Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We have a industrial system(running on linux) with a USB port. We have the USB port only for copying certain data. Other than this we don't want the USB drive to contain any other executables or scripts.etc. As they may copy a worm/virus on to a USB device and attach the system. What are the ways to avoid this ?

Update: If its mounted with noexec option the user can't execute as you guys suggested. But to remount and change to exec, How will the user gain root permissions?

share|improve this question
2  
I assume you're looking for more than the noexec mount option? –  Cry Havok Apr 1 '13 at 16:53
    
Who are "they", in this case? People working for you, people working for those who buy this system, or some others? You could probably force noexec, but then I'll have you beat by doing /bin/bash /mount/usb/maliciousscript.sh –  Michael Kjörling Apr 1 '13 at 16:53
    
@Cry Thanks,Yes.@Michael,Thanks for the idea. These people are the ones who are buying this system. We don't want them to look into whats happening inside. So that they don't access our settings data or tweak our system. –  m4n07 Apr 1 '13 at 17:12
1  
@m4n07 then you need to do more than just stop them running programs off a USB stick... –  Cry Havok Apr 1 '13 at 17:37
1  
You probably want to go to security.stackexchange.com - what you're asking about is how to secure a system from physical attack. Lots of this will have been covered there already - but read their FAQ (security.stackexchange.com/faq) first. –  Cry Havok Apr 1 '13 at 17:44

1 Answer 1

If your system is not going to run files from the USB storage device, you do not need to worry about viruses. If you will be only writing data to the USB disk, forget about them.

If you also need to read and parse data coming from the disk, someone could try to exploit some vulnerability in your software. Care must be taken to reduce the possibilities of introducing such weaknesses (buffer overflows etc).

Pay attention to disable the "autorun" feature of your distribution if it offers such. Improbable in a minimal, embedded distribution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.