Gone in a flash
October 25th, 2007
I’ve been happily using 4GB USB 2.0 flash drives for a while now, transferring data between machines at various locations, and using them as temporary backup devices. For some reason I’d come to the conclusion that 4GB was going to be it for these small memory sticks, and that if you needed more than 4GB you would have to invest in an external hard drive.
How wrong was I? Integral have announced their 32GB flash drive. 32GBs! That’s more than my 4-year old laptop has as a hard drive. I could backup my whole laptop onto something the size of a key fob! There’s even talk about 64GB flash drives becoming available shortly.
Having the ability to carry so much data around with you may be convenient, but from a security point of view it also means that there’s even more of your data at risk of being stolen. Or these devices could be employed to do the actual stealing. The complete contents of a target computer’s hard drive could be copied onto a device that fits into the palm of your hand.
Several companies are already updating their security policies to state that flash drives are not allowed on the premises. It’s one thing to say they are not allowed, it’s another to police it. As the world goes USB mad, it’s possible to purchase USB flash drives in a variety of form factors. So instead of having to look for the obvious ‘pen drive’ form factor, you have to wonder if that fuzzy bee keychain on that girls handbag is what it appears to be, or a USB flash device in disguise.
Somebody even figured out that the width of a USB connector is smaller than the diameter of an AA battery, so they built a battery that can recharge from a USB port. How long before someone builds a USB flash drive that looks like a battery? You could sneak it into places disguised as a battery in a portable radio.
October 29th, 2007 at 12:56 pm
Surely the risk that usb drives pose is only as prevelant as the installation of the standard usb storage driver on most operating systems. All you need to do is remove the standard driver, and ensure that your users don’t have the rights to reinstall it.