USB drives are generally used without much concern for security, but they actually present a number of serious vulnerabilities. In this first article of a two-part series on USB safety, cybersecurity expert Ben Finn explains for Reporters Without Borders (RSF) the risks and usage of USB drives and why journalists should always privilege secure ones.
USB stands for “Universal Serial Bus.” Considered “universal” as they can be connected to a multitude of different devices, USB drives are very practical for data transfer and can be easily transported. However, journalists should be aware of the risks presented by USB drives, learn the right habits to have when using them, and choose secure USB drives when possible to ensure the safety of sensitive data and sources’ information.
USB drives’ security vulnerabilities
- Theft or loss: USB drives can be easily lost, stolen, or confiscated. Without additional security, whoever comes into possession of the drive could easily access its contents.
- Autorun feature: USB drives have a feature called Autorun designed to speed up actions and file transfer by automatically installing software or running programmes on the plugged device as soon as the drive is inserted. A malware put on a USB drive can use this function and install itself on each new plugged device without the user knowing it.
- “BadUSB” threat: a device infected by malware can use the hacking technique “BadUSB” to modify the code of any connected USB drive to further spread malware. US cybersecurity firm LMG Security reported in detail on this hacking method.
- Data interception: when a USB drive connects to an infected computer, the latter can move files on and off the USB drive, which could expose a journalist’s confidential work or their sources’ information.
The basics of USB safety
- Never plug an unknown USB drive into your devices.
- Limit the number of devices each USB drive plugs into.
- Always disable the Autorun feature.
- When opening a USB drive, use a device that is not connected to the internet or any other networks. This is called creating an “air gap.”
- Scan USB drives for malware with a reliable antivirus programme.
Favour a secure USB drive with advanced security features
- Password protection: secure USB drives present either a physical keypad on the stick itself, or a digital password to key in in order to view the files contained in the device.
- Encryption: secure USB drives incorporate hardware-based encryption, preventing unauthorised use.
- Read-only mode: Read-only mode prevents data from being modified or deleted on the USB drive, but can let the user visualise the files on it.
- Remote management: certain secure USB drives can be remotely managed by administrators, allowing the admin to disable or wipe the contents of a USB drive in cases of theft or loss.
Secure USB drives are significantly more expensive than conventional ones; however, it is worth the cost for ensuring a secure transfer of sensitive information and a safe interaction with personal devices. UK tech website Techradar provides a curated list of the best secure USB drives. Diligence with USB safety and digital security is an absolute must to maintain the integrity of a journalist’s work and protect their sources and sensitive data.
Read USB safety Part 2: Protect your USB port
Written by Benjamin Finn. From Houston (USA), Benjamin has been in the IT field for a decade, during which his primary focus was the deployment of internal enterprise tools across large enterprises, including cybersecurity focused efforts. He has been engaged in training on proper security in the context of an oppressive nation-state, specifically in Myanmar. He has also been working with multiple groups in Taiwan to train them on proper security and safety measures.
