Asklemmy

43851 readers

1700 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy 🔍

If your post meets the following criteria, it's welcome here!

Open-ended question
Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
Not ad nauseam inducing: please make sure it is a question that would be new to most members
An actual topic of discussion

Looking for support?

Looking for a community?

Lemmyverse: community search
sub.rehab: maps old subreddits to fediverse options, marks official as such
!lemmy411@lemmy.ca: a community for finding communities

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 5 years ago

MODERATORS

Secondhand item came with previous owner's files on the SD card, do I return the card or format it? (lemmy.dbzer0.com)

submitted 10 months ago* (last edited 10 months ago) by lemann@lemmy.dbzer0.com to c/asklemmy@lemmy.ml

24 comments fedilink hide all child comments

I bought a 3d printer off Ebay which got delivered not too long ago, and it came with 2 sd cards - one with a build video and some demo print files, but worryingly another card that has all the previous owner's personal files on there.

Not sure whether to format it, or to contact the seller offering to send the card back (free of charge)... how would you prefer to be approached in a similar situation?

Edit: No gcode files are on the card, just 30gb of pictures, music and videos. Sent the seller a message offering to upload it to cloud or to send the card back

you are viewing a single comment's thread
view the rest of the comments

[–] LufyCZ@lemmy.world -3 points 10 months ago (2 children)

Autorun doesn't exist anymore.

As long as you don't open any executables, you'll be fine.

What's the chance that the seller has a 0day (which would be veeery valuable) and is using it to steal data from someone random? Not worth it for sure on their side.

[–] Darkassassin07@lemmy.ca 34 points 10 months ago* (last edited 10 months ago) (2 children)

While autorun doesn't exist anymore, there's many many other methods of attack via usb.

Here's a list with 10 seconds of searching:

https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/

It's entirely possible this drive was made maliciously to pass on data from whatever unsuspecting soul uses it. The seller op bought from could even be a victim themselves. You just never know.

[–] LufyCZ@lemmy.world 4 points 10 months ago (1 children)

We're talking about an sd card here. The absolute majority of these attacks only work with USB drives.

And the rest either don't make sense or make use of a 0day, which, as I've already said, is inconceivable

[–] ThePantser@lemmy.world 2 points 10 months ago (2 children)

How do you read a SD card? I usually put it in my SD card reader which is USB.

[–] Max_P@lemmy.max-p.me 11 points 10 months ago

The SD card is still speaking SD protocol, the card reader bridges between USB and SD.

This only works with USB sticks because they're plugged on directly over USB and you don't know whether it'll present itself as a storage device or as a keyboard that immediately starts typing stuff and running a bunch of commands.

The risk is not the flash storage part, it's the USB interface.

[–] peter@feddit.uk 1 points 10 months ago

But I don't think OP is saying the package came with an sd card reader as well that they used

[–] MiltownClowns@lemmy.world 16 points 10 months ago (1 children)

Best security practices are pointless if you disregard them because they're inconvenient and unlikely to be necessary. Most needles I find on the ground are clean too, but I'm not just gonna stick them in me because the odds are in my favor.