1

I need your help: it happens quite often to me that I have to mount drives coming from the most diverse sources and, sometimes, with quite a high risk of being infected with god knows what. As a consequence I deactivated auto mount and I usually format them before mounting them if I do not need to access their content, it is nonetheless quite common for me to need their content: I was wondering if there was any software able to scan them before mounting them; I remember that when I was on windows some antivirus were able to do so (probably mounting them to some sandbox I suppose) and I was wondering if there was any alternative software able to do so on MacOS.

Thanks

Improve this question
2

2 Answers 2

Reset to default
1

A common approach to such unknown and "foreign" USB drives is to use a virtual machine for mounting. I.e. using a tool such as VirtualBox (free) or VMware or Parallels (commercial software) to run a virtualized Linux or macOS system - and then mount the disk in the there.

In almost all cases that limits the amount of damage that can be done to that virtual machine. Virtualisation software usually supports snapshots so that you with 1 click can restore the virtual machine to what it was before the unknown drive was plugged in.

It is ofcourse important to remember to setup the virtualisation software to grab the USB drive instead of the host operating system automatically mounting it for you - but as you have already disabled automount, that shouldn't be a problem.

Another option would be to use a user-space tool to inspect the disk without actually mounting it. The tool to use depends on the file system on the disk - but for USB "keys" it is usually a FAT-based file system. A popular tool for that on Linux would be fatcat - however, I do not know if it runs on macOS. It's not in HomeBrew, but I guess it wouldn't hurt to download it and try to compile it on macOS - it might just work.

Improve this answer
-1

Under Unix, the user has to start the malware. The malware cannot start by itself when you open the USB stick.

Above all, only those programs start that can also be executed, so something like ".jpg" .mp4 "" .txt "falls out.

You should stay away from external software that says it is scanning the USB stick, because most software itself can contain malware and it also sees the contents of the removable media and can intrude on your privacy

In addition, a virus scanner is technically not feasible. See (Theoretical Computer Science)

Improve this answer
10
  • This is actually incorrect. Malware could be hidden inside the structures of the file system itself trying to exploit bugs in the file system handling code in the kernel - so although this is not common in practice, it is a theoretical possibility that you probably want to shield youself as much as possible from when dealing with potentially malicious drives. Similarly the statement that malware cannot infect .JPG and .MP4 is also not correct - it is possibly to create malicious photos and videos that exploits bugs in various players.
    – jksoegaard
    Commented Mar 21, 2022 at 8:57
  • One cannot infect files like .jpg or .mp4. Who says that?
    – BabyBoy
    Commented Mar 21, 2022 at 14:49
  • Your information is incorrect, I'm afraid. It is possible to use JPEGs and MP4s to exploit systems.
    – jksoegaard
    Commented Mar 21, 2022 at 15:06
  • Every security expert I know says this... JPG and MP4 can be manipulated to trigger errors in applications which can then be used to run arbitrary code hidden in the JPG/MP4 file.
    – nohillside ♦
    Commented Mar 22, 2022 at 12:19
  • @nohillside An image is not executable. It contains information on how to display it. Nothing works on Unix unless the attribute "execute" is added or it has an suffix. How dare you let the Preview.app get infected. Apart from that even root has no possibility. I stand by my answer or you have evidence...
    – BabyBoy
    Commented Mar 22, 2022 at 15:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .