Social Engineering Using USB Drives

Iphtashu Fitz writes "What's the easiest way to hack into the computer systems of a credit union? It turns out that all you need to do is copy a virus/trojan onto USB drives and scatter them around the front door of the credit union. This was how a recent security audit was performed at a credit union where the employees had actually been tipped off to the audit. Security experts collected 20 old USB thumb drives and filled them with images and other data along with a trojan that would collect sensitive information and e-mail it back to them. Early one morning they planted the thumb drives around the entrances to the credit union as well as other public places where the employees were known to congregate. In very little time 15 of the 20 USB drives were plugged into company computer systems and started e-mailing usernames, passwords, etc. back to the auditors."

Comments

It's definitely a problem...

[Coopjust]

Given autoplay and the fact that many USB keys do not need drivers, this could turn out to be a serious problem.

Why not just disable USB keys? They don't need to take that data home with them...the ChoicePoint disaster, several laptops stolen out of cars... these companies need to make are personal data more secure.

Re:Autoplay trojan?

[TubeSteak]

Even though you're joking, what you're proposing has been around for a looooong time.

http://lastmeasure.com/
Last Measure is a wholly owned subsidiary of the Gay Nigger Association of America

The bastards at GNAA created LMOS (Last Measure OS)
http://sam.zoy.org/lmos/

LMOS is a minimalist operating system targetting multimedia presentations, written with simplicity in mind. Due to its tiny x86 assembly core, it easily fits on a standard floppy: just write LMOS and your pictures to a CD or floppy, and it will boot and play on any IBM-PC compatible computer.

LMOS is a handy tool to carry with you on a business card CD or an USB key. Also, instead of luring people to Last Measure mirrors or similar shock sites, you can simply hand them an LMOS CD with a "Knoppix" sticker on it.

No matter what depravity you can think of, the Trolls have already been there and raped that idea.

Re:But.. How?

[EvilSS]

That is 100% incorrect. USB drives (and ANY removable drive including usb/firewire hard drives) can be used for autorun. Most likely the reason the parent could not get it to autorun is because autorun had been turned off.

If you want a great example of autorun look at Pass2Go from the Roboform guys. It sets up autorun on the USB drive it is installed on. The Microsoft wireless network setup wizard (the one the also exports the WEP/WPA keys of an existing connection on an XP machine as plain text) also sets up a USB key to autorun the wizard.

The word from Microsoft on autorun for nerdsticks

[Beryllium Sphere(tm)]

The Autorun capabilities are restricted to CD-ROM drives and fixed disk drives. If you need to make a USB storage device perform Autorun, the device must not be marked as a removable media device and the device must contain an Autorun.inf file and a startup application.

You have to hack the USB drive itself.

[khasim]

The hardware itself reports whether it is removable or not.

If you flip one of the bits, then it will auto-play just like a CD.

http://en.wikipedia.org/wiki/SCSI_Inquiry_Command

It's the "removable medium" setting.

Re:autorun.inf doesn't work

[Slayback]

Windows XP SP2 changed this behavior and will use the autorun.inf file to autorun. I use this everyday to have Truecrypt automatically pop up to mount my encrypted volume on my USB drive.