"uDisk" USB devices experience serial number corruption (changing, unusual characters, entirely missing) that prohibit USB approval process via serial numbers.
search cancel

"uDisk" USB devices experience serial number corruption (changing, unusual characters, entirely missing) that prohibit USB approval process via serial numbers.

book

Article ID: 288241

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  1. Inventory -> USB DEVICES lists devices with the PRODUCT value "uDisk" 
  2. The SERIAL NUMBER is either missing, or has unusual characters like Љ <- Љ ‎(upper case, lower case љ ... the fourteenth letter of the Serbo-Croatian Cyrillic alphabet)
  3. The SERIAL NUMBER may change after ejecting and reinserting.

Environment

  • Carbon Black Cloud Sensors: All versions
  • Carbon Black Cloud Console: All versions
  • Sensor Operating Systems: All versions
  • "USB" devices: uDisk

Resolution

The "uDisk" designation is a sign of a problem between the device and the Operating System (e.g. occurs without the Carbon Black Cloud sensor in the picture)

From this article

"If your USB flash drive mounts as a UDISK on your computer, it means it’s a bad USB drive with firmware that doesn’t match the memory type and controller combination. The drive is saying it’s using flash memory, when in reality it’s just a small hard drive. Without the correct firmware in the controller, the USB stick is unstable and the operating system tips users about the problem by calling it a UDISK."