0

Come at this from the point of view of ransomware, where attached backup media could be corrupted, regardless of it being previously mounted.

I have some USB flash drives (hereafter "USBFD" or "USBFDs") which I perform offsite backups to daily. Several hours elapse between the time the backup script finishes writing to the USBFDs and when I pull the day's USBFD from the server. Theoretically, ransomware could look for devices in mount and /dev/. When I umount the USBFD via the script, can I also remove the /dev/sdX device as well so it can't be mounted again and the contents tampered with?

Something in the OS (ubuntu server) removes the /dev/sdX device after the drive is umount ed and pulled.

The USBFDs aren't in /etc/fstab; the UUIDs are in the script and they're mounted to the mountpoints using the partition UUID.

EDIT: To include example. At the end of the example below, the USBFD is still present in /dev/disk/by-* even though it's not mounted. I'd like to delete the device association /dev/sdb and /dev/sdb1 as though the drive has been pulled from the server.

$USER@U16:~$ ls -l /dev/disk/by-* #list all devices
/dev/disk/by-id:
...
lrwxrwxrwx 1 root root  9 Jan 17 06:39 usb-General_USB_Flash_Disk_0425640000007474-0:0 -> ../../sdb
...

/dev/disk/by-label:
...
lrwxrwxrwx 1 root root 10 Jan 17 06:39 ESD-USB -> ../../sdb1
...

/dev/disk/by-path:
...
lrwxrwxrwx 1 root root  9 Jan 17 06:39 pci-0000:00:10.1-usb-0:2:1.0-scsi-0:0:0:0 -> ../../sdb
lrwxrwxrwx 1 root root 10 Jan 17 06:39 pci-0000:00:10.1-usb-0:2:1.0-scsi-0:0:0:0-part1 -> ../../sdb1
...

/dev/disk/by-uuid:
...
lrwxrwxrwx 1 root root 10 Jan 17 06:39 9A95-F490 -> ../../sdb1
...

$USER@U16:~$ sudo umount /media/$USER/ESD-USB #umount the device @ mounpoint

$USER@U16:~$ ls -l /dev/disk/by-* #USBFD still shows in output although it's not mounted.
/dev/disk/by-id:
...
lrwxrwxrwx 1 root root  9 Jan 17 06:39 usb-General_USB_Flash_Disk_0425640000007474-0:0 -> ../../sdb
lrwxrwxrwx 1 root root 10 Jan 17 06:39 usb-General_USB_Flash_Disk_0425640000007474-0:0-part1 -> ../../sdb1
...

/dev/disk/by-label:
...
lrwxrwxrwx 1 root root 10 Jan 17 06:39 ESD-USB -> ../../sdb1
...

/dev/disk/by-path:
...
lrwxrwxrwx 1 root root  9 Jan 17 06:39 pci-0000:00:10.1-usb-0:2:1.0-scsi-0:0:0:0 -> ../../sdb
lrwxrwxrwx 1 root root 10 Jan 17 06:39 pci-0000:00:10.1-usb-0:2:1.0-scsi-0:0:0:0-part1 -> ../../sdb1
...

/dev/disk/by-uuid:
...
lrwxrwxrwx 1 root root 10 Jan 17 06:39 9A95-F490 -> ../../sdb1
...
  • 1
    Theoretically a ransomware can easily scan devices, and mount all of them. – Ipor Sircer Jan 17 '17 at 11:26
  • I'm trying to make it so the device(s) can't be discovered in such a scan, if that's possible. – user208145 Jan 17 '17 at 11:52
  • 2
    That's the point of a "scan"... to discover devices... That being said, eject /path/to/usb/device or echo 1 > /sys/block/sdX/device/delete should delete your device from the system (until the next scan, that is...); btw, this has nothing to do with ubuntu – don_crissti Jan 17 '17 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.