Social Engineering Using USB Drives

Iphtashu Fitz writes "What's the easiest way to hack into the computer systems of a credit union? It turns out that all you need to do is copy a virus/trojan onto USB drives and scatter them around the front door of the credit union. This was how a recent security audit was performed at a credit union where the employees had actually been tipped off to the audit. Security experts collected 20 old USB thumb drives and filled them with images and other data along with a trojan that would collect sensitive information and e-mail it back to them. Early one morning they planted the thumb drives around the entrances to the credit union as well as other public places where the employees were known to congregate. In very little time 15 of the 20 USB drives were plugged into company computer systems and started e-mailing usernames, passwords, etc. back to the auditors."

Comments

wow

[nb caffeine]

Thats an amazingly clever idea. "Hey, free stuff" is what I would think. And then plug it into my ubuntu box :)

Re:wow

[Bender0x7D1]

Unfortunately, even if you run ubuntu, you are still vulnerable - that's the beauty of social engineering.

Sure, you might not fall for a renamed executable on a USB drive, but what if it's taken a step farther?

Imagine you are walking into work early, and find an open folder on the floor, with some papers strewn around and a CD or DVD in with it. Imagine the paper is an application to put on a SIGGRAPH demonstration, and on the CD is a WINDOWS directory, a LINUX directory, a BSD directory and a SOLARIS directory and each directory has a file named SIGGRAPH_presentation.exe or there is a SIGGRAPH_presentation.jar, (eliminating the need for multiple OS versions), with a README about how to execute it. You figure, "What the heck - I love cool graphics."

Now, while you are watching a cool graphics demo, it checks if you are logged in as root and, if you are, installs a nasty payload. If not, it could simply start emailing every file it finds in your home directory, or delete them, or encrypt them.

I don't care what OS you are running, if you can be convinced to execute something, there will be some damage done. If you aren't root the damage is limited, but there is still damage. The attack may have to involve more research on a person's interests, or require more "found" hardware to convince someone, but it can be done. Maybe someone has to buy some hardware from ThinkGeek and make a fake installation disk, then leave the box, (with the modified disk), somewhere you will come across it.

Being convinced you are immune to the dangers of social engineering is not a good way to avoid being social engineered. A healthy dose of paranoia can go far - and it's only paranoia if there isn't anyone out to get you.

Re:Pretty scary.

[CastrTroy]

Believe it or not, the banks' #1 concern is not privacy of the customer's data. The #1 concern is accuracy of the data. The most important thing is that the money is where it is supposed to be. This is the reason that banks spend so much on their computer systems. Not to keep the information secret, but to keep it accurate.

Disabling USB drives is missing the point

[InakaBoyJoe]

People love USB drives for good reasons. They make the data personal, tangible, an object that follows physical laws that users know intuitively. To an IT person, data is just ones and zeroes in some arbitrary physical medium. But to most users, there is a big difference between that letter you wrote last week disappearing into some network ether, versus residing on a physical USB drive you can hold in your hand.

Most of the comments in this thread are of the "USB drives are a big security hole! Disable them!" variety. What a classic example of IT snobbery. A good administrator, one who understands his users, would stop to think WHY people use USB drives, and try to create a solution that balances the benefits vs. risk to the users.

Along this line of reasoning, an ideal system would be a thin client that accepts USB drives for file storage, automagically backs them up when they are used, and doesn't run any executables other than what's configured. Kind of like the old Sun smart card idea where the user has a physical, tangible ID card where his files conceptually reside.

If you want your users to respect your network security concerns, you first have to try to respect your users.