I’ve just bought a high-end Windows laptop for video editing while travelling around Europe. What steps can I take to prevent any possible infections from being passed on from previous machines on SD cards and external hard drives? Some of the external hard drives go back to machines from 2004 but I have never plugged any of them into any computers other than my own previous Macs and PCs. I work professionally with video, photography and coding, so all of this data is vital.
I have a five-machine Bitdefender licence but I’d be prepared to use another protection system, and I’ve looked at Sophos Intercept X. Jason
There are at least three things to think about. First, there’s the threat level: how at risk are you? Second, there’s provenance: how much do you know about your devices? Third, how can you mitigate any risks revealed by the answers to the first two questions?
On the whole, you appear to be at a relatively low level of risk from malware, and the two products you mention should provide an adequate level of protection. Bitdefender includes a firewall, a password manager, disk encryption and a built-in VPN, so it already provides more protection than free, standalone antivirus programs or the built-in Windows Defender.
I’d be more concerned about the physical risks of losing an expensive laptop and data while travelling because of either theft or accidental damage. I assume you are not going to carry around a collection of old SD cards and antique hard drives but will consolidate the data you need on to one or two of each. You should consider using a service such as Dropbox to provide a secure off-site backup while you are on the move.
Threat level
Your risk of cybercrime is dependent on several factors but how high-profile a target you might be likely defines how far you will have to go to protect yourself. Photograph: Kacper Pempel/Reuters
How at risk are you? Some people are at a very high risk because they can be targeted by commercial hackers or people with nation state-level attack tools. If you’re a whistleblower, suspected spy or weapons developer, or you work for someone like the Dalai Lama, you may be a target for people who can deploy zero-day exploits for which there is no known defence. If the CIA, Mossad, Russia’s GRU or China’s state hackers want to compromise your computer, it may not be easy to stop them.
If you are a home user, you are just low-hanging fruit that can be harvested using generic exploit kits for which patches appeared years ago. In this case, you should be safe enough if you keep all your software – not just the operating system – fully patched and up to date, run an effective antivirus program and don’t make any obvious mistakes. This includes things like running unrequested attachments or falling for phishing scams. (Gullibility is an infinitely exploitable resource, which is why so many attacks now rely on “social engineering” rather than software vulnerabilities.)
You make videos, so you could be at risk, depending on your subjects. I expect Laura Poitras – who made documentaries about Edward Snowden (Citizenfour) and Julian Assange (Risk) – has to be pretty careful. But if you aren’t working in contentious areas, Bitdefender and Sophos Intercept X should be enough.
Bitdefender has been one of the best antivirus suites over many years of testing, so I wouldn’t change it. Normally, you should only run one AV program because of the risk of them interfering with one another. However, Intercept X is promoted for using “a deep learning neural network” to detect unknown malware and Sophos says it “can also be used to augment your existing endpoint security or antivirus software”. You could download the free trial version and see if it works alongside Bitdefender.
I’ve also used Kaspersky’s free virus removal tool (currently not found but Major Geeks has a copy) and Hitman Pro – which is now a Sophos product – for occasional double checks.
Provenance
Do you know where that USB flash drive came from? If not, don’t plug it in. Photograph: Jeffrey Hamilton/Getty Images
Plugging in USB memory sticks, SDIO cards and other flash memory storage devices into your computer can be a risk, and some devices (eg USB Rubber Ducky) have been specifically designed for the purpose. In fact, dropping infected USB sticks in company car parks is now a well-known form of cyberattack because lots of users are dumb enough to plug them into their office PCs. This prompted Microsoft to change the way AutoRun works back in 2011.
Shared hard drives and other systems – such as photo-printing kiosks – are also a risk. If more people use something, it is more likely that one of them will eventually pass on an infection.
In other words, provenance matters.
Happily, you know the provenance of your SD cards and USB devices, and you have only used them with your own PCs. If your earlier PCs were malware-free, your SD cards and USB devices should be malware-free, too.
With USB devices, there’s a small risk of uploading malware before the operating system loads from the C: drive but you should be safe enough if no USB devices are plugged in when you start your PC. You could also turn off your PC’s ability to boot from USB, unless you use a USB stick for recovery purposes.
Just checking
Of course, you could still check all your current storage devices, and it may be convenient to do that while consolidating your existing storage on to one or two new external hard drives, and possibly a couple of large SD cards.
You don’t have to do this with your expensive new laptop. You could use Bitdefender on one of your old PCs or buy a small, cheap laptop to do the job. (You could not guarantee the provenance of a second-hand laptop.)
Any reputable antivirus program should be able to detect and remove infections found on a normal external hard drive. You could also try Flash Disinfector, which was developed more than a decade ago to remove common storage infections. I don’t know if it is up to date enough to be worth the effort but it costs nothing to try it.
Other alternatives would be to boot a system to a Live Linux from a CD or a USB stick – because Linux won’t run Windows malware – or set up a little system with a Raspberry Pi. Someone has already developed a Pi-based device in the form of the CIRClean USB Sanitizer, although it is probably not suitable for your purposes.
Either way, given the size of your video-editing laptop, you may find a small, tablet-style computer is a useful extra.
Safe travel
Machines can be replaced; data is much harder to recover without adequate backups. Photograph: John Lund/Getty Images/Blend Images
The first requirement is to have a full backup that you can store in a safe place while you’re away. You can always replace devices but you can’t replace decades of data.
After that, you already have good antimalware protection, a firewall, password manager and drive encryption via Bitdefender. That’s a good start for anyone travelling with a lot of data.
Your next addition should be a VPN, for protection when using public and hotel wifi connections where security cannot be guaranteed. You may also be able to use a smartphone or a mobile router to create a connection, if your contract allows tethering and roaming at a reasonable cost.
Obviously, you will not plug in any unknown USB devices or use any public USB charging stations. You should also turn off wifi and Bluetooth unless you are actually using them. Both services can make external connections without your knowledge, which could enable you to be tracked.
You must also keep all your devices safe from external interference. The “evil maid attack” is a classic information security problem because an evil maid could install a keylogger or other malware on a laptop left in a hotel room. Last year, Eclypsium researchers showed how to take the back off a laptop and install a firmware backdoor in less than five minutes.
Of course, the perpetrator of this kind of attack is far less likely to be a maid than a cybercriminal, state-sponsored hacker or government official. But your laptop is less likely to be compromised while it’s in your possession than if someone else has physical access.
Have you got a question? Email it to Ask.Jack@theguardian.com
This article contains affiliate links, which means we may earn a small commission if a reader clicks through and makes a purchase. All our journalism is independent and is in no way influenced by any advertiser or commercial initiative. By clicking on an affiliate link, you accept that third-party cookies will be set. More information.
Source: The Guardian
