vote up 4 vote down star

As from subject. I want to see what's inside. I am seriously interested in finding the owner if possible and returning them, but I am worried it could be an attempt at social engineering. I own a macbook intel with OSX 10.6. It is a very important install.

What would you do in my situation if you want to see the content without risks ? Any proposal welcome.

Edit: I decided not to plug them in, and I brought them to the hotel reception. They will forward it to the police.

flag
35% accept rate
Of course, you don't know for sure it's a drive to start with. Even if the casing tells you it's a drive, it could be just any kind of device. – Arjan van Bentem Oct 31 at 12:18
what's a drive? I always called them like this. – Stefano Borini Oct 31 at 12:34
He means that while it looks like a USB stick (or usb drive, usb key, usb dongle, memory stick, memory key, file tube (no, really), or one of any other hundreds of possible names because it wasn't standardized), it could actually be something else entirely, designed to LOOK like a USB stick - however I don't think it could do any damage by itself. – Phoshi Oct 31 at 12:42
For example, a bluetooth USB dongle or a proprietary wireless mouse receiver could easily look like a USB flash drive. (No harm there, of course.) But to truly fool someone into social engineering, whatever is printed on the casing is not necessarily true. For starters, I would print 10GB USB 2.0 on a 128MB USB 1.0 flash drive if I wanted someone to pick it up... ;-) – Arjan van Bentem Oct 31 at 13:00
1  
Now my only hope is that it goes back to his legitimate owner. I did my part – Stefano Borini Oct 31 at 13:57
show 6 more comments

8 Answers

vote up 6 vote down check

Why look at the content? I can understand that you are curious, but the content of those drives is non of your business. If you lost a drive, would you want others to look at the content?

Leave some notes in the area where you found them or bring them to the lost property office if you have one.

link|flag
1  
Here is Tokyo. I don't know how to write, I don't know where I was, I don't know how to put a post it note in the middle of the street. If I find a wallet, I would look for personal documents. Why shouldn't I do the same for a lost drive ? – Stefano Borini Oct 31 at 10:12
5  
And if I lost my drive, it would contain an encrypted image, with a clear text file containing my email address. – Stefano Borini Oct 31 at 10:13
2  
Further to this - in the rarest circumstance of the drives actually being of some importance (e.g. government / military), even attempting to access them could wind you up in a whole heap of trouble. – iAn Oct 31 at 10:46
2  
So chances are it's all Japanese after you plug it in... If you can't read that, and given iAn's comment, I guess dropping it off at some police station is all your Scout's Duty can do then? – Arjan van Bentem Oct 31 at 11:25
Because I speak no japanese and they 99.9% speak no english. I was hoping that the usb stick contains what I said it's on mine "if found please send mail to " and then an encrypted file, but maybe I'm a dreamer. – Stefano Borini Oct 31 at 12:28
show 1 more comment
vote up 17 vote down

Disconnect from network. Boot from CD. Do not mount HDD.

Plug in USB drives, mount them and poke around. :-).

-- Brie

link|flag
that was my idea too, however... Linux for intel mac is a pain. If I boot OSX install cd, the HDD gets mounted in any case. – Stefano Borini Oct 31 at 10:27
is it? I've often run ubuntu livecd countless times with no problems, no hdd mounted. osx install cd of course is another matter, plus it's definitely not linux. care to detail your problems? – ptor Oct 31 at 14:14
kernel panics at boot. apic troubles. tried many solutions as proposed on the net, with no result. – Stefano Borini Nov 1 at 12:24
vote up 3 vote down

It could be full of nanites that are going to crawl into your computer and turn it into the master computer for the super-secret Tristan da Cuhna nuclear program. :)

All kidding aside, with the possibility that it could have some form of malware, government secrets, terrorist documents, data used in identity theft, illegal pornography, or child pornography your best bet is to turn it over to law enforcement in whatever jurisdiction you found it in with as much information about where you found it as possible. Leave it to them to figure out what to do with the USB stick.

link|flag
vote up 2 vote down

Just open it! OS X doesn't have any form of AutoRun, and (unlike Firewire) USB does not allow Direct Memory Access attacks. So looking through the USB stick and not executing anything would be perfectly save!

link|flag
1  
The op states USB drive, I suppose it could be some sort of starship engine, in which case plug it in faster :P – Phoshi Oct 31 at 11:09
I've no idea, been a windows/linux guy all my life, but it sounds plausable to me. – Phoshi Oct 31 at 11:10
Unless my Google-Fu is failing me, there's no USB DMA vulnerabilities on a Mac. So, cleaned up my comments a bit (and added a link to Firewire vulnerabilities as a reference). – Arjan van Bentem Oct 31 at 12:16
Ah, thank you :) – Phoshi Oct 31 at 12:18
That's indeed my worry. That plugging specially crafted stuff could compromise my security. I know that mac is not windows, but you never know. – Stefano Borini Oct 31 at 12:30
show 3 more comments
vote up 0 vote down

Is there no way to disable autorun? There might be a virus/trojan in the usb drive, but if it's not ran there is no problem :)

link|flag
Trust me, there can still be problems. A 12 year old in my class managed to bypass autorun the other day. – Dynamic I Nov 3 at 17:34
How? Was this in windows? I would really like to know how he managed to run something without the autorun. – antoniocs Nov 4 at 0:18
vote up 0 vote down

If booting to a LiveCD is not an easy option, do you have any virtualization software? You could create a virtual machine and connect the device to that isolated machine. I've done that in the past using VMWare Workstation. You could probably download an eval copy of VMWare Workstation, which allows sharing of USB devices.

I would be careful that you know the USB device is going to be connected to the VM and not the host. I've done this enough in the past that I was comfortable knowing that the device would be connected to the VM and not my host machine.

To be safer, make sure the VM OS does not have any sensitive information or connectivity to sensitive information (i.e. network connectivity or other sharing with the host).

Edit: I've actually done this too. Turns out the drive contained the person's entire work portfolio. I was able to track down her contact information from the content on the device. She was so relieved when I returned the device to her. It was a very attractive drive too. I asked her if she knew where I could get one, but she got it as a gift in Korea, so she didn't know where I could find one. It was very similar to the Pico USB flash on Thinkgeek, except that the pins weren't exposed.

link|flag
vote up 0 vote down

If I would want to see the content without risks, I would see it and I wouldn't write about it to superuser.com, that gets indexed by Google :)

I'm laughing, you made my day. Thank you.

link|flag
vote up -1 vote down

Use a public computer somewhere. If something bad happens, it won't be on your machine....

link|flag
Are you seriously assuming that someone who wants to return a found USB thing to its owner (good!) would expose a public computer (and possible any future users of that computer) to any risk...? – Arjan van Bentem Oct 31 at 12:23
4  
Actually, this isn't as bad an idea as it first seems. Every library PC I know of doesn't allow any changes, and restores the disk to the master-copy of windows every boot. If you know a PC like that, it'd be pretty safe to use it. Just reboot it before and after you're done (in case somebody else had the same idea and didn't reboot after to wipe any attacker) – Phoshi Oct 31 at 12:45
Using someone's else PC carries also another problem. What if the usb stick contains inopportune material ? I don't want to see previews of undressed women while I'm on a public library. – Stefano Borini Oct 31 at 12:51
That's a good point. You could make sure you grab one facing a wall so nobody can see you, or explain to the librarians what you're about to do? – Phoshi Oct 31 at 13:06
Man, we live in times of cameras and over suspicion. I'm not doing that. – Stefano Borini Oct 31 at 15:21

Your Answer

Get an OpenID
or
never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.