuxnet used Autorun. Disbaling Autorun on the clean computer would be smart.

Reply on news.ycombinator.com