安川伺服驱动器usb驱动_不受信任的USB驱动器有哪些危害？

安川伺服驱动器usb驱动

Using trusted USB drives that you own on your up-to-date, well-secured operating system is one thing, but what if your best friend stops by with their USB drive and wants you to copy some files to it? Does your friend’s USB drive pose any risks to your well-secured system, or is it just baseless fear?

使用您在最新的，安全性高的操作系统上拥有的受信任的USB驱动器是一回事，但是如果最好的朋友停下来使用他们的USB驱动器并希望您向其中复制一些文件怎么办？ 您朋友的USB驱动器会对安全可靠的系统造成任何风险，还是只是毫无根据的恐惧？

Today’s Question & Answer session comes to us courtesy of SuperUser—a subdivision of Stack Exchange, a community-driven grouping of Q&A web sites.

今天的“问答”环节由SuperUser提供，它是Stack Exchange的一个分支，该社区是由社区驱动的Q＆A网站分组。

Image courtesy of Wikimedia Commons.

图片由Wikimedia Commons提供 。

问题 (The Question)

SuperUser reader E M wants to know what the dangers of an untrusted USB drive could be:

超级用户读取器EM想要了解不受信任的USB驱动器可能带来的危险：

Suppose someone wants me to copy some files to their USB drive. I’m running fully-patched Windows 7 x64 with AutoRun disabled (via Group Policy). I insert the USB drive, open it in Windows Explorer, and copy some files to it. I do not run or view any of the existing files. What bad things could happen if I do this?

假设有人要我将一些文件复制到他们的USB驱动器。 我正在运行禁用自动运行(通过组策略)的完整修补程序的Windows 7 x64。 我插入USB驱动器，在Windows资源管理器中将其打开，然后将一些文件复制到其中。 我没有运行或查看任何现有文件。 如果我这样做会发生什么不好的事情？

What about if I do this in Linux (say, Ubuntu)? Please note that I’m looking for details of specific risks (if any), not “it would be safer if you don’t do this”.

如果我在Linux(例如Ubuntu)上执行此操作怎么办？ 请注意，我在寻找特定风险的详细信息(如果有)，而不是“如果不这样做会更安全”。

If you have a system that is up to date and well-secured, are there any risks from an untrusted USB drive if you only plug it in and copy files to it, but do nothing else?

如果您的系统是最新且安全可靠的系统，那么如果仅插入USB复制驱动器并将其复制到文件，而没有其他操作，则不受信任的USB驱动器会有任何风险吗？

答案 (The Answer)

SuperUser contributors sylvainulg, steve, and Zan Lynx have the answer for us. First up, sylvainulg:

超级用户贡献者sylvainulg，steve和Zan Lynx为我们找到了答案。 首先，sylvainulg：

Less impressively, your GUI file browser will typically explore files to create thumbnails. Any pdf-based, ttf-based, (insert Turing-capable file type here)-based exploit that works on your system could potentially be launched passively by dropping the file and waiting for it to be scanned by the thumbnail renderer. Most of the exploits I know about are for Windows though, but do not underestimate the updates for libjpeg.

不太令人印象深刻的是，您的GUI文件浏览器通常会浏览文件以创建缩略图。 在您的系统上运行的任何基于pdf，基于ttf(在此处插入具有Turing功能的文件类型)的漏洞都有可能通过拖放文件并等待缩略图渲染器对其进行扫描而被动启动。 我知道的大多数漏洞利用都是针对Windows的，但不要小看libjpeg的更新。

Followed by steve:

随后是史蒂夫：

There are several security packages that allow me to set up an AutoRun script for either Linux OR Windows, automatically executing my malware as soon as you plug it in. It is best not to plug in devices that you do not trust!

有几个安全软件包可让我为Linux或Windows设置自动运行脚本，并在插入后自动执行我的恶意软件。最好不要插入您不信任的设备！

Bear in mind, I can attach malicious software to pretty much any sort of executable that I want, and for pretty much any OS. With AutoRun disabled you SHOULD be safe, but AGAIN, I don’t trust devices that I am even the slightest bit skeptical about.

请记住，我可以将恶意软件附加到所需的几乎所有类型的可执行文件，以及几乎所有操作系统上。 禁用自动运行后，您应该是安全的，但同样，我也不相信我对此稍有怀疑的设备。

For an example of what can do this, check out The Social-Engineer Toolkit (SET).

有关如何执行此操作的示例，请查看The Social-Engineer Toolkit(SET) 。

The ONLY way to truly be safe is to boot up a live Linux distribution with your hard drive unplugged, mount the USB drive, and take a look. Other than that, you’re rolling the dice.

真正安全的唯一方法是在拔下硬盘的情况下启动实时Linux发行版，安装USB驱动器，然后进行查看。 除此之外，您还可以掷骰子。

As suggested by others, it is a must that you disable networking. It doesn’t help if your hard drive is safe and your whole network gets compromised.

正如其他人所建议的，必须禁用网络。 如果您的硬盘驱动器是安全的，并且整个网络都受到威胁，则无济于事。

And our final answer from Zan Lynx:

我们对Zan Lynx的最终回答是：

Another danger is that Linux will try to mount anything (joke suppressed here).

另一个危险是Linux会尝试挂载任何东西(在这里取消了笑话) 。

Some of the file system drivers are not bug free. Which means that a hacker could potentially find a bug in, say, squashfs, minix, befs, cramfs, or udf. Then the hacker could create a file system that exploits the bug to take over a Linux kernel and put that on a USB drive.

一些文件系统驱动程序不是没有错误的。 这意味着黑客可能会在squashfs，minix，befs，cramfs或udf中发现错误。 然后，黑客可以创建一个文件系统，利用该错误来接管Linux内核并将其放入USB驱动器。

This could theoretically happen to Windows as well. A bug in the FAT, NTFS, CDFS, or UDF driver could open up Windows to a takeover.

从理论上讲，这也可能发生在Windows上。 FAT，NTFS，CDFS或UDF驱动程序中的错误可能会打开Windows进行接管。

As you can see from the answers above, there is always a possibility of risk to your system’s security, but it will depend on who (or what) has had access to the USB drive in question.

从上面的答案中可以看出，总是存在系统安全风险的风险，但这取决于谁(或什么)可以访问所讨论的USB驱动器。

---

---

Have something to add to the explanation? Sound off in the comments. Want to read more answers from other tech-savvy Stack Exchange users? Check out the full discussion thread here.

有什么补充说明吗？ 在评论中听起来不错。 是否想从其他精通Stack Exchange的用户那里获得更多答案？ 在此处查看完整的讨论线程 。

翻译自: https://www.howtogeek.com/181743/what-are-the-dangers-of-an-untrusted-usb-drive/

安川伺服驱动器usb驱动