Firstly, never stick a storage drive into your personal machine that was previously owned by an individual. If you need to use the drive always open it on a machine disconnected from the Internet that contains no personal files. Better would be to boot up a live Linux machine and read the drive and format if needed.
this post was submitted on 29 Dec 2023
83 points (98.8% liked)
Asklemmy
43846 readers
629 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy π
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
Autorun doesn't exist anymore.
As long as you don't open any executables, you'll be fine.
What's the chance that the seller has a 0day (which would be veeery valuable) and is using it to steal data from someone random? Not worth it for sure on their side.
While autorun doesn't exist anymore, there's many many other methods of attack via usb.
Here's a list with 10 seconds of searching:
https://www.bleepingcomputer.com/news/security/heres-a-list-of-29-different-types-of-usb-attacks/
It's entirely possible this drive was made maliciously to pass on data from whatever unsuspecting soul uses it. The seller op bought from could even be a victim themselves. You just never know.
We're talking about an sd card here. The absolute majority of these attacks only work with USB drives.
And the rest either don't make sense or make use of a 0day, which, as I've already said, is inconceivable
How do you read a SD card? I usually put it in my SD card reader which is USB.
The SD card is still speaking SD protocol, the card reader bridges between USB and SD.
This only works with USB sticks because they're plugged on directly over USB and you don't know whether it'll present itself as a storage device or as a keyboard that immediately starts typing stuff and running a bunch of commands.
The risk is not the flash storage part, it's the USB interface.
But I don't think OP is saying the package came with an sd card reader as well that they used
Best security practices are pointless if you disregard them because they're inconvenient and unlikely to be necessary. Most needles I find on the ground are clean too, but I'm not just gonna stick them in me because the odds are in my favor.
Better to offer and they say no vs you just destroying data they can't replace and didn't realize they'd lost.
Just send a quick email/DM. Couldn't hurt. Could even send the data through dropbox or similar instead of the whole card.
I know if I was the seller I would appreciate the gesture, even if I didn't need the data.
First make sure it's not CP π€·π»ββοΈ
Reach out to them and ask. The card is now yours, but the data is theirs.
I am sure if needed they can give you an online folder to upload the contents if needed.
Yeah I don't see the need to return the card. But asking if they want the data seems sensible.
Upload the files to google drive or the like, send the seller a message with the link and an explanation. Give them 14 days to download it. Delete files.
Idk how big these files are. Too big and my idea won't work
I wouldnβt upload my own files to the cloud, and in turn I wouldnβt upload someone elseβs without their consent.
It might have passwords, personal financial data, corporate trade secrets, health data, child pornβany number of cans of worms.
Offer to send it back.
Good on you for asking to upload the data before formating. It's a nice gesture that I'd appreciate either way.