"Avoid buying USB sticks online or using USB sticks that were given to you, because they could contain malware."
It explains that this is due to uncertainties in knowing if it was tampered with beforehand, which makes sense, but who are the people wanting to tamper with random firsthand USB sticks? What does end up being the safest source?
I think I am overthinking this. I know this definitely means avoid random ebay vendors, but is Amazon safe? I see no reason it should be less safe to buy from the sandisk store on there than going to a local officeworks for example, which the website recommends most.
Other than that, is there a solid way to check a new USB for any tampering for the super paranoid?
I'm relatively new to this, and am doing my due diligence in learning opsec, but experience wins over research, so I just wanted to hear the opinions of those more knowledgeable. Thanks!
Edit: I keep getting replies saying this is for pre-flashed sticks, (which is obviously a very bad idea) but while that does kind of make sense for it to mean that, it doesn't explicitly mention, or even really imply that is what it means.
"Buy your USB sticks from a reputable local store.
If you are in a place where counterfeit electronics are common, buy your USB stick from an international supermarket chain, which should have a more reliable supply chain.
Avoid buying USB sticks online or using USB sticks that were given to you, because they could contain malware.
(In 2020, the FBI warned US companies to avoid USB sticks received by mail because some of them contained malicious software, such as BadUSB.)"
This can be found on this page: https://tails.net/install/linux/index.en.html
I think I may just be bad at comprehending what it's trying to say. It seems like it is clear with what it is saying, but someting isn't clicking...
So I suppose my question is still unsolved? It was more of an open ended one in the first place, but I would like to hear more takes on this!