Beware the iPod 'slurping' Employee

Zoner12 writes "CNet is reporting that Abe Usher has created an application that allows an iPod to scan corporate networks for files likely to contain sensitive business data and download them, potentially stealing 100 megabytes in a few minutes. An insider threat would only need to plug the iPod into a computer's USB port."

Comments

Oops

[Luigi30]

Nothing for you to see here. Please move along. Sorry, my iPod slurped the story.

Re:Oops

[PC-PHIX]

Nothing for you to see here. Please move along. Sorry, my iPod slurped the story.
--
503 Sig Unavailable

Perhaps for this article you meant 404 or 410, or perhaps we need

416 Content 'slurped' by iPod

Business data?

[PC-PHIX]

Most of the time, as an IT employee with ties to the management/accounts/administration side of things I have always had full access to company data and know exactly where to look to find what I want. The only real restrictions have been my contract/confidentiality/non-disclosure agreement.

What I would consider much more useful is an application that can hunt .avi, .mpg and .mp3 files across the network and 'slurp' them back to my iPod...

..., if I used an iPod.

Re:Business data?

[__aaclcg7560]

What I would consider much more useful is an application that can hunt .avi, .mpg and .mp3 files across the network and 'slurp' them back to my iPod.

An application that does the opposite would probably be better: transparently offloading illegal .avi, .mpg and .mp3 from the iPod to a specific computer. An anonymous phone call to the local authorities to take a look at the computer would finish the job. Wouldn't be the first time that some high-ranking company official got caught with kiddie porn on their computer.

Re:Business data?

[Isotopian]

I'm troubled by your definition of 'better'. But in all seriousness, if the process were so transparent, I'd think it'd raise red flags simply because of the sheer lack of evidence.

Re:Business data?

[blincoln]

What I would consider much more useful is an application that can hunt .avi, .mpg and .mp3 files across the network and 'slurp' them back to my iPod...

One of my former coworkers added audio/video file types to the SMS inventory list on our network. It was a simple step from there for him to build a little web front end to a database query and *pow!* instant media library.

Re:Business data?

[__aaclcg7560]

Better is a relative term. You can remove information from the network to benefit yourself or add information to harm someone else. A transparent process should raise red flags -- if you know about it.

Re:Business data?

[somersault]

yes, better really is relative with you it seems.. why do you think it's so great to frame an innocent person who is just doing their job? That's very sick, you could totally mess up someone's life/marriage/whatever..

Re:Business data?

[jbarr]

The only real restrictions have been my contract/confidentiality/non-disclosure agreement.

The only real restrictions have been my good character, ethics, and morals...

Re:Business data?

[Anonymous Coward]

> One of my former coworkers added audio/video file types to the SMS inventory
> list on our network. It was a simple step from there for him to build a little
> web front end to a database query and *pow!* instant media library.

Uh... I don't get it. He put files on a computer network, and...? What else do you do with computer networks?

Re:Business data?

[pla]

transparently offloading illegal .avi, .mpg and .mp3 from the iPod to a specific computer. An anonymous phone call to the local authorities to take a look at the computer would finish the job.

Assuming you work in the US Windows-oriented world...

1) Where do you work that your IT guys gave you write access to administrative shares on the domain?
2) Do you realize that files have a concept of "owner", as well as a creation date, and that when you authenticate against the domain, a DC logs that?

Meaning that even if you could do it, which if you can your network admins need to "spend more time with their family", you'd leave tracks even an amateur could follow straight back to you.


Of course, similar ideas apply to the idea of an iPod sniffing around the network... Do most companies not limit "important" file access to people who actually have a reason to access those files?

Perhaps even more relevant - Would most people know what to do with something juicy? Unlike Hollywood's vision, you won't stumble across files named "fake_duplicate_set_of_books.xls" or "super_secret_corporate_takeover_plans.doc". "Real" juicy material takes a frickin' degree in accounting to make any use of... Just columns of account numbers, dates, and dollar amounts.

Re:Business data?

[Heem]

yea because that would require some serious programming ability. You could probably do it in 3 or less lines of script.

Re:Business data?

[hugzz]

An application that does the opposite would probably be better: transparently offloading illegal .avi, .mpg and .mp3 from the iPod to a specific computer. An anonymous phone call to the local authorities to take a look at the computer would finish the job. Wouldn't be the first time that some high-ranking company official got caught with kiddie porn on their computer.

And you've got kiddie porn on your ipod, why exactly?

Re:Business data?

[Fordiman]

I think the idea here is that someone with limited network access only need plug the iPod into a computer logged in with higher access rights - something that shouldn't happen ( lock your box ) anyways.

Re:Business data?

[nolife]

All it takes to have access to an administrative share on a PC (like c$) is be in the local administrator group or be a member of a group that is in the administrator group on that PC. Considering probably 95% of the users that use Windows desktops run as administrator, that idea is not such a major difference from normal and probably overlooked. In the corporate world, companies lock down desktops or at least put users in the power users or users group. In that situation, having the IT department support people as desktop machine administrators is very common. Different classes of machines are in different OUs and you can fine tune what people (including IT), are in what groups for what computers. You obviously do not put lower tech support in a group that has administrator access to your servers and you can remove your network engineers from admin access on the PCs that are not in the IT department.

Having joe blow in a security group that has administrator access is a little crazy but can be manageable if it is only a specific subset of PCs. It is not surprising that companies do not tune or even think about permissions to that level and may provide all or nothing. I blame that on a weak or small struggling IT department or a weak and/or clueless IT manager but there are many of them out there.

Re:Business data?

[scumbaguk]

We all need data to do our job weather it be a customer list, technical resources and documentation we use, this information is just as valuble to the company as anything which may have administrator or system only access.

For example your head of sales leave the company with your prospect list and a whole load of competative information which he/she uses to their advantage in their new job.

This is the type of information leak that they are talking about.

Thankfuly there are many security products like "device wall" which allow you to lock down access to devices like usb memory sticks, ipods, bluetooth dongles.

On to your auditing point, if people use this data for their daily job then there will be no unsuall leads to follow. All will look as normal.

You are also assuming that a company which has such weak IT policy and internal security measures will have the ability and time to check logs, corrolate information and track down these data leaks.

It's much easier to implement a system which secures the internal perimiter.

Which I think is the whole point of the artical which many seem to be missing.

Re:Business data?

[__aaclcg7560]

Innocent is a relative term. I'm just suggesting alternative usage for the iPod since that's what the article is about in the first place.

Re:Business data?

[karnal]

SMS is an application that "Inventories" end-user PCs. Useful for things such as licensing counts (do you really have a license to run "x" application) to PC asset tracking.

You can also have it inventory file types. What this guy did was inventory audio and video files; then you run a query against the information gathered. And as the grand-parent said, *pow!* instant media library.

Our org uses Altiris. There's a default check box to see how many times someone ran solitaire.exe, for instance.... Fun stuff.

Re:Business data?

[somersault]

innocent in this case meaning not guilty of what you accused them of, which itself is quite a well defined idea, even if innocent itself is a relative term.

You may have just been making suggestions, but that doesnt mean we cant worry about why you'd even think something like that :p

Re:Business data?

[Anonymous Coward]

> You can also have it inventory file types. What this guy did was inventory audio
> and video files; then you run a query against the information gathered. And as
> the grand-parent said, *pow!* instant media library.

Ah - I see, thanks.

> There's a default check box to see how many times someone ran solitaire.exe, for
> instance.... Fun stuff.

I can certainly see why one would find that arousing...

Re:Business data?

[Anonymous Coward]

So you're not restricted by your morals then?

Re:Business data?

[Talennor]

Do you realize that files have a concept of "owner", as well as a creation date, and that when you authenticate against the domain, a DC logs that?

I believe the idea would be to use someone else's workstation. Have the autorun drop the files without making any visible signs of doing anything. Hell, you could probably do this while talking to the person, just ask if you can charge the ipod while you talk (try it, people are agreeable most of the time). Alternatively you could find an unlocked workstation, but what's the fun in that?

See how easy that was? And note how the large role ipods now play in our lives contributed to the success of this trick.

Re:Business data?

[Anonymous Coward]

"What I would consider much more useful is an application that can hunt .avi, .mpg and .mp3 files across the network"

It's called 'Search' in windows and 'Find' on a Mac.

"... and 'slurp' them back to my iPod..."

That's called "Drag and Drop."

Re:Business data?

[karnal]

Fun stuff doesn't = arousing in my book, but ok.

Fun stuff in this context meant "I can see why they put that there, but I would hope our management wouldn't use it."

Sorry I didn't spell that out for you the first go-round. HAND.

Re:Business data?

[orcus]

Most of the time, as an IT employee with ties to the management/accounts/administration side of things I have always had full access to company data and know exactly where to look to find what I want. The only real restrictions have been my contract/confidentiality/non-disclosure agreement.

Interesting that you didn't list "integrity" as one of the restrictions.

Re:Business data?

[PC-PHIX]

Most of the time, as an IT employee with ties to the management/accounts/administration side of things I have always had full access to company data and know exactly where to look to find what I want. The only real restrictions have been my contract/confidentiality/non-disclosure agreement.

Interesting that you didn't list "integrity" as one of the restrictions.

OK OK. I have now had several responses to this effect.

To clarify, for those who will continue to get sidetracked by this idea, I am defining 'restriction' as something different to 'motivation'.

My own beliefs, morals, principles, scruples - call it what you will - are used to decide what I will or won't want to do and thus affect the motivation for me to do something (or not).

Once I have decided on a course of action based on what motivates me (to be good or to be evil) the factors that then control my actions and limit my intentions are restrictions such as security systems, permissions on a network or risk of legal repercussions.

Hope that clears things up!!

Assuming I am an evil sysadmin who has no morals then I wanted to stress that nothing stands in my way except my contract (i.e. breaking the law or being exposed legally for what I've done).

If we just assume that I would not do such things because of morals, then my entire comment is irrelevant and I'd simply fall off my chair at the thought of doing something so morally reprehensible. That was not the topic at hand so I looked at restrictions in terms of physical barriers regardless of how well I can sleep at night.

Re:Business data?

[OhHellWithIt]

>> The only real restrictions have been my contract/confidentiality/non-disclosure agreement.

The only real restrictions have been my good character, ethics, and morals...

The former won't work without the latter.

I don't get it.

[Al Dimond]

There's nothing you could do with the iPod that you couldn't do with your normal computer and any random external hard drive. And your access will be logged (or not logged) just the same as if you'd just run some normal program. What's the big deal that an iPod can do it?

Re:I don't get it.

[JanneM]

What's the big deal that an iPod can do it?

There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right? There's many people out there that don't have the interest in technology to really reach the conclusions that seem obvious here.

With something like this, I'd expect to see quite a bit more attention being given not only to mp3-players, but things like cameras and mobile phones as well. "Wake-up call" is a trite, overused term, but perfectly apt.

Re:I don't get it.

[Barbarian]

How good do you think the read-access logging is on Windows 2003 servers? For a big organization, can they really monitor things that well? Someone who thought it through could set it up so the files were copied slowly to avoid detection.

Re:I don't get it.

[Zork the Almighty]

Even though they are equivalent, an iPod is a lot less suspicious than an external hard drive. Companies which rely on physical security only need to take notice and consider whether they should implement some sort of access log.

Re:I don't get it.

[NetRAVEN5000]

"What's the big deal that an iPod can do it?"

Didn't you know? iPods are magical!

Seriously though - there's nothing special about it - the same thing could be done with a flash drive or a CD burner.

The only thing special about it that I can see is maybe the app runs on the iPod and does it automatically for you. But I don't see how that's much different from running a simple VB app that does the same thing. . . I think one of the /. editors is just trying to conjure up some hatred of Apple.

Re:I don't get it.

[Anonymous Coward]

"Wake-up call" is a trite, overused term, but perfectly apt.

People like yourself are going to get all our music players, phones and every other damn thing confiscated by some personnel drone when we enter any corporate building.

Congratulations, I hope you're happy.

Re:I don't get it.

[Fnkmaster]

I see people running around with solid state USB keychain devices all the time. A large number of people at my university seem to have them. They are no more or less suspicion inducing than an iPod. A large, clunky external USB harddrive might be suspicious, but that's irrelevant.

The point is that any device that plugs into the USB port is a real threat, and this needs to be dealt with in corporate networks by assuming that any mounted USB drive of any sort is presumed to contain malicious code.

Re:I don't get it.

[Al Dimond]

I have no idea how good read logging is. I would think that if all reads were logged, and it at some point became clear that certain documents were leaked, that it would be possible by searching logs to find who had accessed those documents. It wouldn't be much use if the files were leaked by someone that had a good reason to access them, but then again, who does?

I imagine if some thought was put into it it wouldn't be that hard to set up some logging rules that would flag behavior that looked like scanning a network for files. It's entirely possible it's already been done and I just don't know about it.

Re:I don't get it.

[Danse]

There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right?

In every secure area I've been in, any sort of external data-storing device is banned, unless you are given explicit permission to bring it in, or you have the proper credentials to be allowed to bring them in on your own (which subject you to a higher level of scrutiny). So, unless the security people and system admins are completely retarded, then yes, this is a non-issue.

Re:I don't get it.

[JanneM]

People like yourself are going to get all our music players, phones and every other damn thing confiscated by some personnel drone when we enter any corporate building.

If the security management has determined that something like a portable harddrive is not an acceptable thing to bring inside, then neither should any other such item. How is pointing that out bad?

If you want to attack something, then attack the reasoning behind forbidding such items in the first place. And yes, such regulations are sometimes wildly overused, but in other places (company R&D or design departments, for instance) perfectly reasonable. And if you want to make a point like "but you could just send the data out as an e-mail attachement!", then I hope information security is already filtering outgoing email and stopping binary attachements.

Re:I don't get it.

[BrokenHalo]

this needs to be dealt with in corporate networks by assuming that any mounted USB drive of any sort is presumed to contain malicious code.

Only if said company never wants employees to take work home with them. You can't have it both ways; it isn't always secure, convenient or practicable to transfer files via email.

Re:I don't get it.

[Skreems]

Hell, you can do this without ANY on-site hardware. Almost any company will let you connect to the outside world, so just SCP to your home machine and upload like crazy. They won't be able to tell what you're uploading, but if anyone DOES ask, just have a bunch of music on your workstation that you "brought from home and then lost in a drive crash".

Re:I don't get it.

[c_forq]

What's the big deal that an iPod can do it?

I've heard that an iPod gives you a bigger ePenis (kind of like neon case-lights, case windows, and UV reactive cables).

Re:I don't get it.

[KDR_11k]

That's where social engineering comes in handy. "Oh, I love that song! Can you upload it to my iPod?"* Poof, access logged under different username.

*= I have no idea whether an iPod can be used as USB mass storage or requires a special program to be accessed but I assume USB mass storage access is possible.

Re:I don't get it.

[nolife]

You need the right tool for the job. A file server is not a document management system. There are many different document management systems available on the market for all sizes of companies. They provide central storage, versions, tracking of access and changes (who accessed and changed what and when), system admin and end user controlable security settings, ability to lock and check out documents, indexing, full text searching, and blah blah blah.
If a company chooses NOT to use one of these packages, they will have problems managing and tracking.

Re:I don't get it.

[Technician]

There's nothing you could do with the iPod that you couldn't do with your normal computer and any random external hard drive. And your access will be logged (or not logged) just the same as if you'd just run some normal program. What's the big deal that an iPod can do it?

Maybe...

What I don't know is if this will function on a machine where the screensaver has kicked in. If it does, than screensaver protected keyboard/monitor does not protect your PC from a visitor while you are at lunch. Does anybody know if it's possible for this to run while the screen is locked with a screensaver? In this case, the logs would point to the owner of the PC, not the visitor who recharged his ipod on your USB port.

Re:I don't get it.

[Anonymous Coward]

Suggestion;
    Bring a regular portable CD-player to work with a blank DVD in it. Burn 8G of company documents onto DVD using company DVD writer, and leave with non-blank DVD in company-approved non-USB, non-ipod music player. And laugh as your ipod-carrying cow-orkers are harassed by security!

Re:I don't get it.

[Bretai]

maybe the app runs on the iPod

I was thinking the same thing, because otherwise this is not news. Sadly - and all to frequently around here lately - it looks like the later. Files are not automatically shared out the USB port anymore than they are automatically shared out the ethernet port. The program has to be run from the Windows machine, which presumably will be locked to you. The CNET artical claims you don't need keyboard access, but the consultant's website makes no such claim, frequently comparing the iPod and usb drives interchangebly.

This maverick security guru wrote a program to browse the hard drive and copy files, after you have full access - in other words, after the hard part is conveniently taken care of for you. Lucky for us he crippled the version available for download, otherwise hackers would figure out how to copy files automatically too!

I'd skip the iPod and go with one of these usb sticks. (The 1GB version is the same size.) The guards would have to dig through my wallet thoroughly to find it. With current technology it's ridiculous to think you can't hide or disguise storage devices. You need to lock down and monitor all machines with sensitive data.

Needless to say, I'm unimpressed by this security guy, as I usually am by the ones who try to raise the alarm without an actual new exploit.

Re:I don't get it.

[Fred_A]

The program doesn't run from the iPod, the iPod doesn't do the scanning. Yo actually have to mount the iPod and run a Windows only Python program which then scans the machine/network and copies data to the iPod.

In other words it's nothing very exciting (although this is a "limited" version of the program, there's no mention of what more the complete version does). The main point is that the iPod looks more innocuous than a plain external disk as everyone has pointed out.

Maybe if some kind of "autorun" file was added, it would be easier to use with a locked keyboard. But then I'm not very familiar with Windows. OTOH I suppose you can add limitations to disable the autorun function and/or disable the running of binaries from external volumes. And of course USB ports are frequently disabled nowadays.

I too was disapointed to see that it wasn't the iPod running the program as I was curious to see how it would talk to the PC.

Re:I don't get it.

[Anonymous Coward]

There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right?

In every secure area I've been in, any sort of external data-storing device is banned, unless you are given explicit permission to bring it in, or you have the proper credentials to be allowed to bring them in on your own (which subject you to a higher level of scrutiny). So, unless the security people and system admins are completely retarded, then yes, this is a non-issue.

Having worked at several large companies (including a fortune 50 company), I can state from experience that many companies simply wouldn't know you attached an external drive to your machine, let alone an iPod!

Re:I don't get it.

[CastrTroy]

So your email system filters out MS Office documents and Zip Files? I think PDFs are binary too. OO.o files are binary too because they are zipped. I think a policy of denying emails based on whether or not they contain non-text characters is pretty bad idea. And you can't really base it on extension either. You can give a document any extension you want. Most of the time these filters cause more problem than they solve. You can't send a .js file to a coworker who needs it, but how many viruses really come enclosed in .js files? A better idea would be some way of blocking emails not sent by a real person, except from specific machines. I'm not sure how you would detect this, but i'm sure it could be done. Maybe everything going out on port 25 requires you to press a button on some box placed outside your computer.

Re:I don't get it.

[v1]

How about a 4gb USB flash drive? Flash drives are becoming more popular than iPods, and are a heck of a lot easier to palm out of sight. They also look a lot less dangerous to most uneducated users, plugged into a USB keyboard rather than an ipod with its firewire/usb cable snaking over to the computer. As far as "sensitive data" goes, it's rarely related to its size. Anything capable of holding even a megabyte of data could easily be considered a major risk for sensitive information loss.

The iPod is just one of the many ways for data to walk out the door. PDAs are just as bad, and are probably the most commonly accepted data storage device let in the building short of cell phones.

All the technology does is make theft easier. It's just like the argument of guns.. it isn't the object that's dangerous, the object is only the enabler. It's the person using the object that makes it dangerous. ("guns don't kill people, people kill peope" -- "ipods don't steal company secrets, people steal company secrets")

In other words, if you are paranoid about your employees taking an iPod into work, why on earth did you hire them for a sensitive position? Them bringing that iPod in is, for the most part, completely beyond your control. (and the iPod is just one of many dozens of vectors to worry about) Whether or not you hire them (and let them, with or without their iPod, in the door) is totally within your control. Pick your battles wisely.

Re:I don't get it.

[Kadin2048]

In other words, if you are paranoid about your employees taking an iPod into work, why on earth did you hire them for a sensitive position?

Absolutely.

You're never going to be able to keep up with the ever-decreasing size of data storage devices: it's going to be a losing battle. If somebody wants to sneak something in or out of your secure area, unless they're being watched at every moment by someone you trust, they're going to have the opportunity. Flash drives, SD/MMC cards, iPods, cellphones that can be mounted as Mass Storage Class USB devices ... I could think of half a dozen ways that a motivated person could sneak data into or out of a "secure" area.

If your security depends on your employees not stealing because they're not allowed to bring portable devices in, you're in trouble. It's not going to work, and you're always going to be on the losing side of the battle as storage densities increase and components become further miniaturized and integrated into other otherwise-innocuous devices.

Good data security depends on restricting access to people who are trusted: people who aren't going to steal it, whether via an iPod or a USB stick or with a paper and pencil.

Re:I don't get it.

[a_nonamiss]

Precisely. I could EASILY get on of these into any data center into which I had physical access. I could nochelantly stick it into a USB port, a little bit of hocus-pocus with an autorun command, and I could easily accomplish the same thing without much effort at all. Hardly rocket surgery.

Re:I don't get it.

[Fordiman]

Nah, wouldn't work. At the protocol level, everything's just data... and therefore can be spoofed.

We really should to replace SMTP with something that can prevent abuse - but we won't. There's only a benefit for 100% adoption, and even then, SMTP would still hang around as a legacy target.

Re:I don't get it.

[Anonymous Coward]

Please, everyone knows it's iPenis.

Re:I don't get it.

[thegattaca]

Yeh, you really don't get it then. Windows user.

Re:I don't get it.

[engagebot]

What's the big deal that an iPod can do it?

The big deal is because Harrison Ford did it in the new movie 'Firewall'. Just seeing it done made people realize that an iPod is nothing but a hard drive. Sounds stupid, but why else would the story be on here now?

Re:I don't get it.

[Anonymous Coward]

you don't post very often; near as I can tell that's a good thing. Maybe you should expand on it and reduce posting even further.

Otherswise? sit down and be quiet. The adults are talking.

Re:I don't get it.

[oshy]

You can get some CD players that can take DVDs full of music. Burn a music track and the rest with data so you can even give them a blast of music

Re:I don't get it.

[oshy]

Everyone keeps saying iPod when any MP3 player with hard disk (and there are many) will do.

Re:I don't get it.

[Lumpy]

???

Ok so what if I work for the cleaning service and watch one of your late-night employees get up and go to the bathroom. I simply get to his/her machine before the screensaver timeout and plug in. Boom in 2 minutes I have 60Gig of goodies that my employer hired me to gather from the competition.

It certianly looks like you do not think like a security specalist as that was the first thogh on my mind. Hell a good corperate harvester could easily talk the target into letting them plug in by asking in broken english... "Can I get a charge?"

Re:I don't get it.

[Anonymous Coward]

A software vendor I have to work with has an Outlook 2003 email filter that keeps stripping out the plain text files I attach with the extension ".sh".
Unbelievable.

Re:I don't get it.

[Anonymous Coward]

Flash drives are a "dumb" storage media. They can only store what you manually tell them to store. You need attach the flash drive to a computer and then use the computer as the "brains" of the operation. You can not automatically run a program directly on the flash drive as you would on an iPod.

An iPod has it's own processing power and can be programmed. You don't hook the iPod up to the computer to run an application. You hook the iPod up to the computer so it can get on the network.

The point is that the iPod, unlike a flash drive, is a mini-computer that can be running programs out of the prying eyes of the IT department. If the IT guy sees a flash drive attached to your computer, he will look at your screen to see what you are doing with the flash drive, because he knows it is just storage space and that you have to be doing something on the computer to make the flash drive a threat. With the iPod though, you can be checking your email while that nice little iPod scans everyone's email. The IT guy will see you working on your email and won't think twice about the iPod.

The wakeup call is that devices like the iPod are actually mini computers that can perform tasks. This is quite unlike a flash drive which is just a storage media.

Re:I don't get it.

[Danse]

Having worked at several large companies (including a fortune 50 company), I can state from experience that many companies simply wouldn't know you attached an external drive to your machine, let alone an iPod!

Having worked in a few secure facilities, I can state from experience that you probably wouldn't make it into the building with such a device.

Re:I don't get it.

[GlassHeart]

what if I work for the cleaning service and watch one of your late-night employees get up and go to the bathroom. I simply get to his/her machine before the screensaver timeout and plug in. Boom in 2 minutes I have 60Gig of goodies that my employer hired me to gather from the competition.

The real question is, on what I/O port did you manage to get 4 Gbps of data rate? :)

Besides, your threat scenario is easily defeated, just like arresting anybody carrying a red lightsaber in the Star Wars universe. Just arrest all janitors with iPods, they're not paid that much money.

Re:I don't get it.

[Anonymous Coward]

yea, like someone using LookOut 2003 would even know how to run a shell script!(?)

Re:I don't get it.

[Anonymous Coward]

"Boom" Heehee, fan of Steve's keynote adresses, I bet? ;)

Re:I don't get it.

[v1]

Custodial Staff (or "sanitation engineers" or just plain "janitors") amaze me at how much trust is placed in them for such a low wage. It's virtually universal for the custodians to have the master keys to the building and (almost) every room in the building, and they have this unrestricted, unsupervised access for several hours at a time, six times a week, at night. I can't dream up a better scenario for data theft. I'm surprised this isn't a bigger problem in corproate america.

In other news...

[Anonymous Coward]

Your employees will steal information if they want to. This has nothing to do with the iPod. I have walked out of work with harddisks before. Treat your employees well and they won't feel the need to screw you.

Re:In other news...

[blankoboy]

Please remind me not to hire you! =)

Re:In other news...

[shmlco]

And in other news, Harrison Ford had this to say: "See! All the geeks laughed at the iPod bit in Firewall, but we knew what we were doing!"

Re:In other news...

[DrSkwid]

> Treat your employees well and they won't feel the need to screw you.

Unless, of course, they were hired to screw you.
Or decided to screw you before they arrived.

Animal Rights activists do plenty of infiltration, indeed, it is one of the preferred methods of action.

http://www.animal-lib.org.au/more_interviews/deros e/

I'm glad it was just the iPod that get's the bad rep. Those white headphones are such a giveaway and by extension, smokescreen.

Re:In other news...

[CastrTroy]

Well then maybe you should have checked out a few more references. Ensure that the number they give you for that place they worked at is a real company, and make sure that the number actually corresponds to that company. Do you think the NSA just hires people without doing proper background checks, making sure as well they can that the person they are hiring is trust worthy? If the data you're dealing with at your company is that important, I think it would be well worth the company's money to do this kind of work ahead of time so you don't get screwed over later. It won't work perfectly, but it will probably work pretty well and give the company good peace of mind.

Under the radar.

[Anonymous Coward]

"An insider threat would only need to plug the iPod into a computer's USB port."

Bet the good guys never saw that coming

Thanks Abe

[Mrs. Grundy]

We can all give Abe Usher the bird for offering management a reason to prohibit iPods a work. Thanks Abe--you're off my Christmas Card list.

Re:Thanks Abe

[Lehk228]

actually it is cheaper to pull the usb mass storage drivers out of any machine that doesn't need them.

Re:Thanks Abe

[somersault]

well if you've got your mass storage device, you could mount off of that (assuming it hasnt been disabled and the BIOS been protected, though you could wipe the BIOS, assuming the case isnt locked.. etc). There will always be a way to achieve your objective, if you are bothered enough. Unless your objective is to sneeze 5 minutes ago. Actually even then you could sneeze, then in 5 minutes you will have achieved your objective.. hmm :s

heh

[bLindmOnkey]

iSpy

Re:heh

[Anonymous Coward]

You mean Windows Spy. That's what this is -- an exploit of the security flaws in all Windows computers by virtue of their OS. Any USB key drive, hard drive, or other external storage device can be set to do this. In fact, you can, because of Windows' lovingly-insecure auto-play feature, probably setup a CD-RW disc to do this. Or DVD-RW. (Or DVD+RW. Or DVD-RAM.)

Re:heh

[Lothsahn]

With my little i?

Thanks, Abe...

[TheIndifferentiate]

Now the kajillions of non-corporate data stealing types of iPod users will probably be shut down because you had a point to prove.

So what's the difference...

[Anonymous Coward]

with carrying a USB key around? it's not that tough to search the network for files containing "Confidential" or whatever keyword and copying them on your key. If you don't trust your employees, their network access shouldn't allow getting at sensitive documents anyways.

Re:So what's the difference...

[__aaclcg7560]

Most USB keys max out at 1GB. However, if you want to steal more than 1GB at time, a 60GB iPod is the way to go.

One video game company that I worked for banned all portable storage devices since they didn't want any files appearing on the internet. The smallest file was 4MB for Gameboy Advance titles and the largest was 4.5GB PS2/XBox titles. I had to get special permission for my 32MB flash card since I was using that to store homework files for the programming classes I was taking at the time. Since half of the projects that I did was for the Gameboy Advance, I was always under suspicion that I might steal a file.

Re:So what's the difference...

[BrokenHalo]

Most USB keys max out at 1GB. However, if you want to steal more than 1GB at time, a 60GB iPod is the way to go.

That's what your IT guys are paid to monitor. If someone is sucking down 60 GB of files at a time, that should ring some sort of alarm bell. Most sites I've worked at would raise eyebrows at a 500MB download.

Re:So what's the difference...

[Anonymous Coward]

I was always under suspicion that I might steal a file.

Such a 'favour' should always be repaid by actually stealing a file... I mean, if they think you're gonna do it, don't disappoint them. Make sure they know that by having the suspicion against you they forced your hand and *made* you steal the file.

Sure, you'll still get fired but if you stole the right file you can simply publish that and hurt them right back. Just because they have the power doesn't mean they should abuse it. But if they do, strike back.

As Newton said: For every action there is an equal and opposite reaction, and while he was thinking physics it also applies perfectly to any kind of human interaction. Call it karma perhaps - you get what you give, and if you (resonably) trust your employees, they'll be much more likely to repay that trust in kind.

Re:So what's the difference...

[LurkerXXX]

If he has access to the directories where those files are stored, why would that raise any eyebrows? Where I work, people are expected to be accessing the files they have permission for. The only raised eyebrows would come from accessing files they don't have permisssion to get to. If he shouldn't be downloading those files for any reason, he shouldn't have access to them in the first place.

Re:So what's the difference...

[__aaclcg7560]

Actually, I left a note in my project folder that if my project screws up after I left the company, it was my supervisor's fault for very specific reasons. My supervisor eventually retaliated a year later by firing my two assistants that I trained since they weren't "team players".

a "program" isn't needed

[Barbarian]

Despite what the article says, a special program isn't needed. All that is needed is for someone to mount the ipod as a disk drive and run a batch file. It could be as simple as one line calling xcopy for each file type (pdf, doc, etc.) running a loop from A to Z for the drives.

Re:a "program" isn't needed

[NetRAVEN5000]

"All that is needed is for someone to mount the ipod as a disk drive"

Actually you don't even need an iPod at all - ANY storage device would do just fine -- flash drive, portable hard drive, camera, cellphone (I think SOME cellphones have some sort of storage functionality through bluetooth so if the PC has bluetooth you might be able to transfer the data to your phone), non-iPod MP3 players. . .

Hell, if the files are small enough you could just e-mail them - many Web e-mail services allow up to 10MB or so filesizes. Just send them to your Yahoo! or GMail account.

Re:a "program" isn't needed

[Anonymous Coward]

As a creative professional with 18 years experience programming batch files, please don't make fun of me. I'll have you know that I've written programs to copy from one floppy to another, from the hard drive to a floppy, and even from a floppy to a hard drive! Programming DOS .BAT files is no less of a programming task than say, a relational database or 3D FPS. I'll bet I can write a program to copy a file in far fewer lines than it would take a so-called "educated" professional in a "real" programming language like HTML, SQL, FLASH, DirectX, or even Assembly!

Re:a "program" isn't needed

[frizzantik]

A batch file is a program...

Re:a "program" isn't needed

[Anonymous Coward]

Right on, brother! Like I was saying...

Re:a "program" isn't needed

[really?]

Sure you could; but, how is that headline grabbing? Where is the sensationalism? Yellow journalism at its best ...

Re:a "program" isn't needed

[Anonymous Coward]

I had success renaming .zip files to .mp3 and putting them on a cell phone I had a long time ago. It wouldnt let me do it otherwise, but as soon as the file extension matched it would accept the file but be unable to play it.

So I concur that cell phone would be a possible exploit venue.

Re:a "program" isn't needed

[somersault]

email is a lot more easy to monitor than copying files over the network, and is likely backed up too; I dont think that would be a great method for espionage, heh

Re:a "program" isn't needed

[just_another_sean]

I think the most telling part of your post is that you list HTML, SQL and FLASH as programming languages.

Re:a "program" isn't needed

[NetRAVEN5000]

"email is a lot more easy to monitor than copying files over the network, and is likely backed up too; I dont think that would be a great method for espionage, heh"

If you're not using their e-mail servers (ie if you use GMail, Yahoo, or Hotmail or something) I'm not so sure they'd have a very easy time catching it.

Re:a "program" isn't needed

[cloudmaster]

Despite what the article says, all that is needed is for someone to mount a disk drive and run a batch file. It could be as simple as one line calling xcopy for each file type (pdf, doc, etc.) running a loop from A to Z for the drives.

There, fixed it for you. Except that it'll still get every file, instead of reading the contents and determining if there's anything potentially useful inside, and looping from drive A to drive Z requires that you have every network share mounted locally. Never mind that if there's something in A or B that's secret, it might be easier to just take the floppy out and bring it with you...

Re:a "program" isn't needed

[Danga]

email is a lot more easy to monitor than copying files over the network, and is likely backed up too

He/she specifically said web-mail: "many Web e-mail services allow up to 10MB or so filesizes. Just send them to your Yahoo! or GMail account."

Now I know that they said send "to" and not "from" but you could just mail it to the same address you are sending it from.

It is MUCH harder to monitor web-mail (if it is allowed in the first place) than to monitor your companies internal e-mail and you also don't have a backup in the same form as e-mail backups. A person would have to be pretty dumb to not use an external e-mail system if they wanted to send files that they shouldn't be sending. I do agree that it is much easier to monitor internal e-mail than it is to monitor all network activity.

Re:a "program" isn't needed

[assassinator42]

What about just plain FTP?

Just plug it in?

[ejdmoo]

An insider threat would only need to plug the iPod into a computer's USB port. ...not only that, the threat would have to have access to said files. Granted, it's an insider threat, but I fail to see the significance here.

Isn't this just:
1. Search for files containing "Confidential" or "sensitive" or "budget" or "payroll"
2. Copy to iPod

? Because I can do that pretty easily and more accurately than software.

Also, why the hell does everything have to have "pod" in the name? Now it's cool? Why can't people coin cool terms anymore??

Re:Just plug it in?

[Wisgary]

iThe iWord iPod iIs iJust iAs iCool iAs iThis.

Re:Just plug it in?

[AngryMuppet]

Also, why the hell does everything have to have "pod" in the name? Now it's cool? Why can't people coin cool terms anymore??

We're being overrun by pod people!

Re:Just plug it in?

[geofferensis]

Well the iPod is a crucial part of the plan. If you do this with something else then security might want to check what is on the drive and then you are busted. But with an iPod you just say, "Look my man, I am just chilling to the Postal Service with my iPod." Then the security guys will just be like, "Alright most cool dude, never mind. We apologize for interrupting your time of groove, have a good day." See, you have to think beyond the purely technical requirements to pull off a real steal. Peace.

Re:Just plug it in?

[greg1104]

Because I can do that pretty easily and more accurately than software.

Yes, but you sitting on your PC typing "confidential" can draw attention to what you're doing that the iPod slurping doesn't. Also, records of what you've did can be left behind in various history files on the PC, especially if you're caught in the middle and don't have a chance to erase them.

What's the deal with iPod?

[kerouacsgp]

What's the deal with iPod? Any form of mass storage media applies, usb drives, CD-Rs? what's the deal with singling out the iPod?

Re:What's the deal with iPod?

[Monkeys!!!]

Because if the word iPod is used it reaches a larger audience then, say, Portable HDD. It's all about using words that people are more likely to recognise.

Re:What's the deal with iPod?

[somersault]

uh because the iPod isn't just a mass storage media, it has a little computer inside it too. I think you mean why single it out as opposed to another mp3 player, or a phone, etc..

Why not block the USB port?

[Travoltus]

What business needs to allow its employees access to a USB port?

I'm not saying none do... but I work in a b2b company and we don't need it.

Re:Why not block the USB port?

[Yehtmae]

Any business that allows their employees to sync their PDAs/mobiles with their contacts and calendars for instance?

Re:Why not block the USB port?

[RomanianCracker]

Well there's those pesky keyboards and mice, oh and scanners, fingerprint scanners...

Re:Why not block the USB port?

[Daltorak]

It's actually pretty easy for a company to prevent employees from writing to mass storage devices with XP SP2: Change one registry key on every machine... simple stuff with an Active Directory environment.

More significantly though, this kind of thing really makes a case for Microsoft's Rights Management Services technology... even if you were able to copy the physical documents onto an iPod, they'd be completely useless to you outside the organization because they're encrypted, and only by talking to the RMS server (located internally) can they be unlocked.

Re:Why not block the USB port?

[Anonymous Coward]

NOTHING is worth acceptance of "Rights Management" technology. Especially something that can be made much harder by changing a single registry key.

Re:Why not block the USB port?

[Travoltus]

Ok, correction, why not disable USB mass storage?

And my workplace still uses PS/2 mice and keyboards.

Re:Why not block the USB port?

[n6kuy]

Not to mention JTAG cables and those stupid dongles that EDA software insists upon..

Re:Why not block the USB port?

[imemyself]

Which totally defeats the point of banning USB keys/external HDD's/iPod. I mean it is brain-dead easy to copy files on to a Palm or PocketPC, and with an CF or SD card(I believe they are up to the 2 or 4 GB range now-days) you could get a ton of stuff out of work. Hell, you could even hide the card in your shoe or something afterwards if you weren't allowed to take your PDA home or something. And even without their USB ports, there's Bluetooth(for some phones/PDAs and a few computers). There is no way that a company can absolutely prevent someone from taking home files that they have access to, unless they're like the CIA/NSA or something(And haven't there been a few cases of people getting computer files out of those places?). There are too many ways to get the data out, and too many ways to get around security.

Re:Why not block the USB port?

[jonwil]

All this Rights Management stuff is good but what about all the stuff you CANT protect that way.

Let me know when someone has come up with a way to protect C/C++ code (reference the windows source leak, the HL2 source leak etc) with this kind of technology...

Re:Why not block the USB port?

[alok_naik]

USB keyboard, mouse?

Re:Why not block the USB port?

[KDR_11k]

Well, ask MS to add that to Visual Studio (or check the manuals if it's not included already). Not that hard to have a compiler eat encrypted data (perhaps with remote compilation as well).

Re:Why not block the USB port?

[spiritu]

"unless they're like the CIA/NSA or something"

Well, yeah. In that case, you just make a phone call to the Washington Post, tell them your national security secrets, and they publish your work secrets for all the world to see. If you want a copy of them printed out for you, you just walk out of work with nothing at all, and then purchase the paper from the magazine stand at the Metro. Easy as pie.

Re:Why not block the USB port?

[himself]

imemyself wrote:
>
> I mean it is brain-dead easy to copy files on to a Palm or PocketPC, and
> with an CF or SD card(I believe they are up to the 2 or 4 GB range
> now-days) you could get a ton of stuff out of work. Hell, you could even
> hide the card in your shoe or something afterwards if you weren't allowed
> to take your PDA home or something
>
      Am I the only one who read this and thought of Christopher Walken telling the story about carrying a gold watch in his ass while in a POW camp?

Reminiscence of a former job

[DamnedNice]

Reminds me of a job I used to work at. It was a call center where nearly every computer on the production floor was configured (by the phone peons like me) as a file server. People would rip DVDs and download on the idle machines, then burn stuff and take it home. It was sweet; I just wish 4GB ThumbDrives and USB iPods were available at the time! As for the app, seems like it was a good idea used for the wrong purpose. Surely this would have been better employed somewhere like SourceForge, where people could contribute their opinions and ideas?

Unofficially called...

[Oyume]

iSuck

Thank you, I'll be here all week!
Jds

Re:Unofficially called...

[psychosquee]

Wouldn't 'iSlurp' fit better?

Re:Unofficially called...

[hacksaw56]

You suck? Well... okay, if you say so.

Quick...

[mrhandstand]

/. the download site!!! If we crush the site and burnup the download bandwidth, I'll be able to keep using my iPod at work! Oh wait....

Less-than-competent physical security

[tepples]

There's nothing you could do with the iPod that you couldn't do with your normal computer and any random external hard drive [...] What's the big deal that an iPod can do it?

Because an iPod is a hard drive disguised as a music player, which may help you get past less-than-competent physical security in ways that you couldn't with a pure hard drive.

Re:Less-than-competent physical security

[damsa]

If the security wouldn't know that an iPod is also a hard drive, how would they know that you are carrying a hard drive in the first place. Security guy, what is that I keep music on it. Okay go ahead.

Re:Less-than-competent physical security

[tepples]

how would they know that you are carrying a hard drive in the first place.
-- what is that
-- I keep music on it.

"Where's the headphone jack? Where's the play button?" It's more obvious to a rent-a-cop that an iPod is a music player because 1. it has those goofy white earbuds (or replacement headphones for those who prefer not to be mugged) plugged into it and 2. Apple advertises on TV.

Re:Less-than-competent physical security

[damsa]

I bet a box of donuts that if you took in a external 2.5in hard drive they will have no idea that it is a hard drive. You can tell them that its a palm rest.

Re:Less-than-competent physical security

[Feanturi]

get past less-than-competent physical security in ways that you couldn't with a pure hard drive.

Next on www.hackaday.com: Modding your external harddrive/memory key to have fake headphones. You supply the fake head-bobbing and humming along.

Re:Less-than-competent physical security

[E8086]

Don't bet a box of doughnuts, use the box of doughnuts.
Guard: hey, what's that?
Random employee: It's a box of doughnuts.
Guard: OK, go right in/you're free to leave.

What they didn't know is within that innocently looking box of cream filled pastries could have been a 300+GB hdd or even a smaller 128mb flash drive.

At least where I work the nice people at the security/info desk are there as formality to keep unauthorized people, not devices, out.

The only way to completely restrict data would be to have full searches of everyone, never know where someone might try to hide a small usb drive, entering and exiting the building or secure area and have one of those flashy things from MiB just to be sure they didn't try to memorize any sensitive documents and so they don't remember the searches.

Locked Down USB Ports!

[GaryPatterson]

I work in a ... large... company (one of the top Fortune ones) and there was a global mandate last year to lock all USB access for data storage devices unless users can make a special case.

That means that USB keys, iPods, plug-in hard drives and so on not only fail to work here, but they generate a little message to the IT department.

Some users, like our media guys, need this access for their work (in this case, digital camera images), and they have an exemption.

This lockdown removes the possibility for portable storage device-based data copying.

Of course, I can always stay late, take the PC apart, remove the hard drive, take it home and copy it, come in early the next day and re-install it. But that's just naughty.

My point is that IT security policies can easily stop this sort of issue, and most large companies are already doing this.

Re:Locked Down USB Ports!

[Anonymous Coward]

This lockdown removes the possibility for portable storage device-based data copying.

I assume you don't have CD drives, floppy disk drives, and you password protect the BIOS and lock it down to not *boot* from USB devices (or floppy or CD) and also don't allow surfing the Internet at all? I could easily stick gpg on some random fileserver (or download it legitimately), encrypt all your data, and send stego "pictures" to my friends and family.

If you do lock down all your BIOSes, I'd be interested to know which tools you use. If you use your hands, I pity you. I imagine there are ways to get major PC vendors to provide custom BIOS flash settings that you can apply (or have factory installed), right?

Re:Locked Down USB Ports!

[GaryPatterson]

It's not hard to circumvent the security, and I'm not in IT so I do absolutely nothing. My point was not to go on about how good the company I work for is, but to highlight that companies realised the USB-storage issue at least a year or two back and took some steps.

Re:Locked Down USB Ports!

[Anonymous Coward]

Actually, one of my previous employers had this sticker they would attach to the computers, both on the sides of the case and the USB ports.

If you remove the stickers, the colors of the stickers would change and the security guys, who would go arround the office after hours, would immediately see that the color changed and you would be reported to the human resources for security violations.

It ticked me off when I was working there because we were supposed to develop computer products but seeing this article, I guess I see where they are coming from.

Re:Locked Down USB Ports!

[Tomfrh]

I worked at a company that did this. I just http mailed things to myself.

Re:Locked Down USB Ports!

[penguin_asylum]

And if you can't plug in an external storage device, what stops you from making a program that ftps or sendmails the files to you?

This articles is sort of ridiculous if you ask me...

Re:Locked Down USB Ports!

[whitehatlurker]

I just http mailed things to myself.

Hey, information wants to be free. I mail things to the competition.

Now, I only use the computers of cow-orkers I dislike, but it's the thought that counts.

Re:Locked Down USB Ports!

[LordSnooty]

My point is that IT security policies can easily stop this sort of issue, and most large companies are already doing this.

Except you have to give exemptions for some guys, because they absolutely NEED the devices... and then your watertight policy isn't so watertight. But I guess you can trust these guys, right?

Re:Locked Down USB Ports!

[Anonymous Coward]

Does that mean that your company goes out of its way to purchase non-USB keyboards and mouses? Can one even purchase a system with PS/2 inputs from Dell or HP anymore? Or do you simply superglue the keyboard and mouse plugs into the connectors? Inquiring minds want to know.

Re:Locked Down USB Ports!

[KDR_11k]

Of course they don't boot off removable media unless you know the bios password, floppy drives are a dying breed and CDs aren't writable if the drive isn't a writer. Sending encrypted data home can be forbidden with an appropriate policy (e.g. "no sending non-work-related email"/"no using external email services", if internet usage has to be enabled at all).

Besides, there will always be legal consequences for leaking data or attempting to.

Re:Locked Down USB Ports!

[snero3]

Or if it is not hardware locked down (BIOS etc...) why not just boot knoppix and coping that way. At least this saves from you a those horrible early mornings.

Re:Locked Down USB Ports!

[GaryPatterson]

Any global mandates like this require exemptions. That's part of life - there's no 'one size fits all' policy in IT security.

The thing is to minimise risk. You remove options for the general staff, as they're probably your biggest risk (temp staff in the call centre I work at). At some point you have to trust some of your staff. Minimise the number and you minimise the risk.

But in the context of the actual article, the USB lock-out is a good thing for corporations. Use it with other policies for better results, cleaner clothes and whiter whites.

Re:Locked Down USB Ports!

[Nimey]

ITYM policies and enforcement. $CORP can have a policy saying that you can't use USB sticks and the like, but they've got to have s/w to help enforce it.

Re:Locked Down USB Ports!

[sootman]

Of course, I can always stay late, take the PC apart, remove the hard drive, take it home and copy it, come in early the next day and re-install it. But that's just naughty.

Plus, a company like yours is probably using the chassis intrusion detection system that comes with most corporate PCs. Oops. :-)

Re:Locked Down USB Ports!

[Danga]

why not just boot knoppix and coping that way.

I had the same idea and if the actual hardware is not locked down then that would be a very easy way to get around local computer restrictions. If a person were to make sure to copy all the files they wanted to the local hard drive first, what would stop them from then booting up knoppix, plugging in the external disk and copying them over that way?

Re:Locked Down USB Ports!

[Danga]

CDs aren't writable if the drive isn't a writer.

That doesn't stop you from booting up knoppix and then plugging in a USB device to then copy everything you want. Thats how I would do it.

Re:Locked Down USB Ports!

[OverlordQ]

Got any links about locking down USB ports in such a manner?

Re:Locked Down USB Ports!

[KDR_11k]

How do you boot Knoppix if you can't access the boot device selection without the BIOS password? Do you want to open the case and reset the CMOS? That'd leave so many traces you can be sure to land in court.

Re:Locked Down USB Ports!

[Danga]

How do you boot Knoppix if you can't access the boot device selection without the BIOS password?

I meant if you knew the password or one was not set. I took your comment: "CDs aren't writable if the drive isn't a writer." to mean if they could boot up off of a CD and the drive was not writable that there would not be a way to copy the data off since you could not write to the CD.

As far as reseting the BIOS, how many places (besides really big corporations) actually lock down the cases? This is an honest question and I really have no idea how common it is. I have worked for two pretty large universities and all of the lab computers were usually locked down pretty well but most office computers did not have the cases locked up at all.

Re:Locked Down USB Ports!

[KDR_11k]

Even if the case isn't locked down (some poster mentioned stickers that indicate tampering with a color change...) a disappearing BIOS password and configuration will raise some questions.

Re:Locked Down USB Ports!

[Danga]

a disappearing BIOS password and configuration will raise some questions.

In the situation I was in at the offices around the university I would say 99% of the people using the computers would not have any clue that the BIOS password was missing (much less even know what the BIOS is). There was no checking going on seeing if the thousands of computers BIOS's had been reset either. I also mentioned that none of the machines (in offices) had their hardware locked down either (not even those stickers to know if someone had gone inside). All of the lab computers were locked down, but the computers I would see people wanting access to were the ones in the offices which were pretty insecure.

I am curious how it is at other places since the norm at two large universities seemed to be "lock down the lab computers" but leave the office computers hardware open. All of the sensitive information was accessed from the office computers too, so it would have been trivial to copy what you needed locally and then copy it off to a USB device.

So how many places actually lockdown the actual hardware of a computer that would prevent someone from reseting the BIOS password and if the password were to be reset how many places would even know? I am curious since I have no idea, but from my limited experience it seemed not to be common.

Re:Locked Down USB Ports!

[Anonymous Coward]

I doubt changing the BIOS password would be noticable, the machines at my work have uptimes of 6 months+... time enough to get yourself a new job. What they do use here is that all the machines are constantly pinged by a server, so any reboots are noted. Of course, you could always e.g. jab a screwdriver into the PSU fan to manufacture an apparent shutdown-causing hardware failure. Use that to cover booting into knoppix and you're good. You can also put a micro-computer (like a gumstix) on the network somewhere as a man-in-the-middle and send data to that.
Really paranoid places use CCTV to monitor the computers and prevent tampering.

Re:Locked Down USB Ports!

[TALlama]

I used to go out to customer sites for my previous paycheck,and I'd bring all our company's product installers on my iPod. Plug it in, download a few files, and away you went. It made things simple, quick and effecient; I just had to make sure the versions on my iPod were up to date (thanks, cron!) and all was well with the world.

But companies like yours were why I was forced to also have everything on my PowerBook, which had a CD burner. I'd get to those companies and have to bring out the PowerBook to burn the Linux or Windows installers to disc, which we would then push over. Not too bad, but still a few extra steps that slowed down the process.

How to do it (nothing new)

[Anonymous Coward]

This is nothing new whatsoever.

Back in high school, I used a floppy and a couple batch files to grab .pwl files off the Windows 98 boxes for cracking at home.

Man, I wish I knew it was called "pod-slurping" back then, I would have been WAYYYY cooler.

Re:How to do it (nothing new)

[popeyethesailor]

Back in high school, I used a floppy and a couple batch files to grab .pwl files off the Windows 98 boxes for cracking at home.

Heh. that's like learning Karate to kick a blind 98-year old cripple.

Re:How to do it (nothing new)

[Andrew Kismet]

But it's still so fun!

Re:How to do it (nothing new)

[Anonymous Coward]

Back in high school, I got laid.

Fuckin' nerds.

*sigh*

[Anonymous Coward]

Equally "dangerous" could be any other USB device including flash drives, so why all the attention to ipods specifically?

Yay sensationalist headlines on non-issues!

[SuperBanana]

CNET: "Abe Usher, a 10-year veteran of the security industry, created an application that runs on an iPod and can search corporate networks for files likely to contain business-critical data."

Actual article: "I've created an application (slurp.exe) that demonstrates this concept. When the program is run from an iPod, it can very quickly copy data files off of a PC and on to an iPod."

Am I reading it correctly that CNet doesn't understand the difference between launching an executeable stored on an external media device, and somehow running it "on" the media device? Am I the only one who thinks Mr. Usher could have been clearer, but intentionally wasn't? Or that both are playing it as "plug an ipod in, instantly hack a machine", like in the movies where magical devices "hack" systems?

It's sensationalist bullshit- all admins would need to do is set up windows to not permit mounting removeable media drives/USB mass storage devices. Or control what executables are permitted to be launched. I'm sure an expert Windows sysadmin could name half a dozen MORE system/domain level ways to stop this dead in its tracks. It strikes me as a distinct non-issue for any company with a properly managed/secured windows network. But hey, that doesn't stop CNet from crying "the sky is falling, the sky is falling!"

"Security consultant releases overblown vulnerability with a confusing and/or misleading description to generate hits to his website, more at 11"...

Re:Yay sensationalist headlines on non-issues!

[Jeff DeMaagd]

In other words, business as usual for C|Net.

Re:Yay sensationalist headlines on non-issues!

[pc486]

Am I reading it correctly that CNet doesn't understand the difference between launching an executeable stored on an external media device, and somehow running it "on" the media device? Am I the only one who thinks Mr. Usher could have been clearer, but intentionally wasn't? Or that both are playing it as "plug an ipod in, instantly hack a machine", like in the movies where magical devices "hack" systems?

I wouldn't bet on that. Hardware really can magically and (near) instantly hack a host: Don't trust your hardware

Re:Yay sensationalist headlines on non-issues!

[mattmacf]

like in the movies where magical devices "hack" systems?
It's sensationalist bullshit

Exactly. "Generic USB Device Can Be Used to Copy Data" just doesn't generate ad revenue. Add an iProduct, a 1337 h@x0r script, and some intentionally misleading nonsense about security vulnerabilities, however, and you have an instant headline.

In capitalist America, headlines create news [/not sarcasm]

Re:Yay sensationalist headlines on non-issues!

[Technician]

Am I reading it correctly that CNet doesn't understand the difference between launching an executeable stored on an external media device, and somehow running it "on" the media device?

You are reading it right. I just finished viewing a Power Point Presentation titled something like "Owned by an i-Pod". The discussion was not about USB, but Fireware which is peer to peer. It can scan memory, do direct reads and writes, etc without the host OS. I would recommend going through the list of seminar materials and find the Power Point presentation.

The link to the Powere Point presentation;
http://pacsec.jp/psj04/psj04-dornseif-e.ppt

I saw in another post USB has some of the same features as Firewire. It may be possible for code running on a USB device to slurp the host just like in the movies.

Re:Yay sensationalist headlines on non-issues!

[ObsessiveMathsFreak]

I'm sure an expert Windows sysadmin could name half a dozen MORE system/domain level ways to stop this dead in its tracks.

Even if such a mythical creature existed, what's the guarantee that they would either have the time or resources or management support to implement such a system. Once the boss can't get files on his key from work, the whole thing would have to be tossed.

Re:Yay sensationalist headlines on non-issues!

[somersault]

hmm true, there are a lot more immediate security bugs in Windows to be worried about than internal employees (not to say that you shouldnt setup security privileges properly, but when you start worrying about people copying stuff to take home then it's less about computer security and more about noticing which employee has a beef with the company/isnt getting paid enough/whatever.. most systems can be cracked through social engineering and whatnot. I'm an admin here and already have access to the whole network, so I dont spend too much time thinking about how I can hack in.. though maybe, obviously, I should. Would be interesting one day to give myself no privileges and see what ways there are to break in :s

Re:Yay sensationalist headlines on non-issues!

[Anonymous Coward]

"I saw in another post USB has some of the same features as Firewire"

Not this feature though. In USB all DMA is initiated by the host, your OS decides, based on instructions from the driver, which areas to make available to the connected USB device. So the OS can ensure that when you copy InvestorProfile.ppt to that USB stick, it doesn't get accompanied by PatentWeHaveYetToFile.pdf and CustomerContacts.xls.

With firewire there is no host vs target distinction, so any device can initiate a DMA transfer. The initiator gets to move data back and forth between RAM of any other Firewire device and itself, entirely in hardware. The Firewire specification permits PC-type hosts to have a firewire controller which limits DMA access, e.g allocating 64Mbytes of RAM as a buffer and only accessing that. But obviously it's cheaper not to implement this feature, and most people can't imagine what they would use it /for/ anyway.

Re:Yay sensationalist headlines on non-issues!

[anothy]

Am I reading it correctly that CNet doesn't understand the difference between launching an executeable stored on an external media device, and somehow running it "on" the media device?

the only thing that surprises me here is that you seem to expect them to. sure, most people can probably deal with the distinction when we're talking about a floppy or CD. but iPods? c'mon, they, y'know, do stuff. the iPod can run software. it's not so crazy to think that it might be doing stuff in this case, too. the fact that it doesn't happen to be in this case is hardly relevant.

CNet's primary audience is not geeks. the closest their target audience gets is ITS managers, and they go more businessy from there.

Re:Yay sensationalist headlines on non-issues!

[Anonymous Coward]

The program is just a glorified search for .doc, .pdf, .xls, etc.

USB Thumdrive...

[kcbanner]

I have a 1gb Sandisk Cruzer I use to run firefox, abiword, thunderbird, etc...http://portableapps.com/. I dont think this "exploit" is limited to an iPod. Probably better driver support for USB Thumbdrives anyway.

Also, doesn't this depend on user priveleges? Dont ban iPods, lower priveleges :P

-kcbanner

Re:USB Thumdrive...

[JTD121]

I did something like this when I was working at a call center late last year. I took my flash drive in with me and tried as hard as I could to get some data onto it or off of it, but eventually just hosted it on a web server I have access to, and then got it, or put it, on there...

Nothing too bad, though, just a bunch of scripts and programs that they had on their COMPLETELY OPEN file server...Except for the folders containing their specialized XP images...I should have stayed there and tried to come up with something like this.

Thanks Abe

[HeavensBlade23]

It's cheaper to ban the ipod from the workplace than to epoxy the USB ports shut or implement a sensible data access policy, therefore that is what management will do. Thanks a bunch, for making the workplace that much less bearable.

Awh Come on!

[Anonymous Coward]

Don't tell me this thing doesn't run on thumbdrive. Enuf of iPod being a threat.

Why always the iPod?

[diamondsw]

Why are stories like this always linked to the iPod? A USB key or portable hard drive could do the same thing. All this will do is keep people from using iPod's at work. If you're that paranoid and don't trust your employees (a bad sign to begin with), lock down the USB ports on their computers, or prevent additional drives from mounting. But don't pin crap like this on the iPod.

Re:Why always the iPod?

[BoneFlower]

An ipod has a well defined function that has nothing to do with data storage at first glance, so its less likely to be percieved as a threat.

Yes, I know that data storage is a critical part of it's functioning, but it isn't *the* function, and isn't what most people think of when they see one. Actually thinking about it it is obvious, but thinking is rather rare these days.

Re:Why always the iPod?

[twitter]

A USB key or portable hard drive could do the same thing. All this will do is keep people from using iPod's at work.

Don't forget the PDA with wifi and a 1 GB MMC. Much less work required to program that one.

It's amazing how companies treat the people who produce their "secrets" as spies instead of producers who need to be kept happy.

The REAL story here is that...

[GrahamCox]

The REAL story here is that he has created an APPLICATION for the iPod, according to the FA. How did he do that? Apple closely guards the iPod SDKs and as far as I know have never released them to third party developers.

Maybe he went into Apple and "slurped" the SDKs using his application.... oh wait.

Re:The REAL story here is that...

[Anonymous Coward]

Connect iPod
iPod mounts as hard drive
double click application on hard drive
normal portable windows application runs, scanning for documents and copying them to predefined destination (ipod).

Theres nothing special to this.

Re:The REAL story here is that...

[Durandal64]

Here's what I'm betting actually happened. This guy wrote a program that does some basic and not-very-remarkable parsing of Word files on C: and copies whatever it finds to the iPod. Then he used Windows Auto-run to automatically execute it when the iPod was plugged in. Ooooh, wow, impressive.

Even if you were able to create a program that actually ran on the iPod's operating system, which by all indications, you can't, that program certainly wouldn't have access to the files of a computer it was connected to. The iPod OS can't even read or write NTFS, for Christ's sake. It's HFS+ or FAT32, period. Either way, this guy did not write a program "for the iPod". He wrote a program (probably in VisualBasic or something like that) that any first-year computer science program could write and then used a not-too-clever trick to get it to launch automatically. That method won't even work on Mac OS X, since there is no auto-run "feature" for removable media.

The only reason no one ever did it before was because it's not a scenario people would take seriously. Simple security measures like disabling auto-run and limiting executable permissions to a specific set of programs would nip this "vulnerability" in the bud.

Re:The REAL story here is that...

[Kj0n]

Simple security measures like disabling auto-run and limiting executable permissions to a specific set of programs would nip this "vulnerability" in the bud.

That's true, but Sony and the other record companies wouldn't like that, because then their root k, oops, DRM software wouldn't work anymore.

Re:The REAL story here is that...

[m50d]

Erm, no, the real story is that he created a windows executable you can store on an ipod and it got reported as being "run on the ipod".

Re:The REAL story here is that...

[Darth_brooks]

Removable devices shouldn't be able to use atuorun to do anything by themselves in XP. The autorun.inf is handled differently for removable devices. XP will read the autorun.inf if one is present in the root directory of a CD or a USB device, but won't actually execute commands on the removable device.

For example, you can make an autorun.inf on a USB device that points to an icon buried inside folders when the device is mounted. (XP will see the autorun and run the (apparently non-destructive) "icon=" line. it just won't do "open=", on removble drives.) You cannot use an Autorun.inf to execute a program on a USB device as soon as it's mounted. Microsoft made a point of neutering that feature on Read-write devices. I'm curious how the author got around that.

And just for the record Autorun can be easily disabled on CD drives, USB / Hotplug devices, or both via Group Policy.

Re:The REAL story here is that...

[GrahamCox]

So it's no longer just enough to "read the article", but to read the article that the article is about, and the one THAT one is about, and so on.... RTFATFATFATFATFA....

Nah. This is slashdot we're talking about here. You should count yourself lucky that I recursed even to level 1.

Re:The REAL story here is that...

[Danga]

This guy wrote a program that does some basic and not-very-remarkable parsing of Word files on C: and copies whatever it finds to the iPod.

If all it does is look at the local hard disks then why even bother parsing the word files? It would be much more efficient to just copy all the word files and then use some kind of filtering program once you got home. Now if it were to scan a large network there might be an advantage to checking the files individually before copying the whole file since you might not have to read the whole file before skipping it but even still doing the parsing prior to copying to the iPod wouldn't be how I would go about it. A 60 GB iPod can hold a LOT of word documents and preprocessing them all seems like a waste in my opinion.

Re:The REAL story here is that...

[Durandal64]

If all it does is look at the local hard disks then why even bother parsing the word files? It would be much more efficient to just copy all the word files and then use some kind of filtering program once you got home. Now if it were to scan a large network there might be an advantage to checking the files individually before copying the whole file since you might not have to read the whole file before skipping it but even still doing the parsing prior to copying to the iPod wouldn't be how I would go about it. A 60 GB iPod can hold a LOT of word documents and preprocessing them all seems like a waste in my opinion.

I don't disagree. But this guy's basically trying to get attention, so he wrote a program that he can kinda-sorta say scans specifically for "classified" or "sensitive" documents, even if his method is a simple keyword search.

Re:The REAL story here is that...

[TheRaven64]

Even if you were able to create a program that actually ran on the iPod's operating system, which by all indications, you can't

Actually, it is possible to get hold of an iPod SDK in some circumstances. I only know one person who has one (in academia), but they are probably available to hardware developers as well.

Physical access

[ian_mackereth]

At one time, I'd've pointed out the difficulty of getting unauthorised physical access to a PC's USB port in any sort of secured environment.

Then a friend went to his local bank branch to get a personal loan. His salary records were all on his USB memory device (he works for an ISP who really try to avoid paper if they can)and he was allowed to plug his mempory card in to the loan officer's PC and run Acrobat to show her the documents.

Yep, on a bank PC, inside the firewall, with a USB stick of completely unkown provenance.

I bet their IT security guys would've had a fit, if they'd known!

Re:Physical access

[Anonymous Coward]

As an IT guy in a bank, I have to say that if you thought that banks somehow had better security than the grocery store across the street, you were merely fooling yourself.

Fact 1: for the system to work, people have have to have access to the core financial applications.
Fact 2: people are stupid.
Fact 3: much (most?) hacking involves social hacking as opposed to trying to "break in" to a financial institution.

Connect the dots.

'Course, there is no way you could get anywhere trying to break into our organization through the front door, but sadly, a low-tech backdoor approach like this would probably work great.

Re:Physical access

[DavidD_CA]

> Yep, on a bank PC, inside the firewall, with a USB stick of completely unkown provenance. I bet their IT security guys would've had a fit, if they'd known!

I would argue that their IT "security" guys should probably have been fired then, for not disabling the USB port from within Windows. It's a simple Windows permission and can be done on a standalone workstation or through the entire network in Active Directory.

Re:Physical access

[crashelite]

they should of been fired for using windows in the first place

Re:Physical access

[Lehk228]

it is entorely possible that the bank system will not run any unknown executables, i know of security suites going as far back as windows 95 which would only allow certain applications to be run and from certain disks.

Re:Physical access

[anothy]

i had two friends who used to work as bank tellers. their PCs - the ones used to do their job as tellers - had some IM program installed. certainly not company policy: the actual AIM executable was somehow blocked, but these folks had just gone out and gotten some other one (the only instance i'm aware of where non-technical people had actually gone out to get some client other than the default one for that service). this was apparently common practice at the bank. i asked one of them if they were aware of the security risk that caused: "yeah, but the managers don't know."
sigh.

Re:Physical access

[I_can_not_believe_I_]

Now, this would actually become interesting if you could automatically get executables to run off a flash drive. Somehow plugging something in and then running some executable would seem at the best odd (claim you mis-clicked?).

If you could do this, things like slurp.exe on iPods would be more interesting, as you could have people unknowingly running this program. For example, assume a fictional girlfriend of mine worked somewhere that I wanted to check for some sort of info. I've got access to her iPod at home, but nothing at her work. If this program could be run without her intervention, then it's an issue, right now it's just one of thousands of USB storage devices people could use to carry things out.

Re:Physical access

[SirTalon42]

Windows will autorun things on external harddrives/flash drives just like they would with a CD.

Eyeballs and a brain...

[Robber Baron]

Eyeballs and a brain work too.
Sooner you're going to have to trust your employees with your sensitive or confidential information, otherwise they're not going to be able to do their jobs. So maybe employers should...oh I don't know...hire employees that are trustworthy? Oh and quit treating them like felons...that way they won't be tempted to live up to your expectations!

I worry more about users losing their damn USB drives than using them to steal.

Re:Eyeballs and a brain...

[supermank17]

Unfortunately, not all employees come with a nice big sticker that say "I'm trustworthy" or "Don't touch me with a twenty foot pole" on them. But in general, I agree. At some point you have to acknowledge that no matter what you do, employees could steal information easily enough if they really wanted to, be it by memory, usb drive, or even "forgetting" to shred important documents. You just have to take precautions to discourage the bad ones, and trust the rest.

Re:Eyeballs and a brain...

[YrWrstNtmr]

Oh and quit treating them like felons...that way they won't be tempted to live up to your expectations!

True. But no matter WHAT you do, there will always be that one assclown whom you cannot please. And who may walk out with your stuff.

Larry you don't have any privacy ... get over it.

[Anonymous Coward]

It's just that simple right Larry?

Where do I get a 100mb Ipod?

[ip_freely_2000]

I can use more disk space so I can watch Ashlee Simpson videos while I slurp data off the corporate network.

Ipod Alternatives

[Monkelectric]

MY iAudio X5 can steal corprate secrets *AND* play Ogg/Flac formats!

Brilliant!

[prockcore]

Watch, we're going to find out that Abe Usher works for Creative.

iPot - iParanoid

[layer3switch]

Watch out! Those creepy employees with floppy! You never know what they are going to steal onto that floppy! Oh yeah, and those RJ-45 Jacks are just pouring out corporate secrets to those spies! And SCREEN! OMFG! Screens are the worst! They SHOW stuff to the eyes of SPIES! THEY ARE EVERYWHERE!!!

[background voice]
"Hey, IT guy, did you finish setting up that wireless access?"

Oh, ok, I gotta go. I had to set up the wireless 802.11g network with ultra secure MAC filtering enabled around our office. Yeah... somebody gotta look out for those absent minded people who have absolutely no idea about security. Heh!

[Update]
DAMN SPIES! I lost my job! Those DAMN SPIES!

Any IT Security manager...

[notnAP]

... who didn't already realize that people could plug in a USB device to an open USB port and potentially copy files to it with or without the aid of a program to automatically search for files really should read this story... preferably prior to hitting Dice looking for a new job.

CNET and Abe conspire to keep my iPod away.....

[Alpha_Traveller]

...from work...But *I* have created an application that prevents sensationalist articles by CNET and applications written by Abe Usher from being run or seen on my employers network! SO THERE!

Don't worry:

[plasmacutter]

don't worry the TCPA will take care of those dirty whistle blowers

Who needs iPods when employees can listen to...

[Anonymous Coward]

hand cranked gramophones? =]

Stealing again?

[MarkByers]

stealing 100 megabytes

It's not stealing because when you copy someone else's data, you do not take that data away from them. They still have the data after you have copied it.

Re:Stealing again?

[bohemian72]

A word doesn't always need to be used by its first definition. Definition two here doesn't necessarily say anything about depriving the owner of that which has been stolen (ie. a kiss). To simply get something stealthily appears to be stealing.
From the answers.com page for the word "steal."

steal (stl) pronunciation

v., stole (stl), stolen (st'ln), stealing, steals.

v.tr.

      1. To take (the property of another) without right or permission.
      2. To get or effect surreptitiously or artfully: steal a kiss; stole the ball from an opponent.
      3. To move, carry, or place surreptitiously.
      4. To draw attention unexpectedly in (an entertainment), especially by being the outstanding performer: The magician's assistant stole the show with her comic antics.
      5. Baseball. To advance safely to (another base) during the delivery of a pitch, without the aid of a base hit, walk, passed ball, or wild pitch.

Re:Stealing again?

[EnsilZah]

I was about to write something similar.
This probably relates to that 'Literacy Limps Into the Kill Zone' article from earlier.
People who don't know what a word means shouldn't use it.

Potential threat through USB/Firewire

[pkhuong]

USB and Firewire allow devices to peek/poke through (physical) memory at will. With the iPod, we have a device that's:

1. Can be attached to a computer without being suspect
2. Can run Linux with programs of your choice
3. Has a built-in mass storage system

Any open USB/Firewire port is a potentially huge threat to your whole system's security. If you look here: http://www.cansecwest.com/resources.html, you'll find a pretty detailed presentation on using iPodLinux to hack a computer (kill an X Window screensaver, here) through firewire, and another less detailed one on other DMA-attack vectors (PCMCIA and USB, mostly, iirc). So while it looks like this attack only uses characteristics 1 and 3 of the iPod, the second one is where the money's at (and requires a much larger investment).

Fill those ports with cement!

Re:Potential threat through USB/Firewire

[Slorv]

>Fill those ports with cement! My computer has Bluetooth, so does my Ericsson phone with 512 MB storeage ... nuff said

Re:Potential threat through USB/Firewire

[Anonymous Coward]

well you can also simply email yourself the stuff with all the huge file transfer allowances nowadays..msn yahoo google walla can,t block an executable renamed to ????then renamed back hmmmm........

Re:Potential threat through USB/Firewire

[leenks]

Where I work access to the USB ports on Windows machines is strictly locked down (and the only other desktop machines we have are Sun Blades - heaven forbid we should be allowed to run Linux on the desktop!). Anyway, basically nobody can use USB peripherals except a few who need it for things like a document scanner, or perhaps memory card readers (eg for official photographers etc). I'm surprised more companies don't do the same.

Re:Potential threat through USB/Firewire

[cowbutt]

USB and Firewire allow devices to peek/poke through (physical) memory at will.

I'm pretty sure the functionality you describe is only available to Firewire devices, not USB devices, because only Firewire devices can initiate peer-to-peer DMA transfers.

I am, however, waiting for auto-0wning Firewire dongles to turn up on the underground/import market...

Re:Potential threat through USB/Firewire

[cnettel]

So what? Just because it's a protocol/interface doesn't mean it will allow unauthorized DMA.

Re:Potential threat through USB/Firewire

[pkhuong]

Yeah, I think the USB exploits rely on shoddy driver programming by EEs. Exploiting drivers can be pretty scarily powerful, and those who write them often don't have a huge secure programming background.

Anyone suprised?

[el_womble]

Dual proc machine, with vast amounts of storage and an innocent ubiquity is used as a corporate weapon. Next they'll be telling me that personal laptops can be used to sniff corporate networks, or that viruses can be transfered on floppy disk, and that restricted documents have been printed out, and 'sneaked' through the front door.

Any company with a decent security model will be able to recognise a user who's file browsing habits are irregular, and classified documents shouldn't be kept in a public repository on a LAN anyway.

Re:Anyone suprised?

[Vitriol Angst]

An iPod can also be sharpened into a point and used as a "shiv" to kill. It won't work as well in the USB ports afterward -- but has anyone addressed this problem? If force swallowed, an iPod nano can stop air in somebody's win-pipe.

The hidden menace of the iPod must be addressed!

Re:Anyone suprised?

[Jesus_666]

viruses can be transfered on floppy disk

The answer to that one is simple: Don't copy that floppy.

Please use the right words!

[Anonymous Coward]

"iPod to scan corporate networks"

We can guess more or less what he means, but it's simply not correct.

The iPod has no network hardware on board. It has a USB port (or FireWire, dependent on model) and so the iPod has no way al all to "scan" any network whatsoever.

this is genious

[tehwebguy]

i can't believe i never thought of this!

1. slurp information from company onto ipod
2.
3. profit $$$

anyway, to all the people who wonder why this is a big deal, the reason is that connecting your ipod is a very innocent looking. obviously there are other ways of hiding what you're doing, but it is perfectly normal to see a teenager, an old lady, or anyone in between hooking their ipod up to a computer to charge / sync.

Whats on Hagbard's new ipod?

[AHuxley]

In capitalist west your admin listen to ipod.
In communist East Germany your whole network sold on ipod.

ipod the new floppy?

http://en.wikipedia.org/wiki/Hagbard_(Karl_Koch)

My iPod Christmas miracle

[VampireByte]

Two employers ago, the company's president walked by my desk and noticed I was listening to an iPod. The song playing at that moment was "Cake and Sodomy" by Marilyn Manson, which was unfortunate because the gentleman picked up my iPod to look at it before I had a chance to change to a song with a less offensive title. As he picked it up he said "I just bought one of these for my son for Christmas" and then I noticed the shock in his eyes when he saw the words on the LCD screen... then he said "Hmmm" and sat the iPod back on my desk and walked away without saying another word.

A few weeks later, after the Christmas holiday, I saw the president and asked if his son liked his iPod. He said "I decided to return it and got him something else." At first I felt like a heel because I probably caused him to go home and dig through his children's CD collections, confiscate those not meeting his approval and give them a stern lecture. But then it occurred to me that his kids are rich brats and I might have caused them some grief! Buwah hahaha! I felt so happy when I chose to Think Different.

Thanks Apple, your iPod filled me with holiday cheer.

Re:My iPod Christmas miracle

[smurfsurf]

Chances are that he does not know one decides on the music, but thought your selection is the "fixed" collection of songs on an ipod.

Re:My iPod Christmas miracle

[Anonymous Coward]

I felt so happy when I chose to Think Different.

You mean Think Differently.

Re:My iPod Christmas miracle

[stunt_penguin]

Or, think before posting. Another smacktard who hasn't been paying attention and doesn't recognise an apple marketing slogan when he sees one.

Re:My iPod Christmas miracle

[Anonymous Coward]

Another smacktard who hasn't been paying attention and doesn't recognise an apple marketing slogan when he sees one.

Seriously... did you just flame someone for not knowing a marketing slogan by heart? That's like the most fucked-up thing I've seen today (though it's only 13:00 hours here, but still).

This is especially true since the GP's correction was grammatically correct, and yours is not. Note: I have no idea how well or badly Apple chooses to use the English language in its ads. Fuck them if they do misspell things like this on purpose. Fuck them even more if they did it by accident.

Re:My iPod Christmas miracle

[Anonymous Coward]

(1) Please don't swear, it's completely unnecessary.
(2) Apple weren't misspelling anything; it was a grammatical error.

Re:My iPod Christmas miracle

[ObsessiveMathsFreak]

You should have reported him for child abuse.

Re:My iPod Christmas miracle

[Creepy]

heh - at least I'm not the only one to have one of those moments, though it was on either Internet radio and not an iPod. My (ex) boss walked in while a song called Fairytales of Slavery by the band Miranda Sex Garden was up on my player - an awkward moment to say the least. I had actually just brought up the player to change stations, too, because I was in the mood for something a bit more upbeat. That problem is now gone because my work blocks Internet radio (and I doubt I was the cause - they also started blocking IM, IRC, SSH, and VNC with a packet scanning firewall [e.g. no port forwarding] at the same time).

Re:My iPod Christmas miracle

[Anonymous Coward]

*Woosh* That was the sound of the joke going right over your head.
Apple's slogan, "Think Different" is grammatically incorrect (not to mention derivative of IBM's "Think"). I was merely pointing out that the poster had contracted Apple's poor grammar.

Re:My iPod Christmas miracle

[Damek]

Maybe if you'd think different it wouldn't be a problem for you.

Next thing you know you'll be castigating people for poor speeling when they refer to fcuk clothing.

Arg!. then Arg! again.

[dilvish_the_damned]

CNet is reporting that Abe Usher has created an application that allows an iPod to scan corporate networks for files likely to contain sensitive business data and download them, potentially stealing 100 megabytes in a few minutes. An insider threat would only need to plug the iPod into a computer's USB port.
Who gives a fuck? Oh wait... I know this one... people who dont know crap about security.
If your network services are secure, then its secure. If its not, then deal with !that!.
If your worried about people (employies) carrying off data, then deal with !that!.
If your worried about iPods, then you have about 20 years of missinformation. Your data has always been insecure. Deal with !that!.

I for one think it rather nifty that this guy Usher was able to do build the Evil application to work on an iPod. As good as he seems to be on this basis alone, he obviously doesnt have way too much work on his hands. Maybe one day he will deal with !that!. Or maybe this is his way of fixing it.

(I normally dont use "!" agressivly, it just seemed funnier this way. To me that is.)

--dant

Re:The REAL story here is that you can run Linux

[macslut]

Actually, you can install linux on an iPod and run all kinds of apps. I was able to play Doom on my Nano as well as video.

let them

[TLouden]

If your network is so insecure, you ought to fix that. It isn't the applications (or hardware) that we should be upset about, but the flaws which they highlight.

His server's almost dead

[La Camiseta]

http://www.sharp-ideas.net.nyud.net:8080/download/ slurp.zip

^- The Coralized version of the software.

Re:His server's almost dead

[Anonymous Coward]

I've also got the slurp program mirrored on one of my servers. Feel free to download it.

http://mirrors.theredfist.com/slurp.zip

Microsoft must be REALLY desperate

[Anonymous Coward]

Hm. So now iPods will be forbidden in corporate environments. Bet iTunes is too, just for good measure.

*snif snif* is that MSFUD I smell...?

Good The Corporation Should Perish

[GlennYaHeard]

Let the data be stolen, it should be public anyway. Yay Socialism

Marketing/Brand consciousness

[mejesster]

The article on CNet is fine, the problem is that /. is a poor audience for such an article. Yes, there are LOTS of ways to stop an "attack" like this, yes it's primarily an insider threat and one of MANY other ways to accomplish such things. It's the automation of the task and the fact that it can be done in large volumes at high speeds onto a device that non-sysadmins wouldn't think twice about. I don't see why /.ers can't just ignore a story that doesn't apply to them (or better yet, editors reject stupid stories).

nothing special about using an iPod...

[constantnormal]

as has already been pointed out, any flash drive or external hard drive could be used.

Or a thieving employee could burn a CD or DVD.

Or use a cellphone to store sensitive info, transferred from a PC via the Bluetooth connection used to support a wireless mouse.

The only real defense against employee theft is restricting access to sensitive data and minimizing the number of untrustworthy employees. That's the best that can be done.

Re:nothing special about using an iPod...

[TallMatthew]

Or use scp

Or POST the file to a website

Or email the file to yourself using encryption or obfuscation

Or print the thing out

Or call someone up and tell them the info over the phone

The only real defense against employee theft is restricting access to sensitive data

Agreed. There are certain people within a company with the access to take everything down, generally upper management and officers. The company is obligated to trust them. That having been said, if it wasn't for them the company wouldn't exist so it's even steven. If people who aren't in a position of authority can access information like this using an MP3 player, then mistakes have been made.

Indeed

[Anonymous Coward]

Exactly. I could very easily backup hundreds of complete databases right off the SQL servers (and other sources, XML, etc) - including tons of sensitive data, the source for every app we've made, our entire intranet's contents, and burn it to DVDs or copy to a portable HD anytime I would want to (or copy ona corporate laptop's HD), right in direct view. No one would even question, comment or bother me in any way (it would be ridiculously easy to try to conceil things too).

I have total access to dozens and dozens of servers. Thing is, it's a question of ethics. I'm not a dirty thief scumbag that wants to sell personnal information. No need to treat me like one. As far as non-admins are concerned, their access to sensitive data is extremely limited anyways, they can't do much damage really. My employer pays me decently and treats me well, no reasons to be disgruntled either.

Re:Indeed

[SavvyPlayer]

It's not only a question of ethics, it's a question of security clearance, trust and responsibility. Misuse of this clearance would at the very least make finding future employment in IT nearly impossible. At worst, if you work in the medical/financial/insurance sector (heavily regulated), a publicly traded company or the public sector, such a violation might constitute felony. And your legal system probaly doesn't regard salary or morale justification for premeditated criminal acts.

Confused?

[snStarter]

I'm confused. Is this about a program that's on an iPod, executed by the computer into which the iPod has been plugged (which is what I think) or is it a way for an iPod to actually be executing its own code and somehow access the network through the USB port? (which seems REALLY clever and dangerous but extremely unlikely).

Both the article and the summary are poorly written in any event.

Send it out as a ternary attachment

[tepples]

then I hope information security is already filtering outgoing email and stopping binary attachements.

Then send it out as a ternary attachment ;-) Seriously, for every filter there is a tunnel, even if it consists of pasting some uuencode variant into the body text instead of using MIME.

Re:Send it out as a ternary attachment

[JanneM]

Then send it out as a ternary attachment ;-) Seriously, for every filter there is a tunnel, even if it consists of pasting some uuencode variant into the body text instead of using MIME.

Of course there is. Or you can hide an mp3 player in a bodily orifice. Or a concealed keylogger to grab your coworkers' passwords. Or break in from the roof, lowering yourself down a ventilation shaft, subduing the guarddogs with sleeping darts and finding the laser beams with cigar smoke.

But once you do any of these things, you are willingly and deliberately breaking your company's security policies. And a malicious employee is a different kettle of fish from someone not excercizing their judgement in what data to bring home for overtime work, or not thinking through that while their uncle sure would get a chuckle out of the boneheaded design of next years' model, perhaps taking the data out of the building to show him isn't a good idea.

A wordy, fuzzy data security policy can be misunderstood, its main points forgotten and its admonishments mentally filed under "it doesn't really apply to this case". A clear, unambigious, 'All devices need preapproval' and 'No attachements. No, not even of your newborn. No, no even if he really is the cutest thing anybody in the building has ever seen.' is clearer and easier to follow.

It's all a matter of what kind of thing you want to stop. A locked screendoor will not stop a burglar - but it will stop your nosy neighbour just walking into your kitchen or your children to walk outside. And chances are, you usually have far more problems with the latter kinds than the former.

Re:Send it out as a ternary attachment

[KDR_11k]

Are you sure the filter won't throw up red flags like mad when it spots any irregular activity? Like huge outgoing emails (especially those with all of that in the body), unusual encryptions, possibly unrecognized email addresses as well? You only get one try.

Re:Send it out as a ternary attachment

[tepples]

You only get one try.

Does the filter also restrict HTTPS connections? If so, it might be hard to detect a 200 KB upload of a .zip package of the data that you have already distilled to a random webmail server.

Re:Send it out as a ternary attachment

[mikiN]

A locked screendoor will not stop a burglar - but it will stop your nosy neighbour just walking into your kitchen or your children to walk outside.

Gosh no..heaven forbid!! Your neighbour could actually come in and say 'Hi!' to your kids! Your kids could actually go outside and see for themselves what Nature really looks like instead of watching Cartoon Channel. The horror!

People, if some of you really get off on living in a 'war zone' 24/7 where you can trust nobody, please do, but I'm outta here.

Re:Send it out as a ternary attachment

[Yazeran]

Does the filter also restrict HTTPS connections? If so, it might be hard to detect a 200 KB upload of a .zip package of the data that you have already distilled to a random webmail server.

Well ssuming the place is a research lab with high restrictions I' sure the regulatins would also forbid the employees to access any external mail-system (they are there to work not to chat with fammily etc..)

I know i would instate such a policy in an restricted area (and at the same time block any pop3-requests which does not go to the company email-server)

Yours Yazeran

Plan: to go to Mars one day with a hammer.

Re:Send it out as a ternary attachment

[Babbster]

Heaven forbid your neighbor might actually knock on the door and wait for permission to enter.

My neighbors could be my best friends and I still wouldn't want them wandering in and out of my house at will - something strongly encouraged by a wide-open door.

Re:Send it out as a ternary attachment

[M1FCJ]

True! https://gmail.google.com/ - the employee is reading personal mails at work or maybe he is using a throw-away google account to subscribe to many technical mailing lists to protect his office address from spam harvesting and virii (that's what I do anyways)? During all of that gigabytes of https transfers, how can you spot a small piece of mail sent out containing the corporate secrets?

Re:Send it out as a ternary attachment

[Anonymous Coward]

wtf is a "virii" ?

Re:Send it out as a ternary attachment

[Spacejock]

Or break in from the roof, lowering yourself down a ventilation shaft, subduing the guarddogs with sleeping darts and finding the laser beams with cigar smoke.

I have to do that to access my own computer.

Re:Send it out as a ternary attachment

[Golias]

So your neighbors check to make sure your doors are locked out before bothering to knock? What sort of freaky town do you live in???

Normal people knock on the door to somebody else's house, unless it was verbally made emphatically clear to them that they are welcome to stroll in.

Locking a screen door is about as useful as wearing a parachute while tree-climbing.

Re:Send it out as a ternary attachment

[Pieroxy]

My guess is that you don't understand security very well. It is virtually impossible to make something 'unbreakable'. Would it be computers or houses.

Security is about raising the effort needed to break in, nothing else. When your screen door is locked, it takes more effort to get into your house. That will avoid (for example) the neighboor's dog to come in and pee on your carpet. If your door is wide open, that's just likely to happen. Door closed it is more difficult.

Remember, there is no absolutes. Security is about making it difficult for others to break in. How difficult is your definition of an 'acceptable security'.

Re:Send it out as a ternary attachment

[Golias]

So, your neighbor's dog knows how to work the latch on your screen door, but can't manage to bust through the screen? Okay, then I guess it does make sense to lock it after all. All those feeble dogs with opposable thumbs can be a very challenging situation.

Remember, there is no absolutes. Security is about making it difficult for others to break in. How difficult is your definition of an 'acceptable security'.

Which is why locking a screen door is utterly pointless. Anybody who is willing to get in against your wishes is presented with almost no additional difficulty in doing so. If there's any chance at all of an unwelcome visitor entering your home, you should close the actual door and lock it.

Locking a screen door is a terrific example of a security measure which does not offer much, if any, added security, yet makes your life a little bit more of a hassle.

Re:Send it out as a ternary attachment

[Golias]

If your door is wide open, that's just likely to happen. Door closed it is more difficult.

Actually, now that I look at your post again, I can see where you are confused.

This is not a thread about propping your door open vs. closing it. It's about the merits of simply closing it vs. closing and locking it./i>

The point you are debating against is that LOCKING the latch is pointless. "Wide open" doors have nothing to do with the discussion.

Re:Send it out as a ternary attachment

[Golias]

and locking it./i>

Damn, I should have closed that tag properly. Now the neighbor's dog is probably going to walk in and pee all over my post, and he doesn't even need to know how to work the latch!

Re:Send it out as a ternary attachment

[tepples]

I' sure the regulatins would also forbid the employees to access any external mail-system (they are there to work not to chat with fammily etc..)

So do the regulations also forbid the use of technical mailing lists and web boards? In general, there's no way to tell an HTTPS web board from an HTTPS webmail without a white- or blacklist, and even in the case of well-known webmails, some people would prefer to use hotmail/yahoo/gmail in order to keep spam out of the employee's primary work e-mail account.

Still, ye cannae stop the analog hole.

Re:Send it out as a ternary attachment

[Pieroxy]

My guess is that you don't understand the difference between a door unlocked and a door wide open.

As for the difficulty, I think that if you want to enter my house while my screen door is locked you will have to break in which might not be very difficult, but is a step you have to go through in your mind. You are effectively breaking the law. So if you are a loner in a search for a phone (just an axample) to call someone (or willing to grab a quick buck lying around), you will not trespass my doorstep if my screendoor is locked. Or you will be less liklely.

That said, I lived some places where my neighboors would come in in the middle of the day to give us back some tool I might have lended her an hour earlier. This was fine with both of us, but the screendoor locked would be enough to let her out.

If you don't want to think about it as security, think about it in terms of privacy. It is really the same thing, in a lower degree.

--
Krazy Kat, The Reference

Re:Send it out as a ternary attachment

[Pieroxy]

As I said, it is all a question of degree. A door wide open is less secure than a door closed, which is in turn less secure than a door locked. There is nothing to debate around this, it is plain and simple.

Is a screen door locked very secure? No, by no means.

Is a screen door locked more or less secure than a screen door not locked? Of course it is more secure, even if by a tiny amount.

THAT is my point, door wide open or unlocked aside. Point still stands.
--
Krazy Kat, The Reference

Re:Send it out as a ternary attachment

[yawn9]

http://en.wikipedia.org/wiki/Plural_of_virus

Re:Send it out as a ternary attachment

[Golias]

Is a screen door locked more or less secure than a screen door not locked? Of course it is more secure, even if by a tiny amount.

THAT is my point, door wide open or unlocked aside. Point still stands.

More secure against what, exactly?

It won't stop criminals.
Non-criminals won't walk into your home without permission.

So, what exactly does a lock on a screen door protect against?

That was my point. It's not much of an added layer of security, but it is an added layer of inconvenience FOR YOU. Our lives are full of way too much of that kind of "security."

Re:Send it out as a ternary attachment

[Pieroxy]

So you don't think there is anything in between outright criminals and non-criminals... You live in a black and white world my friend. Just let us know when you're back in our grayish world.

Re:Send it out as a ternary attachment

[Minwee]

Your kids could actually go outside and see for themselves what Nature really looks like instead of watching Cartoon Channel. The horror!

In my neighbourhood, "Nature" is standing on the corner having a private chat with some guy who just pulled up in a Lexus. There is a broken beer bottle on the sidewalk, something which could be a needle lying next to it, and two of the local dealers are having a shouting match right across the street.

If you _really_ think it is a good idea for your three year old to wander out into "Nature" unsupervised, just by walking out the open front door when your back is turned, then by all means, please get "outta here".

Re:Send it out as a ternary attachment

[Minwee]

True, but when you set out to dual boot OS X with Windows you knew that there would be some inconvenience.

Re:Send it out as a ternary attachment

[c0bw3b]

seriously. Where I come from screen doors are for keeping out mosquitos.

Re:Send it out as a ternary attachment

[Golias]

So you don't think there is anything in between outright criminals and non-criminals.

I don't think there is anything between trespassers and non-tresspassers, no. Care to tell me what they are, oh enlightened and nuanced one?

Re:Send it out as a ternary attachment

[Pieroxy]

There are plenty of kiddos out there in the streets whose parents have decided the street would be the best training for them. Thay are 'would-be' trespassers just awaiting for an opportunity to actually become one. There are kiddos out there just looking for something stupid to be accomplished. There are deranged people. There are people looking for a quick buck but not willing to 'break and enter' but perfectly willing to enter. I've seen some of those.

Granted, these are not the norm. But an open door is just too good of an opportunity.

I've had a friend whose car has been stolen because he left it open. It was a crappy car and the thief just needed transportation to go point to the justice dept in a neighboor town. He was on parole and needed to get there by the end of the day. He stole the car BACAUSE it was open, for no other reason.

Well, enough for today. Good day my friend, and sleep well with your doors unlocked.
--
Krazy Kat, by George Herriman

Re:Send it out as a ternary attachment

[Golias]

Well, enough for today. Good day my friend, and sleep well with your doors unlocked.

You can feel free to sleep well with a locked handle on a paper-thin door securing your house.

I'll stick with a deadbolt on a proper door when I need security, and the welcoming presence of an unlocked door for my friends and neighbors when I'm home and awake, thanks anyway.

Re:Send it out as a ternary attachment

[Anonymous Coward]

You must be new here!

Assuming virus as a word from latin language (all words ending with "us" are, right ?), and assuming it is singular, the plural is virii.

Re:Send it out as a ternary attachment

[murdocj]

Non-criminals won't walk into your home without permission.

See, here is where you are wrong. For example, one morning many years ago I got up, wandered out into the living room, and saw a body lying under a blanket. Pulled back the blanket. Guy looked up at me and asked if I was "George" (or whoever). Turned out he had shown up in the middle of the nite and was actually going to be visiting the next door neighbors. In this case, he certainly wasn't a criminal, and had I locked my door (even a screen door) he wouldn't have wandered in.

Another case: I've known people whose friends or relatives felt perfectly comfortable wandering in whenever they felt like it if the door is unlocked.

As a parent post somewhere up the chain correctly pointed out, there are degrees of privacy / security. The "locked screen door" doesn't keep the Hillside Strangler out but it does serve a purpose.

Re:Send it out as a ternary attachment

[CommieOverlord]

So, what exactly does a lock on a screen door protect against?

It protects against toddlers accidentally opening the door. It protects against animals opening the doors, my cats do this if it isn't locked.

It prevents little neighbourhood kids from wandering in.

Re:Send it out as a ternary attachment

[JanneM]

Non-criminals won't walk into your home without permission.

Um, yes, they will, when their sense of friendship and community spirit overwhelms their understanding of propriety. Or, in other words, friendly but nosy neighbours with no sense of social nuances whatsoever. They're your friend, they would never mind you walking right into their home, so why should you mind them walking into yours?

You may not have met these kind of people but believe me, they very much exist. Mind you, they can be good people, great fun, and a definite asset whenever a party or dinner is to be organized, but they do need somewhat more, ah, physical limits to their behavior than a meek verbal "I would appreciate if...". (Think "Hyacinth Bucket", in case you've seen that BBC show.)

Another situation is if you have older children or teenagers living at home; not infrequently they will be freer with invitations and social protocol than their parents. Just wandering in - and then concientiously knocking on the bedroom door of their friend - can be a regular occurrence unless you put a natural restraint on it.

Of course, this whole screen door thing in my original comment was just an analogy...

Re:Send it out as a ternary attachment

[Anonymous Coward]

I can't believe I read this whole thread.

Are You Kissing Hollywood's Ass?

[Quirk]

A couple of days ago someone posted about having seen the new Harrison Ford movie FireWall. The poster noted Ford supposedly downloads thousands of accounts into an iPod. It looks like this story is a teaser for the movie.

"Abe Usher has created an application that allows an iPod to scan corporate networks for files likely to contain sensitive business data and download them,"

I couldn't be bother to see such a movie. Harrison Ford playing the righteous man who just isn't going to take anymore and singlehandedly wipes out untold numbers of bad guys is too old in and of itself, but to have Hollywood throw out a buzz word like 'firewall' and use it as a lame premise for a lame movie it way too much. Someone somewhere in Hollywood is laughing a /.

If this was some years ago...

[lampiaio]

No wireless slurping. Steals less data than a Nomad. Lame.

This is why the boss wants Treacherous Computing

[tepples]

You can't have it both ways; it isn't always secure, convenient or practicable to transfer files via email.

Unless your employees who telecommute set up a Trusted Computing partition on their hard drives so that everything at work stays private. They use Trusted e-mail over a Trusted VPN to communicate with work, and (to satisfy Alsee et al.) they use traditional e-mail to communicate personally. Nothing crosses the barrier; programs running in the traditional zone can't see the Trusted zone nor vice versa.

This is not news

[jonwil]

Devices that plug into a USB port and contain storage are potential vectors for stealing corporate data.

RMS server

[tepples]

even if you were able to copy the physical documents onto an iPod, they'd be completely useless to you outside the organization

Unless your iPod is connected to a spy camera inside your glasses. Ye cannae stop the analog hole!

and only by talking to the RMS server (located internally) can they be unlocked.

Speaking of RMS, he wrote an article and a story about this very issue.

In other news...

[Anonymous Coward]

In other news, a carefully conducted study has revealed that the majority of retail stores are COMPLETELY UNSECURE as the majority of employees have full access to the stockrooms, and many are able to access the cash contained in cash registers!

but...?!

[smash]

But Microsoft keep telling me that plug and play, zero configuration, etc is a good thing?? :D

Seriously though, in a corporate environment, USB ports, autoconfiguration, etc *should* be disabled (yes yes, we live in reality, not fairyland where that would be feasible).

Another case for DRM? If the ipod owner doesn't have the PC's (secure, in-built) private key, he can't read the company data... he'd have to steal the entire PC.

Alternatively encryption such as that included with Win2k (tied to the user account) could work perhaps?

This sort of problem is only going to get worse with plug and play + bluetooth and insecure users...

smash.

Steals the data?!?

[noidentity]

"potentially stealing 100 megabytes in a few minutes."

Wouldn't it be more stealthy if this tool copied the data rather than deleting the original? Or was "steal" the wrong word to use here?

Total Bunk

[scdeimos]

TFA on CNET must be poorly worded.

Could somebody please explain to me how a program running on the iPod is suddenly going to become a USB host and then communicate with the (previously) host computer (which could be a Mac, PC clone, or anything with a USB port) to search for files even locally, let alone figure out which network protocols are installed so it can enumerate file servers on the network and the files which they contain.

Most likely this "program" is just an .exe or its equivalent living on the iPod's filesystem which gets run by the host computer to do all the hard work - in other words, this is no different to using any old USB key.

Depends on how their system works

[Sycraft-fu]

It may be that their computers don't have any special access in particular. I work for a university and, of course, we have detailed financial and personal information on employees and students. Most people don't have access to it (including me) but of course people like our finance people need it. So you get at their computer, you get the info right? No, it's all stored on a mainframe over in the computer centre. They access it via a very archaic text interface over an encrypted link. Their computers aren't special for this access, you just need the right software, username, and password.

I don't know how banks work, I'd bet they are all different, but just because a computer is on their network doesn't necessiarly mean it has any special kind of access. All the important data may be stored on another system to which they have to log in. If they then lack admin access on their desktop, there's no real way to put a keylogger or anything on there. I would be more worried about someone getting a password via social engineering than getting anything useful off the computers themselves.

Re:Depends on how their system works

[realnowhereman]

You're not thinking evil enough. Taking the GP's example, what if the USB device with financial PDFs on had a PDF that contained a buffer overflow for Adobe Acrobat Reader? What if that overflow was then used to install a rootkit with a keylogger and back door, plus a connection to some botchannel of the owners choosing.

Does it matter that the records aren't stored on that computer? Does it matter that the connection is encrypted?

So you get at their computer, you get the info right? No

I'm afraid: yes. Better than that, you get access to the mainframe, using the keylogged username and password.

Re:Depends on how their system works

[Sycraft-fu]

Ok great, for all that effort, I can think of better ways to get the password, including but not limited to pretending to be a tech, looking over someone's shoulder, or buying someone off. What you are talking about assumes that:

1) Acrobat is installed.
2) It's not patched.
3) There's no additonal protection hardware or software on the system (new processors block overflows, and programs like Kerio Personal Firewall try to as well).
4) There's nothing watching what goes on like the Cisco Security Agent that will throw a flag with IT when you make your attempt.

The whole "get data on a USB stick" thing seems to be mainly useful to trying to get something off of a computer, or something that computer has direct access to. While a scenario like yours is possible, it's not really feasable because someone with the ability and willingness to go to those lengths can find a better method that's a lot less likely to get them caught.

Besides, this was a story about a program that nabbes things and copies them to a USB device, not a rootkit as you are talking about.

Re:Depends on how their system works

[somersault]

if you'd read the whole of this thread you would see that someone did in fact install Adobe Reader on a bank machine to show an assistant his financial records. And yes there will maybe be easier ways to get things onto a machine, but it is frightening enough already that he would be allowed to plug in his flash drive an run an executable.

Re:Depends on how their system works

[roystgnr]

If you'd read the whole of this thread you would see that someone did in fact install Adobe Reader on a bank machine to show an assistant his financial records

I must have missed a post - I see where someone ran Adobe Reader (which most computers are likely to have already installed) to read .PDF files on his USB disk; I don't see where anyone ran an installer from a USB disk.

I don't get the obsession with USB devices anyway. When Microsoft starts trying to autorun executables after a USB disk is plugged in, then I'll be scared - your USB ports will now be as dangerous as your CD and DVD drives.

Re:Depends on how their system works

[somersault]

I'd say USB ports were more dangerous, because there are more of them, and they tend to be hidden out of site, so someone can just come along and quickly put something into your usb port (or put a keylogger between your keyboard and port, etc). It would take longer to use a CD drive, and you'd have to stick around to retrieve the thing.. actually flash cards are so small these days that maybe you could make a fake usb port that's hardly noticeable as being plugged into the real one, which would even fool someone who is making a quick inspection of the machine.

And no, the bank machine apparently didnt have Adobe Reader installed, which yes I found surprising, but that's what was claimed.

Re:Depends on how their system works

[somersault]

here is the post from the top of the thread, from whence the discussion began http://slashdot.org/comments.pl?sid=177941&thresho ld=1&commentsort=0&mode=thread&cid=14759039

Re:Depends on how their system works

[lab16]

When Microsoft starts trying to autorun executables after a USB disk is plugged in, then I'll be scared - your USB ports will now be as dangerous as your CD and DVD drives.

Assuming of course that you still have autorun enabled. One of the first things you should do after installing windows is to disable all of that unecessary garbage.

Intrusion notifications in PCs

[WoTG]

Many corporate geared computers have little sensors to report on when the cases have been opened. So, really, to be really paranoid, you'd have to find the sensor on your particular PC, then figure out how to get at the hard drive without triggering it.

Email/http/ftp/ssh/vpn are also options, but that's rather easy to monitor for abnormally large amounts of data.

Re:Intrusion notifications in PCs

[realnowhereman]

Email/http/ftp/ssh/vpn are also options, but that's rather easy to monitor for abnormally large amounts of data.

I run a VPN from my work desktop to my home desktop (primarily to get around the crappy NAT on our network that keeps dropping my IMAP connection after a few hours). It would be trivial to set my desktop to upload the whole of the company intranet to my home computer. It would be just as trivial to throttle the upload to 100 bytes a second. Of course the upload would then take months, but who would care about that?

If I were actually trying to hide the fact of the connection, I'd run the VPN on port 80. 100 bytes a second on port 80 would be invisible in any reasonably sized corporation.

The point I'm trying to make is that there is no such thing as security against your employees. If you want anyone to do any work in a modern company, they will have access to IT resources. Those resources can always be subverted in some way or other. Forget the paranoia, this security obsession is like securing against a meteor strike. If it's going to happen, it's going to happen.

easier than that...

[Kaenneth]

Take for example the little bluetooth dongle I have sitting in the back of my PC, I use it with my palm Lifedrive, and a VNC client to remote into my desktop from nearly anywhere in the house, or in reasonable range outside.

with a hop, skip and a jump... at home I have Palm VNC over TCP/IP over Bluetooth to the Windows box, network connection shared to the Linux box, which is running DVArchive (a ReplayTV emulator) in a Java VM, which uses HTTP/UPnP to connect to my ReplayTV DVR, and I can change TV channels from my handheld.

Just slip a self-installing, invisible VNC server onto the bank computer (hopefully not easy), along with a tiny bluetooth dongle, and have your way with their network remotely, and continuosly

The USB dongle was quasi-free; $15, with a $15 rebate (which I have never received, just like the last 4 rebates I submitted from things bought at Fry's...) so if I never got it back, no huge loss.

Nice troll.

[Anonymous Coward]

I guarantee you get at least a couple bites.

Re:PC competition for "I-Minor" MAC?

[KDR_11k]

When you buy it form over function a PC really isn't your best choice. Either convince your wife that "cute" isn't the only thing a computer has to be or just buy that Mac.

Though the alternative spellings in that post really sound like someone trolling... Meh, who cares?

iPod, what's it all about?

[StarKruzr]

Is it good, or is it whack?

Naive to think treating people well protects ...

[AHumbleOpinion]

Your employees will steal information if they want to. This has nothing to do with the iPod. I have walked out of work with harddisks before.

The problem is that given the iPod's popularity it does not draw any attention. Even if someone notices that it is plugged in the thief may be able to dodge suspicion with a simple "I need to charge it".

Treat your employees well and they won't feel the need to screw you.

That is naive. Industrial / Commercial espionage happens. Greedy, self-centered, immoral people exist at all levels of companies. "Good" companies get screwed just like "good" employees.

Re:Store analogy was terribly naive ...

[grolschie]

Way to ruin a good joke dude. Who brought you along?

Non-Story

[Kris_J]

Your workplace is either a secure location, in which case this has already been addressed, like every technology before it, or it isn't a secure location, in which case an iPod is only one of many ways for data to leak offsite. -- From When Data Goes Missing Will You Even Know?

To the employers

[cciRRus]

That's no iPod, that's iPwn3d.

Sombody...

[getwhipped]

...just watched the movie Firewall.

There goes my chance of listening...

[freedom_india]

There goes my chance of listening to my iPod at work.

Iam used to listening to Audible books on my iPod at work....

Once our admins see this, they would definitely clamp down on this tool, without RTFA.

A better solution.

[syberanarchy]

Since the iPod uses a proprietary connection to interface with the computer, wouldn't it be smarter (and less hassling to employees) to just ban bringing the Pod-to-USB (firewire) cord? If you want to keep your kid from playing video games, why lug out the entire system when all you have to do is take the power cord?

Re:A better solution.

[flyneye]

Since C(ommunist)Net probably paid Abe to write this program to generate their own little "the sky is falling" story.Ban C(ommunist)Net from the office.No one will get any "Wrong" ideas.Just a damn iPod,gimme a break,The program probably doesnt work as advertised anyway.It would have to find crap better than gOOgle to work like this.Until we see some evidence (not television news,which is 98% fantasy,1% reality and98/100ths coffee table boogers) we should not give in to purposfully generated rumours.One merely has to ask themselves"who benefits from this story"........

not news

[Anonymous Coward]

Sorry to point to Hollywood as the rightful owner of the 'warning shot' but this type of access and data theft was pretty much central to the plot of 'The Recruit' starring Al Pacino , Colin Farrell, and Bridget Moynahan. Moynahan's character uses a USB Flashdrive to steal the source code for some dreamy virus from within the CIA headquarters at Langley... and the moral of the story is... the best hacks are always personell hacks, get someone from inside the organization to transport the sensitive info off campus.

Smart employers have policies in place controlling access to sensitive documents, keeps logs of all attempted access to such documents, and have binding agreements defining the civil and criminal ramifications of purposely violating those policies.

Not-so-smart employers serve as reminders to the rest of us when they demonstrate that Darwinian priciples apply to many facets of life besides goldfish and DIY backyard balloon enthusiasts.

Thanks

I did this at my school!

[Anonymous Coward]

I didn't use any program, just browsed the windows network shares and copied a few gigabytes of "sensitive" data from my school network for me to look at when I got home.
If anyone asked I was just charging it up.

trusted employees

[16K Ram Pack]

Anyone with half a brain can work out how to get secrets out of a company. Trying to lock it down is impossible.

The key thing is to ensure that employees have access to appropriate data, with the most trusted data being with as few people as possible.

Oh!

[cgenman]

Oh, SLURPing!

I thought the story was about LARPing. That would have been much more terrifying.

Re:Oh!

[The Ultimate Fartkno]

"Sir? I think Johnson's up to something."

"Johnson? That weirdo down in IT? I *knew* he was trouble when he brought that shiny, new iPod in here! What's he doing? Slurping our corporate data?!"

"Erm, no. He put on a cloak and wizard hat, and now he's chasing Shelley the intern around the server room yelling 'lightning bolt! lightning bolt!'"

"Sweet Jesus... this is worse than the time we found out we had a furry in accounting. Fetch my pith helmet and tranquilizer gun."

Re:Oh!

[Anonymous Coward]

He put on a cloak and wizard hat, and now he's chasing Shelley the intern around the server room yelling 'lightning bolt! lightning bolt!'

I would've guessed Lvl. 3 Eroticism instead of "lightning bolt! lightning bolt!" Or it could've been Lightning Lvl. 1,000,000.

Physical Access...

[xenobyte]

...is king!

It's quite simple: Make sure that people cannot get to hardware they're not administrators of! - If someone can touch the hardware, they can get at the information inside with some tools, so make that impossible.

Own PC's? - Shouldn't be a problem provided they're properly configured, preferably with USB-ports locked out unless in use for keyboard/mouse, and with P&P disabled so new hardware added to these ports won't be installed.

Servers? - Should be in locked racks/rooms, not dumped in corners of common rooms.

Restricted physical access will also make it inpossible to 'borrow' a harddrive home for copying or wharever.

Anti-iPod Guidelines

[ABoerma]

My father is head of security for our local police force, and has put up rules against the use of things such as iPods and USB data sticks to avoid leaking critical data.

Use a better operating system?

[argent]

Run an operating system developed in a hostile multiuser environment instead of one developed for standalone PCs?

At Berkeley, we had professors and CS students using the same computers. There were hardly any "personal computers" back then: tests, assignments, and exams were sitting on the same machine as student accounts. The students were intelligent and highly motivated, and yet the security worked.

So, today, you have a choice of running your business on the descendants of that OS, or the OS that turned the science fantasy idea of an automatically executing 'worm' from "if you can even get someone else's computer to run untrusted code, that's a bug... nobody would be dumb enough to treat it as a feature" to the most common and disruptive network security problem in the world.

Pick your poison.

llamma

[eksodos]

Visit the homepage of your new Apple consortium. http://firstpost.gnaa.us/ DOWNLOADABLE APPLE OS for XP/Lunix and your mother.

Surely...

[EddyPearson]

Surely it is just as possible for a malicious worker to use netbios and find these documents in the same way the iPod would (perhaps even recreate the "business" algorithm that selects the files for Windows)

So really, this is something of a sideline...

brilliant

[Lord Ender]

This article is about as insightful as "Knives Can Stab People!"

Flawed revenge

[No Such Agency]

And what happens when analysis shows that those files appeared there only hours before the person was "snitched out"? And all at once? The police hate child porno freaks but they are not stupid.

Re:Flawed revenge

[BoneFlower]

It would still be effective harrasment of your target, even if it doesn't land them in jail.

The targets wife might not be so understanding. His kids too. Or his mother.

Sure, these people can probably be convinced, but there will always be a seed of doubt there.

Re:Flawed revenge

[LurkerXXX]

Right. Effective even if it doesn't land them in jail. Because the police are never going to go looking for the person who tried to frame their cowoker by putting kiddie porn on their network share... Right. They are going to keep looking, and if you are that sloppy, they are going to catch you. Then you get to go to fuck-me-in-the-ass federal lockup, where all the other inmates just loooooooove child molesters. Then you'll get your just reward for trying to set someone up with something so bad.

Re:Flawed revenge

[BoneFlower]

And how exactly would they tie the kiddie porn to *your* ipod?

Unless you are stupid enough to be caught in the act, chances you'd even come up as a suspect are pretty slim. The police would certainly try to find the person, but unless you really are quite stupid about it the most evidence they are likely to have against you is "he didn't like the boss much". Chances are they'd have the same evidence against many others as well.

Re:Flawed revenge

[Anonymous Coward]

Well around here, no one's computer is running unlocked while folks are away from the machine. If you upload anything, you are going to have to authenticate on the computer/network first, and the auditing trail is going to nail you.

Re:Flawed revenge

[RobertLTux]

okay if you really want to be evil then you 1 transfer kinderporn.net (with mini server) to the target 2 use one of several tools out there to dink with the times on the files (take a look at some MS windows install trees notice the funny date timestamp) 3 send a link to the startup folder 4 wait for a reboot 5 profit!!

Not just old news, but REALLY old news

[WebGangsta]

From the Feb 2002 issue of Wired Magazine:

When Apple introduced the iPod, the company was aware that people might use it to rip off music from the Net or friends' machines. Each new iPod, in fact, is emblazoned with a sticker that warns, "Don't Steal Music."

But it is unlikely that Apple imagined people would walk into computer stores, plug their iPod into display computers and use it to copy software off the hard drives.

This is exactly the scenario recently witnessed by Kevin Webb at a Dallas CompUSA store.

In other words, move along - there's nothing more to see here.

"It's a power adaptor."

[Kadin2048]

Better than that, get a nondescript one and say that it's a power supply for your computer.

There are external HDs now that are smaller than the AC power supply that came with my first laptop, and they look about the same -- big fat cord goes into plug in wall, smaller cord connects into computer.

I'm sure an enterprising hardware hacker could actually put a hard drive inside the plastic shell from one of those old brick-type AC adaptors, too.

Couple of things

[majortom1981]

On the network that I run they wouldnt be able to get to the important files because you need to be an admin and unless you sneak into my office or the director or assoc directors office you wont be able to get documents. Thos are the only people who can get the important docs. admins or the people who created them . Second Windows 2003 can log what accounts logged into what share or files on that server if its a 2003 server. Also here at teh library we have extra security in the way of security cameras focused directly at the computers. I can see what everybody is doing plus we have some programs that you would have to hack in order to be able to even access the required stuff to be able to do this. Any secure network this would not work on. If it does then the network admin needs to be fired.

Re:Store analogy was terribly naive ...

[Plunky]

The most obvious glaring problem with your analogy is that data can be copied and the originals are still there.

I'd like to talk to you after class, I wonder if you could make a presentation of your idea that copying data from one place to another is not a crime. For your reference points, here is Steve Jobs' (please mod me up for that topical example) bank account number, and here is mine. Copy the contents of one to the other.

I'm not after the money (tis Karma I crave) so feel free to copy in either direction.

31337

[Anonymous Coward]

Just like in Transporter 2 when he totally hacked the Gibson with his iPod!

Quit it!

[ducttapekz]

Are you trying to make my workplace ban my iPod? Cut it the hell out.

What a dumbass.

[kin_korn_karn]

Why in the hell do people do shit like this and PUBLICIZE it? All it does is give geeks a bad name and make a 'threat' out of anyone who carries an iPod or other digital music player.

I'm all for the freedom to write software like this but shit, you have to be smart about it.

Re:What a dumbass.

[user24]

"Why in the hell do people do shit like this and PUBLICIZE it?"
- so that the good guys are aware of the problem and can fix it. Would you rather he published it on an underground black hat mailing list or on his public website where the issue can become quickly well known?

"I'm all for the freedom to write software like this but shit, you have to be smart about it."
he actually only released a program that reports how many files could be copied. The downloadable doesn't actually copy anything. It's a proof-of-concept, not an actual example. This is "being smart about it".

Whoosh! [nt]

[Anonymous Coward]

Whoosh! [nt]

Re:Whoosh! [nt]

[just_another_sean]

OK, OK, I responded while suffering from a serious caffeine defficiancy...

Stealing?

[Digital Vomit]

Is it possible to put these bits back into the computers once they've been stolen by iPods? Will the computers still work without those bits?

Charlie Jade

[DahGhostfacedFiddlah]

The show didn't get much of an audience, but I liked it.

Just two years ago, when it was being filmed, the idea of a small device that connects to a network and hacks it for you was considered the stuff of high-tech fiction.

And now, here we are.

I'm ready to go to Gamma now.

Re:In other news... Even easier for me

[Anonymous Coward]

I have a laptop with a VPN connection to work's network. I can copy files from work's network to a home network drive in Windows Explorer while sitting comfortably on my couch at home.

Re:Naive to think treating people well protects ..

[swb]

That is naive. Industrial / Commercial espionage happens. Greedy, self-centered, immoral people exist at all levels of companies. "Good" companies get screwed just like "good" employees.

This is just a little cynical, isn't it? Obviously there are certain kinds of trade secrets or valuable personal data (banking, financial, etc) that are vulnerable to theft and this information is supposedly protected for that reason.

But the idea that employees who are treated with fairness and dignity are less likely to to damage to the workplace seems to be common sense. Rejecting this notion outright just seems like a crude justification to treat employees poorly since "some people are bad".

IPod slurping and Security

[Anonymous Coward]

It seems to me that, and this is just my opinion, if the employee with the iPod (with the data gathering application installed) does not have access to read sensitive files, then they aren't able to steal them. If they do have access to sensitive files, then they are in a position of trust which means that they can steal files using multiple methods.

To me, this just means that if you haven't already worked out a corporate system of assigning, monitoring, and removing privileges it's just another reason to do so.

David

And once again

[Tweekster]

that supposed sensative material really isnt that important because it only matters to that company...

Everyone has this feeling that their personal data is soooo important, when in reality it isnt. First off alll, most "trade secrets" could only be figured out by the company. Have you read a corporate document lately, no one can figure that junk out.

Unless you are grabbing a list of credit card numbers (which are actually quite useless) you will get a bunch of documents that are worthless.

Nothing new here, people

[octaene]

As has always been the case, in IT security, physical access to a system is everything. I'd state with relative certainty that any security control is heavily mitigated if a malicious user has physical access to the system.

I think the sensational part of this story is that lots of people use iPods at work and that they've typically been viewed as innocuous devices. Clearly, similar threats are presented by portable USB drives, cell phones with built-in cameras, Bluetooth devices, Web cameras, etc.

Not At My Company!

[Anonymous Coward]

I work for a large telco supplier (another word for luminous, we have a famous lab). The company is shifting to all laptops, with open USB ports, DVD/CDR drives in every one, plus all wireless in an effort to standardize platforms and support costs.

Seems like not all "large companies are already doing this".

This isn't going to stop

[Austin Milbarge]

People who are computer savvy and malicious are always going to try to either attach some device or use a CD burner to steal information. This is where corporate culture comes into play by first, not allowing people to bring in and hook up any electronic devices to their computers and second, by locking down a machine enough where the OS will require a password to access ports such as USB. Unix can already do this and the next version of Windows, I believe, will have this capability as well.

Two words

[Anonymous Coward]

Two words: Morris Worm. Sorry, but I just felt the need to remind you that all has not always been so secure in BSD land. Mail to pipe seemed like a useful thing when it was designed.

That said, BSD fixed those holes quickly, in contrast to the track record of that other OS to which you allude. And I'm certainly a happy FreeBSD user.

Muzic moron

[Anonymous Coward]

What a moronic post. I have already had dumb IT people (Thank God they are not all dumb) trying to prevent the use if an iPod because of the "Dangers of using iTunes"

Now they will just have one more excuse to prevent otherwise hardworking folk from listening to some relaxing/stimulating music while at work.

Get a life and find something useful to spend your idle time posting about. The fact that we have been able to do this with numerous other devices for years didn't cross your mind I guess... (along with a lot of other things).

Why just iPods?

[oshy]

There are loads of MP3/MP4 players out there. Mine is some unbranded 40G unit thats just as capable of sucking files.

Cant they just say MP3 Player?

Re:Simple Solution

[vertinox]

Any open USB/Firewire port is a potentially huge threat to your whole system's security.

Superglue

(You'd think I'd be joking but there are places that do this)

Depends on the environment

[DaChesserCat]

Where I work, most of the IT guys (myself included) run around with USB sticks attached to themselves (hanging around the neck, attached to a belt loop, etc.). Our main support guy has a Linux distro on one of them, and can boot desktop machines off the silly thing; comes in real handy when someone has REALLY hosed up their WinXP machine and he has to try to rebuild it without completely wiping their drive and losing their data. Each of us have a "personal" one which has .mp3's, etc. on them. In my case it's an old 128 MB Sandisk Cruzer. I got it free when we ordered a bunch of hardware from someplace. It's getting harder to buy something that small, these days. Even that little thing can easily haul 100 MB of files around.

Quite a few employees have iPods or other small, personal media players, with capacities that dwarf my Cruzer.

If we wanted to, I'm sure we could slurp a large amount of data and walk off with it. More than a few people have pointed out, though, that it would be unethical. For most people, that's enough of a reason not to do it. Probability of getting burned for doing so isn't really the motivating factor. Most people are ethical enough, without needing any kind of threats hanging over their heads.

On the other hand, my wife applied, at one point, for a position with a defense contractor. She wasn't allowed to bring any kind of personal media player, CD's, etc. into the premises. If she had a camera cellphone, she wouldn't be allowed to bring it in, either. A regular cellphone was allowed, but she couldn't turn it on or take/make calls inside the building; she'd have to be outside on break. She couldn't even bring a personal CD player into the place (no recording capability, at all). She had to go through a metal detector any time she entered the building; good luck sneaking an electronic device past that thing.

It all depends on the environment. Obviously, some places are "locked down" more than others.

Re:Store analogy was terribly naive ...

[pyrrhonist]

For your reference points, here is Steve Jobs' (please mod me up for that topical example) bank account number, and here is mine. Copy the contents of one to the other. I'm not after the money (tis Karma I crave) so feel free to copy in either direction.

I tried to copy all your money to Steve Jobs, but his bank refused to, "fiddle with small change". Bastards. :(

This *should* be a non-issue....

[King_TJ]

There are always going to be stealthy removeable drive type devices out there that someone can sneak in and out of a company easily and copy files onto. The iPod is just a popular target because millions have been sold and most people are aware of them.

The *real* question is, why would employees have access to file shares on servers containing important documents they weren't supposed to have? If your business throws everything on shares that all users have read (or read/write) access to, they deserve what they get for not implementing some sort of security policy for the shares.

If you're an I.T. person who has full access anyway due to the nature of your job, again - so what? You're already able to burn the stuff off to DVDs at night and sneak them home or download them remotely over your corporate VPN or ??? The point is, companies have to place trust in their people to various extents. If they hired you as a sysadmin, they should have already done the background checking and everything else before hiring you - and believe you can be trusted. If you violate that trust - you screwed them, plain and simple. Implementing some sort of "no Ipod allowed!" policy won't prevent that.

Re:Naive to think treating people well protects ..

[hackstraw]

Obviously there are certain kinds of trade secrets or valuable personal data (banking, financial, etc) that are vulnerable to theft and this information is supposedly protected for that reason.

But, look a little deeper into who does this kind of stuff.

OK, are they bright or dumb?

Probably on the brighter side, right? Dumb people risk their lives ripping off a convenience store for $50.

OK, are they wealthy or "underpaid"?

I would say more on the underpaid part. Wealthy people do whatever they want anyway, there is basically nothing that can be done preemptively or after the fact with these guys most of the time.

So, what kind of person is underpaid and bright? Your unconfident typical slashdot geek. So, yeah, I would bet that treating this kind of guy pretty well would reduce your risk of getting burned by this guy.

They did this in a movie once...

[just_forget_it]

I wonder if the person that wrote the program just finished watching The Transporter 2

Someone had to ruin it for the rest of us, eh?

[bing12345]

The problem that I'm beginning to see here is this: - most large companies have an IT department and thus know how to secure USB ports, etc - most small companies know their employees really well and have nothing to worry about - medium sized companies (say between 50 - 150 employees) are big enough to not know all their employees that well but small enough not to have an IT department in house. It's easy to say "hire trustworthy employees" but eventually someone will slip through. The biggest difference between this and target disk mode is that someone could plug in their ipod to "charge" and walk away as opposed to sitting in front of a computer screen where their boss could walk in and see what they were doing. Stupid people writing stupid things may have ruined charging an ipod without a charger for the rest of us. Grrrrr

Do you live under a rock...

[Anonymous Coward]

... or are you still living in a cave? Who is not aware of Apple's marketing slogan? Oh, I'm sorry, you've never heard of Apple, the company that produces computers and consumer items? Wow, a lot must be confusing to you. I bet you've been trying to figure out how people listen to music on a piece of fruit. You poor thing.

Permissions and policies

[jascat]

This is why it's important to have good policies and proper seperation of permissions on your resources. Where I work, no personal storage devices, to include thumb drives, music players and external hard drives, are allowed to enter the building. Personal laptops must be signed in and they are forbidden from going on the network. If they do and we find out about it, the laptop is seized, thoroughly searched and then wiped. Too bad, so sad. They knew the policy when they walked through the door.

How many times have you admins been told to use a non-administrator account for your day to day operations and to give users the least privleges possible? Don't make users local administrators to their machines. Don't give all of your user's domain admin access on a windows network. Don't give sensitive network shares full access to everyone. So many people focus on boundary security and leave their internal network absolutely open. Like others have said, it doesn't take software to do this. It also doesn't take an idiot with some clue of permissions to stop this sort of thing from happening in the first place.

Simple solution to this

[I_can_not_believe_I_]

There's a great, and easy solution to this, when a new computer comes into the company, while you're removing the CD drive (don't laugh, they do with us), go to the motherboard with a pair of wire-cutters, and after disconnecting the USB hubs, cut the pins. Voila, a PC that you can't hook an iPod (or anything else) to.

Re:Simple solution to this

[assassinator42]

I have a PS/2 to USB adapter I got with a keyboard sitting around somewhere. Do those only work with keyboards, or any USB device?

Re:Simple solution to this

[I_can_not_believe_I_]

Well, I'm too lazy to go dig up the specification on PS/2 and check whether or not it's bi-directional, and what the bandwith is; however, the limiting factor for this would be that Windows does not include mass storage device drivers over PS/2.

Therefore, even if you could connect over PS/2, there should be enough safe-guards in place on secured computers to prevent users from installing drivers (by the time IT has taken the CD-ROM and cut USB pins on the motherboard, restricting people's user role is pretty simple.

working?

[johnnyR]

Why are people bringing Ipods to work anyway, aren't they suppose to be, yaknow, working? Then we complain about being outsourced.......

This is news how?

[IgLou]

I'm sorry but the threat has been existent ever since the USB drive/device... or anything that is "hotpluggable". In theory I can come into almost any office with a USB drive with some malicious software to steal secrets or whatnot and just plug it in to the back of someone's computer. I guarantee the average luser wouldn't be aware of the devices existence.

Re:Store analogy was terribly naive ...

[krakelohm]

Good joke... where?

Or you could just use trusted computing

[geekee]

Or you could just use trusted computing to secure your data from people on-site with iPods and other portable storage device. Oh wait. I guess that's evil, never mind.

Re:Store analogy was terribly naive ...

[AHumbleOpinion]

"The most obvious glaring problem with your analogy is that data can be copied and the originals are still there."

I'd like to talk to you after class, ...

I have office hours after class and I'll be happy to alleviate your confusion.

... I wonder if you could make a presentation of your idea that copying data from one place to another is not a crime ...

Why would I do so? You did not misunderstand things and believe that was what I wrote? When data is copied the original is still there, how does the owner know it was stolen, as opposed to physical inventory.

...For your reference points, here is Steve Jobs' (please mod me up for that topical example) bank account number, and here is mine. Copy the contents of one to the other.

Financial transactions don't involve making "copies" of money, they involve transfering it from one place to another. What do you mean by "copy the contents", surely you realize that this is fundamentally different that copying a private data file from a server to an iPod?

I'm not after the money (tis Karma I crave) so feel free to copy in either direction.

Well fools get mod points too so perhaps your foolishness will get you something. Good luck.

Re:Naive to think treating people well protects ..

[AHumbleOpinion]

But the idea that employees who are treated with fairness and dignity are less likely to to damage to the workplace seems to be common sense. Rejecting this notion outright just seems like a crude justification to treat employees poorly since "some people are bad".

The statement I responed too: "Treat your employees well and they won't feel the need to screw you." That is quite different from your "less likely" point, I agree with "less likely".

I stole second base

[geekee]

ok, so I didn't actually deprive the owner of second base.

I don't need an IPod

[Anonymous Coward]

I am using the company provided USB key!

To be able to show our presentations in case the network is not available, or something like that, almost every one has an USB key of at least 256MB. Provide by the company! And if you see how much effort they put in for security, I wonder how long we can keep our USB keys.

Guns don't shoot people

[Savantissimo]

Guns don't shoot people - Vice-Presidents shoot people!

Re:Guns don't shoot people

[Karzz1]

Guns don't shoot people - Vice-Presidents shoot people!

Ummmmm... the guy he shot was a lawyer -- I don't think that counts.

Re:Guns don't shoot people

[Savantissimo]

My bad.

Simple solution...

[Gruneun]

I suppose they can protect against this problem the same way they protect against similar IT theft here: Fill all the USB ports with hot glue, except one (for the mouse).

Yes, I'm serious.

Please, shoot me.

Re:Simple Solution

[pkhuong]

Yeah, that's exactly what I suggested :) It's an effective, cheap, low-tech solution. Ig might even be patent unencumbered! What's not to love?

Mandatory Harrison Ford quote ripped from other /,

[darkhitman]

Ten thousand songs, ten thousand names. It can't tell the difference.

Store analogy was foolish

[AHumbleOpinion]

In other news, a carefully conducted study has revealed that the majority of retail stores are COMPLETELY UNSECURE as the majority of employees have full access to the stockrooms, and many are able to access the cash contained in cash registers!

"COMPLETELY UNSECURE"? With such a poor analogy the attempted joke falls flat. The most obvious glaring problem with your analogy is that data can be copied and the originals are still there, nothing to notice. Not so with the physical objects from the stockroom, they must simply be stolen and their absense noticed. Secondly, stockrooms, cash registers, etc often have have cameras trained on them.

I've worked in a warehouse that stocked department stores. We had a caged jewelry section, a caged firearms section, and a general caged section for other high price / small size items. Access required that keys be logged out.

Friends have worked cash registers and there is quite a bit of individual accounting taking place. Starting and ending balances are individualized, no sharing of a register, and these must balance with transactions.

In contrast data is often far less secure. Commands like "copy" are not logged at most companies, storage devices connecting are not logged at most companies, ... We have millennia of experience handling inventory and cash, security is not perfect but it far more evolved than the handling of data, which is in it's infancy by comparison.

Yes, familiar huh. I'm curious to see if mods react differently when one doesn't insult an AC.

Re:Store analogy was foolish

[Anonymous Coward]

So what. I have to agree with the previous poster. Who needs an ipod when you can just email everything to your personal email? There's no new threat here.

Re:Store analogy was foolish

[AHumbleOpinion]

So what. I have to agree with the previous poster. Who needs an ipod when you can just email everything to your personal email? There's no new threat here.

Wrong. There are often records of an email, perhaps even copies, in other words evidence. Probably not for connecting an iPod.

Re:Store analogy was terribly naive ...

[LordBodak]

The point is, if you don't trust your employees with cash, you won't have them working the cash register.

Along the same lines, if you don't trust an employee having access to certain data, that employee should never have read access to that data. If you can't read it, you can't copy it to an iPod. If you can read it, you can steal it... via iPod, floppy disk, e-mail, or even by printing it. This software is just a tool, and the biggest lesson here is that corporate networks are often not secured properly.

iPod Scans Network?

[DonGar]

How does an iPod access the network though the USB connection? That strikes me as really, really scary.

However, this strikes me as just bad reporting. I'll bet it's PC software that dumps the data to an iPod instead of software on the iPod itself. That means it's just using the iPod as a standard external USB drive.

Microsoft's Rights Management Services

[runlvl0]

I only ask because I don't know, but does Microsoft's Rights Management Services prohibit you from:

• highlight data with mouse
• ctrl + c
• open gmail
• ctrl + v

Or does it just cryptographically protect the document file/format itself?

Re:Microsoft's Rights Management Services

[Squirrelgirl]

it prohibits select+copy and screenshots as well. You need to use an actual camera or something of the screen to get it captured

Custom App?

[Anonymous Coward]

This is a custom app?

Can someone tell me how you write code for the iPod?
It thought it was a closed system...

Not Exactly...

[beyond_the_blue]

There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right?

Wrong. I've worked for large corporations, and all of them subjected me to bag checks at the door (entering and leaving), and all of them strictly prohibited any type of electronic or magnetic storage devices. I had a pocket organizer that had no data ports of any kind, and I couldn't take it in the building, even though it was essentially as functional as a pad of paper.

There was one instance when a manager jumped my case when I had a floppy disk that was given to me by HR when I needed to transfer some files when I moved from one workstation to another.

If there's a big network and an even partially competent IT or building supervisor, storage devices like that are right out.

Scaremonger recycles hype, newsguy recycles story

[billstewart]

A year or two ago, this sort of thing was popular consultant/pundit scaremongering, and the newsies writing the stories without really understanding them were at least writing _new_ cluelessness. By now it's really old hype except that the iPod comes in cool Bono-colored black and the Nano just got its price cut. USB thumbdrives are down to $9.99 on sale for 128MB, USB memory is available in wristwatches and Swiss Army Knives, CDROMs are a dime, or a bit more money for the small pocket-sized ones.

It was bogus hype when consultants first started copying it from each other (to give them some credit, most of them saw an initial article written by some newsie and reinvented the scaremongering detail themselves, because it's simply not that hard.) By 1999, almost every techie sales person had a Palm Pilot with inadequate amounts of memory, by 2000, WinCE PocketPCs had USB, and by about 2002, most WinCE machines let you use standard-format flash cards, typically CF, so you could get enough memory to copy something useful. But the bogus hype didn't really heat up until the iPod caught on, though the scaremongers had kept busy with digital cameras for a couple of years, even before everybody's phone had one.