I recently had my first Intel-Mac kernel panic. If you’ve never seen this, a gray curtain slowly descends over your screen, and you get a message in the center of the screen saying that you must reset your Mac using the power button. If you had any unsaved work, it is lost. This happened twice on my iMac. At first I didn’t know why. I was afraid I would have to take it in for service. I also suspected a problem with my external USB hub.
However, when I took the USB drive I was working with down, and gave it to my wife, it crashed her MacBook Pro with a kernel panic as soon as she inserted it. That’s when I realized that even though it didn’t crash my machine right away, I had been working with that flash drive both times. Also, I had never used that particular flash stick before.
It was a a 1GB drive from Staples, and it had the U3 “feature”. If you’re not familiar with U3, it is an attempt to add functionality to flash drives by using a special partition on the drive that contains software to be launched automatically when the drive is attached, with no intervention by the user. This software is supposed to extend the functionality of the drive by providing encryption/decryption and other on-the fly features. This scheme is inherently dangerous. It could have been invented by malware authors, since it is perfect for the spread of viruses.
U3 is supported in Windows, and most U3 features are Windows-only. Most Mac users regard U3 as an annoyance, since it takes up some of the space they could otherwise use on the drive, and it puts a second, useless icon on their desktop.
The most frequently-asked-question about U3 is: “how do I get rid of it?”. To their credit, SanDisk, one of the leading manufacturers of flash storage provides a removal tool. It’s called “Launchpad Removal Tool for Mac“. It’s part of the Cruzer Utilities for Mac. It worked fine and the offending drive now works without crashing the Mac.
Heads up to Apple on this: The kernel shouldn’t panic when a drive is inserted. The fact that it does probably represents a vulnerability that someone could exploit in malware.
When shopping for flash drives, I recommend avoiding U3 drives altogether. Otherwise, get the tool and remove the offending partition the first thing.
-Jamie
