NSA Develops USB Storage Device Detector

Hugh Pickens writes "Bob Brewin writes on NextGov that the National Security Agency has developed a software tool that detects thumb drives or other flash media connected to a network. The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool, provides 'network administrators and system security officials with an automated capability to detect the introduction of USB storage devices into their networks. This tool closes potential security vulnerabilities; a definite success story in the pursuit of the [Defense Department] and NSA protect information technology system strategic goals.' The tool gathers data from the registry on Microsoft Windows machines (PDF) and reports whether storage devices, such as portable music or video players, external hard drives, flash drives, jump drives, or thumb drives have been connected to the USB port. 'I have a hunch that a bunch of other agencies use the detection software,' writes Brewin."

Comments

Wow.

[jgreco]

Wow. Clever. Nobody ever thought of that before.

Re:Wow.

[Itninja]

No kidding. I seem to remember using some open-source utility that did exactly this like 5 years ago.

Re:Wow.

[BJ_Covert_Action]

Seriously, I just dropped Puppy Linux on an old laptop of mine and one of the first packages I installed, that was freely available in the repositories, did exactly this. Hell, I could pipe the output from that utility into a perl script that popped up a big red box on the network admins display if the state changes.

For that matter, you could probably homebrew a shell script that monitors the /dev files on your systems and reports usb usage. I like how some of our tax dollars fund bloated agencies to come up with solutions that unshaven hackers in their mom's basements figured out years ago.

Re:Wow.

[Anonymous Coward]

I like how some of our tax dollars fund bloated agencies to come up with solutions that unshaven hackers in their mom's basements figured out years ago.

Because clearly the NSA started numbering this program at 3.0 just for the hell of it.

Re:Wow.

[Crudely_Indecent]

Why would the government spend a few of their citizens dollars for an existing tool when they can take and spend millions of their citizens dollars. They're not playing with their own money.

Remember, if they don't use all of their budget, it'll be reduced next year. They need to show budget shortfalls in order to justify a request for budget increase.

Re:Wow.

[Darkinspiration]

Because they want to integrate it with theyre security suite or theyre logging solution, because they have over 9000 machine using it. If they want to spend the budget they could buy fancy new chair instead of wasting programmer and consulting time coding a app. Don't forget that gouvernement is big and app deployement, monitoring and security is not free.

Re:Wow.

[davester666]

How exactly do you connect a USB drive to a network? They use completely different connectors.

Re:Wow.

[stonewallred]

Difference is that the NSA program probably copies everything on the attached drive, decrypts anything encrypted, plants a keylogger and backdoor and calls home when hooked to another drive with all the new stuff. I ain't got over the fact they are still sifting through the data they stole from the telecoms with their black rooms and diverting 99.99% of traffic through their boxes.

Re:Wow.

[masshuu]

http://www.chinatraderonline.com/Files2/pic/2008-5/30/USB-A-F-to-RJ45(8P8C)-Adapter(Crossover)-15250240208.jpg
simple

Re:Wow.

[somenickname]

$ ls -l /etc/udev/rules.d/99-mail-on-usb.rules
-rwxr-xr-x 1 root root 159 2010-04-13 21:23 /etc/udev/rules.d/99-mail-on-usb.rules
$ cat /etc/udev/rules.d/99-mail-on-usb.rules
ACTION=="add",SUBSYSTEMS=="usb",RUN+="/bin/sh -c 'who | mail root -s Insert'"
ACTION=="remove",SUBSYSTEMS=="usb",RUN+="/bin/sh -c 'who | mail root -s Remove'"

That's my version 1.0 and took almost 30 seconds to create. I don't live in my moms basement though. :(

Re:Wow.

[Anonymous Coward]

THEYRE?!
Fucking hell, this is getting out of hand. It's "their security suite" you fucking illiterate American ignoramus! As in:
"Their level of literacy indicated that they're getting dumber by the minute over there."

Re:Wow.

[destuxor]

Yeah...no. I used a previous version of this application I found on DISA's website. It was a simple .NET application that apparently pulled information from the registry of a remote workstation using WMI. If you're slick on Windows and Visual Studio you could have it implemented in a day.
The older application wrongly assumed that a number that Windows assigns each unique USB device was your serial number. Maybe that number is a USB-particular serial number - don't know, don't care. The application reported these long, worthless numbers as device serial numbers that didn't match the number printed on the back of an iPod you personally confiscated minutes ago.
Scanning is good, scanning is fun - but it doesn't give the warm fuzzy of a NIDS/HIDS sending alerts to your pager when you're trying to sleep...

Re:Wow.

[Grishnakh]

The problem with this is that what you wrote is a Linux-only implementation. Doing something functionally equivalent on Windows, which the NSA program does, requires a large application program with thousands of lines of code, as do many things in Windows. This is obviously superior, as it means the NSA/Windows solution keeps people employed for far longer than your 30-second solution. This is why we need to abandon Linux, or perhaps even ban it, because it's basically putting many people out of work.

Arms race anyone?

[TheCarp]

"USB Detect detects the use of removable drives"
"Shadow Drive evades detection by the following products"
"Latest USB Detect detects Shadow Drive use!"
"New ShadowDrive 2.0!"

Shit, the parent company of both products could make a killing! Hey wait a minute, is this another lame
attempt to bring money in off the books for illegal ops?

-Steve

Re:Arms race anyone?

[swanzilla]

"USB Detect detects the use of removable drives" "Shadow Drive evades detection by the following products" "Latest USB Detect detects Shadow Drive use!" "New ShadowDrive 2.0!"

A strange game. The only winning move is not to boot Windows.

Re:Arms race anyone?

[neonv]

"NSA Slashdotter Develops USB Storage Device Detector Trigger"

Runs as a service to drive you local network admin nuts!

Re:Arms race anyone?

[fuzzyfuzzyfungus]

It'll be a pretty short race, for all but a fairly dedicated hard-core.

In order for the USB device to do anything, the host OS has to load the appropriate driver. Until it does so, you aren't getting anything other than 100ma at 5V(higher amperages quite possible, depending on the situation).

Getting the OS to load a driver without noticing that it has loaded a driver(and without the benefit of exploit code, since you don't get to access that until the drive is mounted) would be quite a trick. Assuming this monitoring software isn't completely braindead, the fact that a USB mass storage device has been inserted, along with any interesting ID strings, will have already be sent to a monitoring server before your filesystem is even mounted. Any tampering you do at that point will just introduce suspicious discrepancies.

Now, there is(for instance, I'm sure the suitably creative can think of others) nothing stopping a truly dedicated exfiltrator from obtaining the USB device and vendor IDs and so forth for the brand of keyboard used at that particular establishment, then building a USB device(using one of the common and inexpensive USB-capable microcontrollers) that presents exactly those IDs, and is thus detected as a USB-HID keyboard, rather than a USB-MSC device. They could then use the fact that the keyboard LEDs are under software control as a method of getting data off the system. At least on a unixlike, anybody with some basic script-fu could probably be piping arbitrary files off the system with xset led in about 10 minutes. Your custom USB device would have a slab of flash, which it would fill according to the LED commands it received. I don't know if there is anything equivalent on Windows.

Using tricks like that, you could probably get something of an arms race going(though, still, anything that involves doing suspicious program/script execution is going to get your ass busted in any reasonably paranoid environment); but for USB MSC stuff, it is only the pure apathy of the administration, or the fact that they recognize that mass storage devices are extremely convenient and beloved by users, that lets you get away with it.

Re:Arms race anyone?

[tomhudson]

A strange game. The only winning move is not to boot Windows.

Or plug it in before booting ... since it detects drives as they are plugged in and unplugged.

Or boot linux off it, and load Windows in a vm if you really really need windows.

Re:Arms race anyone?

[Anonymous Coward]

More like: Hey EVERYONE! We discovered the command: dmesg | less !!!

Re:Arms race anyone?

[jaavaaguru]

We did that. Now where's my Linux version of USB Detect please?

Re:Arms race anyone?

[History's Coming To]

Or tinker with a soldering iron and $20 of components so a big flashing light goes off as soon as a USB device is detected? Or monitor the power supply on the motherboard (software independent)? Or do what my workplace does....if you're that worried, don't have USB ports or fill them with epoxy and/or physically cut the connections.

Re:Arms race anyone?

[poena.dare]

I've seen a number of PCs with a universal flash card/stick reader that is itself a USB device similar to a flash drive. I'll bet those things are gonna set off all the alarms.

You can send a ton of data to a device mimicking a Logitech G15 Keyboard, I would think.

Kinda silly I think, but I'm sure this will get very serious treatment in all sorts of pseudo-IT-security mags and blogs. Once again, I'm in the wrong goddammed business!

Re:Arms race anyone?

[Anonymous Coward]

I'm not sure if I heard a "wooshing" sound or not. Anyhow, from the movie "War Games":

Greetings, Professor Falken.
Hello, Joshua.
Strange game.
The only winning move is not to play.
How about a nice game of chess?
Colonel Conley, take us to DEFCON 5.
Yes, sir.

Re:Arms race anyone?

[ArsonSmith]

boot from USB drive with hypervisor that then boots the standard OS. Hypervisor presents the USB as a real hard drive or some other read/write non-removable device.

Re:Arms race anyone?

[Rantastic]

Why not just do what we did? Create some udev rules so that anytime someone inserts a USB, instead of mounting it, the system silently logs the event and sends an alert. As far as the user can tell, the USB key just won't mount. And no, the users do not have root access to change this.

With some clever udev rules and a shell script, you can even record the make, model, and serial number of the USB key that was inserted.

Re:Arms race anyone?

[mikael]

Try typing 'dmesg' if you are using Linux - that will give you the kernel message logs.

There is also 'lsusb', which lists all USB devices, along with 'usb-devices' There are other utilities which allow you to snoop on all USB traffic.

Whenever a device is inserted or removed from a USB socket, it generates a notification event which is logged by the kernel. It isn't going to be too difficult to have those events sent across the network to a central server, or to have a central server to poll each system for the results of 'lsusb' or 'usb-devices'.

Re:Arms race anyone?

[Anonymous Coward]

what are you talking about? has nothing to do with an o.s.

Re:Arms race anyone?

[tomhudson]

.if you're that worried, don't have USB ports or fill them with epoxy and/or physically cut the connections.

It must suck to be stuck using that old dot-matix printer hanging off the Centronix parallel port. And that serial mouse - a null-modem cable will let me suck the data out of your box just fine. That old-style keyboard plug? Hate to have to buy a new keyboard ... and not be able to plug it in.

Re:Arms race anyone?

[Anonymous Coward]

Your custom USB device would have a slab of flash, which it would fill according to the LED commands it received. I don't know if there is anything equivalent on Windows.

You're trying way too hard;
    Linksys Network Storage Link for USB 2.0 Disk Drives reviewed 1:10 PM - July 6, 2004

Case and point; provides you access without black magic, and demonstrates what 98.2% Microsoft market share does to CIO's (layer 7 junkies) - who all seem to think that their "network" starts at the Windows login screen and not the UTP port.

Bob Brewin writes on NextGov that the National Security Agency has developed a software tool that detects thumb drives or other flash media connected to a network

Bah! n00bs.

Re:Arms race anyone?

[AHuxley]

All your MS tinkering will only find what a FOIA might get you in 20-40 years.
All the good nuke stuff is never classically networked and only known by the US techs and the Russians who turn them ;)

Re:Arms race anyone?

[networkBoy]

or you can actually get data off the PS2 keyboard port if you really need to. you can send two bits with parity per transaction just by usage of the caps/num/scroll lock LEDs.

Might be a bit slow, but certainly is an interesting sideband attack...

Re:Arms race anyone?

[fuzzyfuzzyfungus]

I would sincerely hope(though, if "thumb drives connected to a network" is anything other than clueless journalist distortion, that hope may be unjustified) that the network in any NSA building would refuse to talk to an unknown device, and probably ping somebody angry to come and take a look. 802.1X is kind of a pain, so I can understand why lots of low security wired LANs aren't doing it; but I'd hope that the NSA would suck it up and do it right.

If they aren't, in fact, doing it right(and quite possibly even if they are), I'd take a look at the printers. Your modern workgroup printer is generally a powerful beast, running some embedded OS on a fairly serious little board(half dozen services listening on various ports, if nobody shut them off, sometimes with multiple authentication mechanisms, one of which somebody always forgets to set. If it's a multifunction printer/scanner unit, you might even find a hard drive full of the last few hundred scans...) If you are dealing with the competent-but-fatally-Windows-centric, a printer makes an excellent target. It is supposed to be there, so the network guys won't catch you trivially; but it doesn't respond to Group Policy, so the Microsofties won't even think about it.

(That said, the NSLU2 is a great toy. Arguably obsolete now that you can get a SheevaPlug with a hell of a lot more RAM and some extra peripherals for the same money; but if you can do it in debian ARM and 32MB of RAM, the NSLU2 is great.)

Re:Arms race anyone?

[Minwee]

It must suck to be stuck using that old dot-matix printer hanging off the Centronix parallel port.

Actually the printers are plugged in to _ethernet_ ports. On network switches, where their MAC addresses have been registered to prevent gangs of street kids from sneaking in their own bulky laser printers and connecting them to the office network because that's the kind of thing that they do now.

a null-modem cable will let me suck the data out of your box just fine

Not when the serial port has been disabled in the BIOS, and the BIOS locked with an unremovable admin password. You can suck on your null-modem cable all you want, but you're not going to get anything but chapped lips.

And that serial mouse [...] That old-style keyboard plug? Hate to have to buy a new keyboard ... and not be able to plug it in.

The keyboard and mouse are connected to the USB ports on the back of the case, inside the wire cage where users can't get at them. If it's a notebook computer then they're built in and don't need to plug in anywhere. People have thought of this kind of thing before, you know. It's not a new concept that just popped up today on Slashdot.

Re:Arms race anyone?

[fluffy99]

Or plug it in before booting ... since it detects drives as they are plugged in and unplugged.

Wrong. I've used the tool and its nothing special. It just queries a range of computers and queries the registry keys for usb devices that the OS knows about, and whether they are currently plugged in. So as soon as windows says "detected new device" then its been found. It happens to detect SATA drives plugged as well if they show up under "unplugged devices".

One trick for evading this tool is changing the registry permission on that key, but the tool will flag it as access denied. Still it was nice to know who's had an ipod plugged in so I could remind them of appropriate use of our computers. I usually knew who anyway because they also had itunes installed.

Re:Arms race anyone?

[fluffy99]

In order for the USB device to do anything, the host OS has to load the appropriate driver. Until it does so, you aren't getting anything other than 100ma at 5V(higher amperages quite possible, depending on the situation).

You've never dealt with some motherboard that don't regulate the current at all, eh? I've had a few, including some Dells that just fed 5-volts with a 1-amp limit to all the usb ports regardless.

Getting the OS to load a driver without noticing that it has loaded a driver(and without the benefit of exploit code, since you don't get to access that until the drive is mounted) would be quite a trick. Assuming this monitoring software isn't completely braindead, the fact that a USB mass storage device has been inserted, along with any interesting ID strings, will have already be sent to a monitoring server before your filesystem is even mounted. Any tampering you do at that point will just introduce suspicious discrepancies.
 

This tool isn't a monitor. You run it and it queries computers, enumerating the drivers/devices that it know about. It produces a list of computers, the vendor-ids/make/model of the usb devices that computer has seen, and if they are currently mounted.

Re:Arms race anyone?

[fuzzyfuzzyfungus]

If the BIOS is letting you boot arbitrary removable media, admin has already fucked up, badly.

Unless the HDD is encrypted, allowing removable media boot means that anyone with physical access can tamper with the OS more or less freely. Overwrite hashes to gain local admin access, disable unwanted monitoring software, change permissions on files and registry objects, the works.

The hypervisor approach would be technologically impressive, if pulled off. Most off-the-shelf offerings either emulate a limited set of older peripherals, since those are the ones that are sufficiently well understood, and broadly supported, or emulate a set of explicitly virtual peripherals, with their own special drivers, designed for performance, not to fool the OS into thinking that it was on a real machine.

Building a hypervisor that accurately emulates a particular contemporary hardware platform well enough that the OS won't notice, while also doing some sneaky concealing of what is going on on the USB bus and pretending that a USB device is actually an SATA drive or something, would be both onerous(building accurate emulation of the contemporary chipset and peripherals) and tricky(doing the sneaky USB stuff).

Re:Arms race anyone?

[Anonymous Coward]

Actually the printers are plugged in to _ethernet_ ports. On network switches, where their MAC addresses have been registered to prevent gangs of street kids from sneaking in their own bulky laser printers and connecting them to the office network because that's the kind of thing that they do now.

Hell, off-the-shelf broadband routers have the ability to clone MACs.

Not when the serial port has been disabled in the BIOS, and the BIOS locked with an unremovable admin password.

Easy as pie to pop the jumper and clear the BIOS. What's the saying? If you have physical access....

The keyboard and mouse are connected to the USB ports on the back of the case, inside the wire cage where users can't get at them.

Wire cage? Are the spaces between the wires big enough to slip a USB drive through? Can the lock be picked? The wires bent?

Re:Arms race anyone?

[tomhudson]

It's trivial to re-enable a serial port that has been disabled in the bios. You can use debug to write to the bios data area under windows, or you can write a small program to do it for you. I used to reassign serial ports on the fly that way - 4 ports and 2 interrupts is not a good situation, but 4 ports and 1 shared interrupt IS good.

Your "bios blocked with an unremovable admin password" is also bs - while you sometimes have to open the cover and short out a couple of pins for a few seconds, sometimes it's possible to do it entirely in software as well - but you miss the point - the bios is read at startup, but I can monkey with it as much as I want afterwards.

also, serial cards are cheap. So are ethernet cards. So plug all the ports you want with epoxy, and people will still get the data out. Or they can just take a picture with their cell phone.

The keyboard and mouse are connected to the USB ports on the back of the case, inside the wire cage where users can't get at them. If it's a notebook computer then they're built in and don't need to plug in anywhere. People have thought of this kind of thing before, you know. It's not a new concept that just popped up today on Slashdot.

... and a pair of wire cutters fixes that. snip, splice, done. Or just take the keyboard apart and the wires are nicely exposed (if you've ever tried to wash a keyboard, you've taken it apart to see how munged up you ended up making it, so you know the wiring is dead simple where it connects).

A notebook - even if you plug all the usb AND the card reader, my mini philips screwdriver will have the hd out in seconds - it's a LOT easier to remove and replace than a desktop. I'll also reconnect the wireless (it's just one wire, after all, and nowadays even if you rip it out it's field-serviceable and replacements are cheap). Pop the hd into the second drive bay on my laptop, make an image of it with dd, and I'm good :-)

If someone has physical access, you cannot stop them from getting the data if they really want it.

Re:Arms race anyone?

[Anonymous Coward]

It doesn't matter if you didn't tell users the root password.
With physical access, they OWN the system, and no silly runtime config stops anything, it's as far away as booting a rescue image or single user and changing whatever files they want on the system disk.

At which point, even the root user itself is just a few keyboard strokes away from being changed to whatever the hell they want.

Re:Arms race anyone?

[Anonymous Coward]

Maybe you missed the part with the wire cage. You need some bigger equipment here to get into the case. Also you wont ever plug in an ethernet card in while the system is running. Turn a system off and you got a sysadmin there faster than you can unpack your tools. Mouse and keyboard are connected via PS/2. Printer is connected via Ethernet.

Also tampering with a screwdriver on a laptop takes more time than you have in an office. Walking away with it might work, but wont go unnoticed.

Also if you intend to take pictures with your cellphone it might be hard to do that because phones with cameras are in a box at the entrance to the building.

Re:Arms race anyone?

[Anonymous Coward]

Not when the serial port has been disabled in the BIOS, and the BIOS locked with an unremovable admin password.

And ignoring all the workarounds that others have mentioned for BIOS, the fact that there's often a hardcoded, manufacturer-specific default password for BIOS that lives alongside the user-specified BIOS password.

Re:Arms race anyone?

[Anonymous Coward]

If someone has physical access, you cannot stop them from getting the data if they really want it.

All good and well, but it's worth noting that the primary threat admins are trying to defend when disabling USB ports, or detecting thumbdrives, or whatever, is simply the inadvertant transmission of viruses. They are (usually) aware that data will leak if an internal attacker with physical access really really wants it.

Re:Arms race anyone?

[neumayr]

This tool is probably meant for a controlled environment. People will not be allowed to bring their own OS.
Besides, a similar tool can be made using Linux' hal...

Re:Arms race anyone?

[dbkluck]

Why not just do what we do? Full body cavity searches for flash drives before you're allowed into the building for work each morning.

Re:Arms race anyone?

[tomhudson]

Maybe you missed the part with the wire cage. You need some bigger equipment here to get into the case. Also you wont ever plug in an ethernet card in while the system is running. Turn a system off and you got a sysadmin there faster than you can unpack your tools. Mouse and keyboard are connected via PS/2. Printer is connected via Ethernet.

No, I didn't. Maybe you missed the part with the wire cutters.

Also, you CAN sove an ethernet card into a PCI slot while the system is running. Same as you can with a hard drive. YMMV, but guess what - the onboard controller initializes the device without the need of the system bios. People do this all the time with flaky hard drives that they NEED to get data off of but that are so flaky that if they are present at boot-up, they prevent the system from booting.

And the printer being on the ethernet gives yet another point of attack. Snip, snip, splice splice.

Also tampering with a screwdriver on a laptop takes more time than you have in an office. Walking away with it might work, but wont go unnoticed.

Less than a minute. Or have you not opened up a laptop in the last few years? They're a lot easier to work on than desktops when it comes to things like swapping hard drives, installing ram, or changing the wireless card.

Also, walking away with a laptop is easy - just bring in a similar make and model dead laptop, then complain - "My laptop is dead." They'll check it out, realize it really is dead, and there won't be a laptop officially missing for a day or two. And at that point, who did the swap ... you, or someone else?

Also if you intend to take pictures with your cellphone it might be hard to do that because phones with cameras are in a box at the entrance to the building.

So we go old-school - a FILM camera, just for that Kodak moment.

You cannot depend on technology to replace trust in the people around you. If you can't trust them, they shouldn't be working there in the first place, and you have bigger problems than you realize.

Re:Arms race anyone?

[jep77]

Well obviously you wouldn't fill the mouse and keyboard usb ports with epoxy.

Re:Arms race anyone?

[Minwee]

And ignoring all the workarounds that others have mentioned for BIOS, the fact that there's often a hardcoded, manufacturer-specific default password for BIOS that lives alongside the user-specified BIOS password.

Oh, good. In that case I've got a skid full of old Thinkpads to sell you. Surely, since getting past BIOS passwords is trivial, they'll be worth a lot to you.

Re:Arms race anyone?

[Anonymous Coward]

Linux anyone?

Re:Arms race anyone?

[Minwee]

If someone has physical access, you cannot stop them from getting the data if they really want it.

You may find it difficult to explain to building security just what you were doing under the receptionist's desk with a bolt cutter, three screwdrivers of various sizes and shapes, as well as a bag full of wireless cards. They may also find it a bit odd that you chose to field-strip several of their computers instead of just waiting patiently for the meeting you were supposed to attend.

Had you been able to casually palm a USB device into an unused port then nobody would have noticed. It's a little bit more difficult to casually disassemble a keyboard without anyone seeing what you are doing.

Re:Arms race anyone?

[tomhudson]

And ignoring all the workarounds that others have mentioned for BIOS, the fact that there's often a hardcoded, manufacturer-specific default password for BIOS that lives alongside the user-specified BIOS password.

Oh, good. In that case I've got a skid full of old Thinkpads to sell you. Surely, since getting past BIOS passwords is trivial, they'll be worth a lot to you.

It IS trivial. IBM tells you how to do it. The instructions are in the field service manual. I found them last week while looking to see what types of replacement batteries I can use (turns out that pretty much anything that ends in 1220 is fine).

However, those thinkpads probably aren't even worth the shipping charges. The only reason I want to boot this one up is because it's handy to run a copy of dbase5 for dos on it when I feel nostalgic.

Re:Arms race anyone?

[tomhudson]

You may find it difficult to explain to building security just what you were doing under the receptionist's desk with a bolt cutter, three screwdrivers of various sizes and shapes, as well as a bag full of wireless cards. They may also find it a bit odd that you chose to field-strip several of their computers instead of just waiting patiently for the meeting you were supposed to attend.

Are you kidding? Cube farms are great places for doing all that, and more. And you only need one screwdriver.

Re:Arms race anyone?

[History's Coming To]

Most modern printers also have ethernet connections, it's called network printing. Saves us a fortune on printers because we can share them. The barcode scanners we bought a good few years ago are on PS2 ports linked in with the keyboard anyway. All of our equipment is standard legacy stuff used in millions of offices worldwide. Yes, it's a hassle not being able to use flash drives, but that's the entire point. You can easily do without USB, especially if you want to stop some well meaning idiot uploading a virus ridden torrent of last night's episode of Desperate Housewives.

Re:Arms race anyone?

[tomhudson]

Most modern printers also have ethernet connections, it's called network printing. Saves us a fortune on printers because we can share them.

Here, let me fix that for you.

"Most modern printers also have ethernet connections, it's called network printing. Costs us a fortune on printers and consumables because we can share them."

I can go months without printing. Whatever happened to the paperless office?

Re:Arms race anyone?

[Anonymous Coward]

If someone has unnoticed physical access for an extended duration, you cannot stop them from getting the data if they really want it.

There, I fixed that for you. The vast majority of people using computers in a highly managed network environment don't have any of those skills to start with, and the ones who do don't have the opportunity to get away with it in most cases.

Take a call center as a good example- I worked at one with about 500 stations. There's no way in hell you could start pulling cases apart without a dozen people saying something, and the log-everything software would still show you trying to hack it via software methods... "Gee, Tom Hudson's computer just stopped logging all his activity, the last thing I see is him loading up a debugger. And I'll be damned if I don't see him at his desk with a hacksaw, soldering iron, and the guts of the MB strewn all over the place."

Most people who try any of that kind of shit end up without a job. This isn't meant to stop a dedicated attack, in fact it isn't meant to stop you at all. It's meant to alert the IT guys so they walk up to your desk and say "Hey, you're not supposed to be plugging that shit in at work, so knock it off or pack your crap."

Re:Arms race anyone?

[tomhudson]

Ever been in a call center during the graveyard shift. I walked into one (to get through to the section where I was writing the point-of-sale software) and most of the cubbies were empty. Anyone could have kept their headset on and stretched out to the next cubby and jimmied open a box with no problem. They would even have "proof" that they couldn't have been the ones to do it, since they were always jacked in and able to take a call.

Also, the higher-ups have even less of a clue to security - they leave laptops on the roof of cars and then drive away ... or sitting on the front seat. Or did you miss all those stories about military secrets getting leaked by cthe clueless. Also, I don't need anything more than a wire probe to get into your network - no need to unplug anything, even for a second.

3.0?

[Itninja]

"The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool"
So if this is 3.0 can I assume they have had the tool for some time. Why are bothering to tell anyone at this point?

Re:3.0?

[batquux]

They aren't. Someone leaked it.

Re:3.0?

[Hognoxious]

They're actully running version 4.0, but don't tell anyo!7*0 ,.;
lno carrier

Re:3.0?

[CorporateSuit]

So if this is 3.0 can I assume they have had the tool for some time. Why are bothering to tell anyone at this point?

Check out the comments on this article. They just need a quick dredger to go through and find out what additional security measures need to be programmed into 4.0. No need to do their own research, since they have a million know-it-alls at slashdot happy to tell them how they'd hack the NSA if they were to do it via thumbdrive.

Re:3.0?

[fluffy99]

They aren't. Someone leaked it.

It's been available on several NSA and DISA websites for at least a few years. It's being freely given away to Federal agencies as a tool to help secure their networks (something NSA and DISA are suppoed to be doing). Not exactly much of a leak, eh?

It's not hard to gin up your own version of this with a little wmi scripting.

Re:3.0?

[Anonymous Coward]

It's not leaked, it's not classified and it's not even interesting. It's a crap application that nobody uses.

Too easy to circumvent

[dave562]

It relies on information from the OS. The OS is too easy to circumuvent. For example, it doesn't report on whether or not the system has been booted from a USB device. Given that they are the NSA, maybe they have the luxury of making the assumption that USB boot is disabled and the BIOS is password protected?

Re:Too easy to circumvent

[fatalwall]

I looked into making a viable product like this a while back. You run into too many issues.

First you have to set up the bios on all machines to prevent booting off any device other then the hard disk.

Then you have to password the bios

Then you need to put a physical lock on the computer to prevent some one from opening the case and resetting the bios.

If you manage to do this you then need a dope slap because you can always use ssh or even plain email to get files out. Then what about the occasion where you need usb drives.

Your best bet is controlling the hardware. Making sure the machines do not have USB ports or cdroms. if you cant get them without the usb port then you could insert locks into them of some sort that to remove requires specialized equipment and a code.

Re:Too easy to circumvent

[armanox]

Or just bend the pins on the USB ports...

Re:Too easy to circumvent

[Bakkster]

If you manage to do this you then need a dope slap because you can always use ssh or even plain email to get files out. Then what about the occasion where you need usb drives.

This is almost certainly aimed at preventing classified information leaks. Machines with classified information are not connected to any network containing unclassified machines, and definitely not the internet. Even if it were connected, sending that e-mail leaves a record of the transmission, meaning the spy can be easily identified.

USB drives are the most likely way to get info off a classified machine, which is precisely why they're forbidden. There is no legitimate occasion where a USB drive is needed in this case.

Re:Too easy to circumvent

[daremonai]

Or just shoot all the users and get it over with.

Re:Too easy to circumvent

[mirix]

kind of pointless though, because there are still printers and pencils, and human memory if that fails.

Re:Too easy to circumvent

[spazdor]

easy fix:

http://xkcd.com/294/

Re:Too easy to circumvent

[ProppaT]

You hit it in your last sentence. The NSA isn't concerned about booting from a USB device. For the system to be certified and contain sensitive information, the BIOS would have to be protected and USB boot would be disabled.

You have to take into consideration, the NSA isn't looking to keep out hackers. Well they are...of course they are...but they also know hackers are hackers and will find their way into a machine. They're looking to lock out and detect/prevent lay people from being able to put in a USB stick and walk away with data they can sell.

Re:Too easy to circumvent

[Stray7Xi]

kind of pointless though, because there are still printers and pencils, and human memory if that fails.

If your employees are trying to violate your security, you'll never stop them reliably.

Instead you assume your employees are stupid and/or lazy. You make policies that when followed will prevent them from becoming a victim of social engineering or accidently leaking info. Plus if thumbdrives are prohibited then the act of having a thumbdrive on you is a security incident that's pretty hard to explain.

Re:Too easy to circumvent

[Darinbob]

Does it assume Windows? Does it assume there's actually a BIOS?

Re:Too easy to circumvent

[Anonymous Coward]

Machines with classified information are not connected to any network containing unclassified machines, and definitely not the internet.

How does this work with Windows Vista or Windows 7 activation, by the way? Do the key servers never connect to Microsoft?

Re:Too easy to circumvent

[Anonymous Coward]

Worked at a recycler for a time, and some of the systems we saw had, in fact, been used by various security-paranoid organizations, and I can attest to the fact that some of what you mention as "too many issues" didn't deter these guys IN THE LEAST from poor implementation in an effort to offer the illusion of security.

"First you have to set up the bios on all machines to prevent booting off any device other then the hard disk."
Trivial: standard setting in BIOS controls enables you to do EXACTLY that much, assuming you didn't bother w/ a firmware upgrade that removes that functionality from the outset. Resetting the BIOS was equally trivial, of course.

"Then you have to password the bios"
Standard feature of BIOS instructional code for the last couple of decades, heck, a custom BIOS can likely be made to include encryption of the password, if you like. Minor headache, reset button, bridge a jumper, or at worst, grab a chip puller and yank the BIOS chip, swap with a new one.

"Then you need to put a physical lock on the computer to prevent some one from opening the case and resetting the bios."
Can't begin to tell you how many physical locks I had to chisel, grind, chip, and chew off of these boxes just to get to the salvageable parts within. Installation was probably inconvenient, but not really that problematic, removing them was the hard part. Even so, still doable 85% of the time in under 15 minutes with not much more than a screwdriver with specialty bits and a little elbow grease if you didn't care what they looked like afterward.

"If you manage to do this you then need a dope slap because you can always use ssh or even plain email to get files out. Then what about the occasion where you need usb drives."
Yep, valid argument, but easily solved by restricting network access at the physical level. Some motherboards were made that offered USB ports ONLY as a hardware add-on that plugged into the board either via a set of pinouts on the board, or as a daughter card that plugged into an available slot on the bus, just offset from the video port as I recall. Need a USB port? Ask the supervisor, and he can hand you one for your board....after signing the right forms, I imagine. Meh, if you know the internals of the system, you could probably just bring your own. As for network ports, many of these boxes I processed had no built-in ethernet ports, though some did have cards, and a few were equipped with PCMCIA add-on slots where a cd-rom ought to have been. Every single one, though, came with a standard parallel port for a printer, and I suspect they may have been linked via that through a print server or maybe even some kind of router for a mainframe.

I agree, controlling the hardware is a good bet,but not foolproof. Less of a hassle to control your people, ultimately.

Re:Too easy to circumvent

[Anonymous Coward]

Why is this even an issue, shouldn't the classified machine you speak of not allow external drives to begin with? I'm pretty sure years ago we had rackmount cases that if you opened them it'd disable the system to prevent local tampering.
Google can get custom motherboards with batteries, I highly doubt any orginization with classified data can't get custom motherboards without USB. (turning it off is one thing, making it not be there at all is ideal)

Re:Too easy to circumvent

[destuxor]

Machines with classified information are not connected to any network containing unclassified machines, and definitely not the internet.

About that...

...the spy can be easily identified.

About that...

USB drives are the most likely way to get info off a classified machine, which is precisely why they're forbidden.

About that...

Re:Too easy to circumvent

[mlts]

Activation is handled two ways offline:

1: One calls Microsoft and gives an install ID (which changes each install). The person on the other end gives a response key, and this should activate the machine.

2: Corporations using Vista Enterprise, Vista Business, or Windows 7 Enterprise use KMS servers (5 servers or 25 clients minimum.) These allow machines to activate without ever touching the external Internet.

Re:Too easy to circumvent

[Anonymous Coward]

2: Corporations using Vista Enterprise, Vista Business, or Windows 7 Enterprise use KMS servers (5 servers or 25 clients minimum.) These allow machines to activate without ever touching the external Internet.

Thanks, I was thinking of the KMS servers: Do they need to be activated, by phone or otherwise?

Re:Too easy to circumvent

[Bakkster]

Machines with classified information are not connected to any network containing unclassified machines, and definitely not the internet.

About that...

In which case, using e-mail or other electronic means to leak classified information still wouldn't work. It would be caught by the CDS.

...the spy can be easily identified.

About that...

I don't see how that's relevent. We're talking about secure systems that require physical access and login credentials. Also, security cameras, possible card swipe access or keys, and other security measures. It's possible (in theory) to get in and steal something without leaving a trace, but it's highly unlikely.

USB drives are the most likely way to get info off a classified machine, which is precisely why they're forbidden.

About that...

Let me clarify, they're banned on classified machines.

Re:Too easy to circumvent

[hesaigo999ca]

>This is almost certainly aimed at preventing classified information leaks. Machines with classified >information are not connected to any network containing unclassified machines, and definitely not the >internet

These same machines, if they were to be actually really in need of security, would use the old standard
printer ports and keyboard and mouse ports, and completely remove the usb plugins.
If i want info and i cant stick my key into a hole, how will i get the data...no internet, no cd burning, and now no usb....seriously could have saved them a lot of money if they asked me first... XD

Re:Too easy to circumvent

[Anonymous Coward]

The KMS servers will need activation either online or by phone.

Re:Too easy to circumvent

[desertjedi85]

In the Navy and Army they are still banned on all systems, don't know about the other branches. The original cause for the ban was due to a virus but now they are keeping the ban indefinitely, for security and for future viruses.

Impervious

[blair1q]

...because the Windows Registry is a secure source of information...

Re:Impervious

[HarrySquatter]

Because it's not trivially easy to prevent people from modifying the registry? Oh wait it is.

Re:Impervious

[nurb432]

But if you monitor in real time, then by the time you can edit the registry you have already been busted.

Re:Impervious

[MobyDisk]

A non-administrative user could not delete those registry keys.

Re:Impervious

[dna_(c)(tm)(r)]

Nah, copy to local HD, unplug network cable, plug USB key, copy all you want, unplug USB key, plug in network cable. Tool circumvented.

lsusb

[Anonymous Coward]

Hi. I seem to have that installed on my computer already. I just typed lsusb (and then I pressed the return key) and up popped:
Bus 008 Device 003: ID 1307:0165 Transcend Information, Inc. 2GB/4GB Flash Drive
Bus 008 Device 002: ID 1307:0165 Transcend Information, Inc. 2GB/4GB Flash Drive ....Those CIA/NSA guys are trickey, aren't they?

Re:lsusb

[jdunn14]

So you're one of those "network is the computer" guys or you misread/didn't read either of the first two sentences of the summary... I'm gonna go with "didn't read" on this one.

Re:lsusb

[spazdor]

okay, fine. lsusb over ssh .

Re:lsusb

[Anonymous Coward]

Please point to the part of the argument that is supposed to make us think that you're not a moron.

Flaw?

[Superdarion]

Won't it work with Linux or OSX? Or does the NSA run completely on -gulp- windows?

Re:Flaw?

[Mojo66]

The title should read "NSA Develops USB Storage Device Detector for Windows"

Or even better:

"NSA Develops USB Storage Device Detector for declining Operating System"

Re:Flaw?

[HarrySquatter]

"NSA Develops USB Storage Device Detector for declining Operating System"

I thought the story was about Windows not Linux.

Re:Flaw?

[Anonymous Coward]

Why does it matter? Most of their computers aren't even connected to the internet.

Re:Flaw?

[Superdarion]

I thought the story was about Windows not Linux.

The problem is that now if you want to get into NSA's network (being an employee, I mean), you will HAVE to run Windows. Linux and OSX will be seen as security flaws because their program doesn't run in them. Now you have the NSA forcing all its employees that want access to the network to run Windows.

Re:Flaw?

[Anonymous Coward]

^This.

Re:Flaw?

[Anonymous Coward]

You'd think if the entire NSA ran on Windows that /.'ers could withhold their pride for once. But nope, they would only think themselves smarter than NSA employees.

Re:Flaw?

[Superdarion]

Fool! You thought you could insult /.'ers and not be modded down?

You can't fight the system, man.

Re:Flaw?

[HarrySquatter]

The problem is that now if you want to get into NSA's network (being an employee, I mean), you will HAVE to run Windows.

Says who?

Linux and OSX will be seen as security flaws because their program doesn't run in them.

By whom? And with what evidence do you say so?

Now you have the NSA forcing all its employees that want access to the network to run Windows.

Really? Care to cite the exact policy where they have done so? And by "the network" what network are you referring to? If you say the Internet then you are really highlighting that you know jack and shit what you are talking about.

Re:Flaw?

[grub]

I thought the story was about Windows not Linux.

Didn't you hear? This is the year of Linux on the desktop with thumb drives!

Re:Flaw?

[HarrySquatter]

My bad. The many announcements that 20xx is the Year of the Linux Desktop just sort of run together anymore.

Re:Flaw?

[WindowlessView]

does the NSA run completely on -gulp- windows?

You can rest assured that of all of the organizations on the planet this is one that will never be using Windows for its core mission. The tool is for the defense department dweebs, contractors, secretaries, suits, etc., where you expect to find Windows.

Re:Flaw?

[Anonymous Coward]

That's what you think. If you mod me down, I shall become more powerful than you could possibly imagine. -AC

Re:Flaw?

[tomhudson]

My bad. The many announcements that 20xx is the Year of the Linux Desktop just sort of run together anymore.

Ignore them, Unfortunately, it will never happen, for the simple reason that the average user is lazy, brain-dead, and thinks Windows is the computer.

And her boss is even worse.

It's not even a question of there being "too much choice". The vast majority don't care. They're used to crap. Take it away from them and they're lost. They'd rather click through 10 screens to hit-or-miss change some setting rather than type a command. That's "too complicated."

And don't believe that devs are any different. The majority of users on slashdot run windows.

People looking for an alternative already have one - another proprietary system, even MORE locked-in.

The only thing that will happen is that linux will continue to make inroads where the consumer doesn't see it as an operating system, or just doesn't see it - smart phones, servers, data appliances, controllers, etc. The desktop - the desktop is lost. People aren't goingto switch from the "free" copy of windows that came with their computer.

Re:Flaw?

[Anonymous Coward]

"NSA Develops USB Storage Device Detector for declining Operating System"

I thought the story was about Windows not Linux.

You apparently didn't get the memo that 2010 is the Year of Desktop Linux

Re:Flaw?

[Anonymous Coward]

People looking for an alternative already have one - another proprietary system, even MORE locked-in.

Presumably this is supposed to be a swipe at OS X. When will you slashtards realize that OS X is way less locked down than windows? Yes, iPhone and iPad are locked down -- but Macs running OS X are much more free than anything Microsoft offers. And no, it won't change anytime soon. I understand that some of you people find knee-jerk bashing to be "witty" and "satisfying", but believe me -- you just make yourselves look like the uninformed lusers you really are.

/rant

Re:Flaw?

[Anonymous Coward]

Unfortunately, it will never happen, for the simple reason that the average user is lazy, brain-dead, and thinks Windows is the computer.

Wow, I guess I'm a genius. I switched to Linux Mint Helena about three months ago, and I'm doing great.
It was a combination of Windows viruses and "upgrades" that pushed me too far.
I haven't lost anything since switching. Every program I was using in Windows can either run in Wine, or has a native port.

The only compromise I've had to make is with Netflix instant watch. I reboot to WinXP if I want to watch a movie.
It *is* possible to watch the movies with Linux, but my computer's processor is too wimpy to handle the fullscreen movie playback through a virtual machine (AMD Athlon 64 X2 Dual 3600+). When I eventually upgrade my computer's hardware, I wont need to dual boot anymore.

Re:Flaw?

[ArsonSmith]

It runs on BSD too?

Re:Flaw?

[Anonymous Coward]

Linux and OSX will be seen as security flaws because their program doesn't run in them.

By whom? And with what evidence do you say so?

why netcraft of course.

Re:Flaw?

[sensei moreh]

NSA was the primary developer of SELinux. Circumstantial evidence that NSA does, indeed run Linux.

Re:Flaw?

[tomhudson]

Wow, I guess I'm a genius. I switched to Linux Mint Helena about three months ago, and I'm doing great.

Don't worry, you're still a dummy, since you don't know that "the year of linux on the desktop" means more than just you.

Re:Flaw?

[tomhudson]

"I sense the force has a strong hold on this one, master!"

When will you slashtards realize that OS X is way less locked down than windows?

I see the Steve Jobs Reality Distortion Field claims another victim. Call me when I can buy a copy and install it on the hardware of my choice without Apple claiming I'm violating their license, even though I bought a full retail copy off the shelf.

Apple OSX is even more locked in than Microsoft Windows. Get over it, or I'll throw another chair at you!

Re:Flaw?

[AHuxley]

What can a captured defence department dweebs, contractors, secretaries, suits, troops tell the bad guys about MS?
I log in, move the cursor, type, reboot, log in, move the cursor, type and over charge the US tax payer another million, then make coffee?
I did have a dream home and a consulting job waiting for me back home ...
I move the cursor, log in, move the cursor, type, reboot .. select the non US icons on the small map and watch the horizon light up?
I did have a family waiting for me back home ...
MS as a sealed unit does have its uses to the US mil.
The NSA/US mil have read the "John McCain" era KGB files and understood the tech details lost by over educating people in direct contact with the bad guys.

Re:Flaw?

[Stray7Xi]

The problem is that now if you want to get into NSA's network (being an employee, I mean), you will HAVE to run Windows.

Says who?

Have you tried setting up SELinux? It being invented by the NSA is proof that NSA doesn't use linux. No sane person would want to use it.

Re:Flaw?

[nemesisrocks]

does the NSA run completely on -gulp- windows?

You can rest assured that of all of the organizations on the planet this is one that will never be using Windows for its core mission.

Except of course, for Windows for Warships...

Re:Flaw?

[HarrySquatter]

It was a combination of Windows viruses and "upgrades" that pushed me too far.

You claim to be a genius but yet couldn't keep your computer free of viruses? Contradict yourself much?

Re:Flaw?

[Anonymous Coward]

NSA does not operate warships, the Navy does.

Re:Flaw?

[Anonymous Coward]

That organization only uses non-windows for very few specialized machines. ALL workstations are windows xp. And if you are connecting through VPN to unclass you can only use a windows box. The unclass network used is actually run by the base and internet connectivity is provided by DISA's network.

Linux isn't used on the network much at all, just Solaris. OSX has no presence at all on the network.

I can't provide you any references for the network, but I can tell you that DISA's STIGs and SRRs are nice starting points for security. AFI 33-115 Vol 1 is also a good starting point on unclass network ops.

Re:Flaw?

[Anonymous Coward]

1: OS X is open? No it isn't. Just ask anyone who wants to virtualize it legally.
2: Feel free to ask the ashen hulk of Psystar how open OS X is.
3: Look at how much stuff is SUID root on OS X. It may be tested, but in reality, it takes years to decades before a program with root privs becomes decently secure in the real world. Look at sendmail.
4: seriald is closed source, but is required to run on OS XS, and checks for other machines on the network with the same key.
5: There is no open source whole disk encryption for OS X. FileVault doesn't count, because one can just boot the OS and stick a keylogger somewhere.
6: Just try moving large (1+ TB) drives back and forth between Macs and Windows without using FAT, and having both types of machines write to it.
7: Good luck finding a back copy of iWork 08 on Apple's site. Lose your downloaded copy, its time to hit the torrents and pray you might get a clean copy, or just buy the latest version.
8: All the account tie-in with me.com.
9: Lots of Apple only formats. Sparse bundles come to mind. Need to read your homedir on another platform because your mac won't boot? Luck++.
10: Good luck getting a roadmap from Apple. I can sign a NDA with IBM, Microsoft, Sun, or HP and get a whitepaper of where they plan to go with future technologies. Apple doesn't give this out, so I cannot reliably predict when to budget for a machine refresh. With other vendors, I know when they are getting new models in, so my business can have this year's stuff, as opposed to last year's.

Re:Flaw?

[infolation]

you will HAVE to run Windows. Linux and OSX will be seen as security flaws

Err, actually the NSA see Windows ('Mainstream Operating Systems') as a security flaw:

SELINUX

...the National Security Agency has long been involved with the computer security research community in investigating a wide range of computer security topics including operating system security...

Unfortunately, existing mainstream operating systems lack the critical security feature required for enforcing separation...

The results of several previous research projects in this area have yielded a strong, flexible mandatory access control architecture called Flask...

The architecture has been subsequently mainstreamed into Linux and ported to several other systems, including the Solaris operating system, the FreeBSD® operating system, and the Darwin kernel, spawning a wide range of related work.

Re:Flaw?

[WindowlessView]

Troll? Really moron?

This is not a slam against Windows, it is stating the obvious. It was a response to the question of whether the NSA runs completely on Windows and notes that Windows would be inappropriate for the NSA's core mission which, for brevity's sake, we can limit to signal processing and decryption.

How many Crays does Windows run on? How many custom DSP processors? How many routers? How many HPC clusters?

You fan boys need to get a fucking clue and stop being overly sensitive, insecure douche bags.

Re:Flaw?

[mr100percent]

OS X is not more locked in than Windows. Apple open-sourced their Kernel, and you can download DarwinOS for your PC for free. They open-sourced their web browser (WebKit) and use GPL tools at the command line

It doesn't detect network-connected USB

[Anonymous Coward]

it detects WINDOWS-connected USB storage. If I plug my USB storage key into my Cisco router or HP Procurve switch's USB plug, it won't detect it.
If I plug my USB key into my Linux box... it won't detect it. If I plug my USB key into my OS X box, it won't detect it.
what's the point?

Re:It doesn't detect network-connected USB

[Anonymous Coward]

since when have procurve switches had usb ports?

Re:It doesn't detect network-connected USB

[EnigmaticSource]

My jumpdrive happily fits into that internet hole on the HP swatch thing... never could get it to read though.
(No... I really don't miss late 90's tech support)

Re:It doesn't detect network-connected USB

[NotBornYesterday]

Well, I'm no expert, but at least since 2007 or so. Although if you were right, I'd have to admit that it's hard to detect a USB key without a USB port.

Re:It doesn't detect network-connected USB

[Anonymous Coward]

Well, no f'ing shit. As it's Windows only it kind of makes sense. But do you work for the NSA and have the ability to use a Linux or OSX client? Otherwise it's kind of pointless to comment like that. And "network-connected USB", as far as I know that isn't even a thing so I'm guessing that's Samba, HTTP, FTP or some other protocol, and I'd think anyone'd see the clear security flaw having one of those easily accessible...

Re:It doesn't detect network-connected USB

[AHuxley]

I'd think anyone'd see the clear security flaw having one of those easily accessible...
The US mil has had many people walk out with their data in hard copy and digital form.
Their "John May Lives" moments.
Some have been low level, some from good trusted families.

Useless Tool...

[Manip]

Since you can set the security policy on a domain to ban USB and External devices, and since you can also unplug a machine from the network this tool seems to serve little to no real world purpose. It might inform you after the fact if a device has been plugged in or heck even during, but by then you've just learned that you have configured your systems incorrectly and you will need to re-image your network either way.

Sorry if I'm being negative but Microsoft closed this "hole" a long time ago.

Re:Useless Tool...

[ironicsky]

Agreed. You can either change the value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor and/or deny anyone who is not an admin access to the following files in the NTFS %SystemRoot%\Inf\Usbstor.pnf and %SystemRoot%\Inf\Usbstor.inf and they wont be able to mount a US drive... Password protect the bios and disable the USB storage there too.

Of course this only works for Windows, linux users and Mac users can simply be denied access to the device chain in /dev/

Re:Useless Tool...

[Zironic]

Well, since they are in the espionage business, maybe they want to trap whomever does it by making it possible to mount the drive but triggering a silent alarm.

Re:Useless Tool...

[Luke has no name]

I think the point of this is to be used on computers where the users are not administrators, e.g. most corporate environments, in such case you couldn't edit the registry or install "USB Detection Blocker" software, etc.

I don't think there is anything wrong with this. Very useful for companies keeping data secure.

Re:Useless Tool...

[Anonymous Coward]

Since you can set the security policy on a domain to ban USB and External devices, and since you can also unplug a machine from the network this tool seems to serve little to no real world purpose. It might inform you after the fact if a device has been plugged in or heck even during, but by then you've just learned that you have configured your systems incorrectly and you will need to re-image your network either way.

Sorry if I'm being negative but Microsoft closed this "hole" a long time ago.

Nevermind that you can configure systems to ban USB devices. Nevermind that systems can be unplugged (and if you did this to a networked NSA system without prior approval I imagine you'd immediately raise all sorts of red flags.)

It is most likely intended to make sure no one plugs in a USB storage device after having been explicitly and repeatedly told that USB devices ARE! FUCKING! NOT! EVER! FUCKING! ALLOWED! ON! THE! FUCKING! NETWORK!

Re:Useless Tool...

[Anonymous Coward]

...then why would you need the tool, as your users can't activate or mount a usb drive in the first place?

Re:Useless Tool...

[Khue]

You can also do this through premade GPOs which already hit that same registry key plus others. If you google write_protect_removable_drives.adm or write_protect_removable_media.adm you may be able to find the same thing I have implemented across the board. The only difference is I did this back in 2002/2003 for PCI/DSS compliance.

Re:Useless Tool...

[captaindomon]

That's not the point. The reason for this software is to add one more layer of security to an already extremely secure network, and mostly to detect friendly accidental use by tech-clueless intelligence analysts (yes, most intelligence analysts are experts on geopolitics or military tactics and not Windows). This is not designed to prevent true espionage attacks by insiders who are technology experts, there are a lot of other layers of security for that.

Re:Useless Tool...

[Anonymous Coward]

I think this tool still has uses, though not what one would initially think. For example, you could detect when a device is plugged in, then throw a tiny little virus on there that can infect the next host the usb drive is plugged into, and now all of a sudden you have easy access to a formerly "Secure" network. This could be very useful in cyber-warfare and spy games in general. Run something like this in every foreign embassy, and then you can detect leaks etc.

Re:Useless Tool...

[fatalwall]

password protecting the bios does nothing unless you put a lock on the computer case. password resets are really easy to do on a bios

Re:Useless Tool...

[IndustrialComplex]

Well, since they are in the espionage business, maybe they want to trap whomever does it by making it possible to mount the drive but triggering a silent alarm.

Not quite, the NSA can really be seen as two groups. The Data Processing NSA and the Anti-Network-Intrusion/Espionage & Policy NSA. But you are correct that they probably want the ability to determine and track before simply blocking all access.

I'm quite sure on the computer I'm at right now I could go hog-wild and do all sorts of things. Things that would be logged and flag my account/use as one to watch.

Re:Useless Tool...

[smbarbour]

This is software being used by the NSA. It is much better in their opinion to detect espionage than prevent it.

If it is being done by a government employee, they can "execute" a "termination" of employment.

Re:Useless Tool...

[Anonymous Coward]

What if you want to allow it but log it? Notice it says detects not prevents.

What if you want even the people who are logged in as admin to be logged?

Re:Useless Tool...

[Bacon Bits]

I tested this extensively on WinXP SP2 for a hospital worried about HIPAA. These methods only work if the UsbStor key hasn't already been created. Once it's there you can keep plugging devices in and they will all install normally (new or old).

Under Vista and 7 there's supposed to be a new Group Policy that will prevent USB drives, but I'm not sure how it works.

Re:Useless Tool...

[Anonymous Coward]

We're talking about a workplace. Just put a sign up in the lobby saying "no screwdrivers past this point" and have the security guards check. Oh and no USB drives either.

Re:Useless Tool...

[Anonymous Coward]

Or you could just delete the driver. This is guaranteed to work on any version of Windows.

Re:Useless Tool...

[AHuxley]

The Russian handlers work long hours understanding and watching out for their US government employees.
When a government employee is found to have gone over "execute" is such a strong word, its mostly hanging, multiple gun shot suicide or out sourced artistic home invasion.

Re:Useless Tool...

[Anonymous Coward]

Or, you can just put glue in the port.

Re:Useless Tool...

[jrumney]

What if the users have a need to use authorized USB devices? It seems this is aimed at such cases, where approved devices can be filtered from the log.

Re:Useless Tool...

[digitalchinky]

Not quite accurate sir. Insiders, people who have been delta briefed and hold a security clearance (at least in the top secret areas) are assumed to be 'trustworthy' - this trust is implicit and never questioned - except by the buggers that want to do positive vetting every couple of years, bastards :-) For sure there are audit trails and such, but these aren't monitored in real time - not really monitored at all, just a paper trail if you will that can be referenced later. The 'lot of other layers of security' you mention are mostly wishful thinking on your part. The Air Gap, security guards, jail time, and various security branches take care of the whole unsanctioned espionage thing. Computer systems, these exist to be used, if I needed a memory stick to transport data around, I'd go to the safe and grab an empty one. Seriously, real life, real high tech, it's not Jame's Bond, glamor, hot women, and whatever, it's a bunch of geeks and scientists doing whatever they need to do, using available technology fully.

The NSA, just like most other similar 3 letter entities, also have customer facing departments that are generally where other government agencies (sometimes private industry) go to get all their security advice, policies, best practices, and sometimes software.

Re:Useless Tool...

[Xacid]

But this also bans devices such as backup drives that *are* legal for use in these facilities...

Why only USB?

[Anonymous Coward]

Is there some weakness associated with USB that I'm not aware of? Shouldn't this instead be for all removable storage devices? What about Firewire flash/HD drives & et cetera?

Re:Why only USB?

[fuzzyfuzzyfungus]

If anything, USB is less dangerous because it is less capable. Firewire can do DMA. Which, unless you are on modern, high-end hardware(where the I/OMMU will stop you) or on a 64 bit system(where the fact that Firewire DMA is only 32 bit will limit you some) a malicious firewire device can snarf or modify your memory space at its pleasure.

USB just makes it easy to copy files off the system(assuming your environment hasn't already disabled that). Most modern corporate-issue computers let you shut off USB ports at the BIOS level, if you want, and you can block the loading of Mass Storage drivers or the mounting of unauthorized filesystems in any modern OS.

Re:Why only USB?

[Anonymous Coward]

The weakness is the storage device itself since you can copy/steal/bring data onto host machines.
USB itself isn't the issue.

Re:Why only USB?

[PhxBlue]

Because DOD got pwned back in November 2008 when some schmuck used a thumbdrive to transfer files between the NIPR and SIPR networks, and they still haven't figured out how to fix the vulnerability.

Re:Why only USB?

[sheph]

Other than users that download malware from the Internet and drop it on your private/critical LAN? No, not really. I'm assuming that it would detect any external storage that is USB based. Firewire usually isn't there unless it's required, and if it's not desirable to have, it can easily be disabled in the device manager. With USB you might have a mouse and a keyboard that you'd like to use, but you want to make sure no one plugs in a storage device. This can be accomplished with a GPO though. The tool is really not necessary. Even if you wanted to trap people, tripwire is far more functional, and can provide the same detection. It's a useless tool really.

Re:Why only USB?

[Anonymous Coward]

Regarding firewire, I assume the designers didn't want to waste their time with a port used by a whopping 2 or 3 people on earth.

Re:Why only USB?

[Anonymous Coward]

something something something opsec

Re:Why only USB?

[PhxBlue]

Yeah? Where's the OPSEC problem here? I didn't disclose specific details about how the network was compromised. Moreover, the incident took place 30 months ago, and it was strictly against regulations even then to use thumbdrives on the SIPRNet.

I'm all for OPSEC, but it shouldn't be used as a cover for someone's moronic behavior.

Re:Why only USB?

[Anonymous Coward]

It's not that they're trying to keep people from transferring information,(still happens with portable hard drives) but to keep people from plugging in thumbdrives into SIPR machines and then losing them. They find them in bazaars all the time.

Hmmm....

[Anonymous Coward]

Hopefully the tool checks the vendor and product IDs of the device and doesn't just rely on what windows thinks the device is. It's not that hard to make windows think that a flash drive is something else, but it's harder to mess around with the vendor and product ID that are detected from the device.

Bit Late?

[mistralol]

Don't get me wrong but this allows you to detect after the device has been and gone. Is this not a little late in finding this out? So exactly what security hole has it plugged? Though i guess it could prove possible useful in a court where you can then link the usb hardware id and unique id to a pen drive with sensitive information to prove what / when / where it plugged into.

Meeeeliionnns

[codepunk]

5 or so meeeliionnns of well spent money....our brilliant govt at work.

Does it only detect USB MSDs?

[Dogbertius]

Does this software only detect USB mass storage device (MSD) modules? A simple workaround would be to implement a USB-connected character device. You could simply dump a binary file via "cat" or some similar tool to the device, presto - data acquired. I would know this because I've built similar ones in the past while playing around with PICs.

At some of the more "security oriented" offices I've visited, the easiest way to prevent data from leaving the office was:
-implementing proper network security (blocked sites, restricted sent-to abilities for e-mail)
-customizing the Linux kernel for slim-boxes so there was next to no driver support for anything not already connected to the box
-disabling MSDs in the kernel altogether

The only other way (ie: in the case of my little USB data logger) is to completely disable un-used USB ports, etc. If you have the computing resources for it, you could just have most slim boxes log in to VMs that are pretty much locked down and obliviously to external H/W anyways. This approach seems to be useful for detecting attempts to make unauthorized copies of data, etc, but it seems far from a fool-proof way to prevent it.

Re:Does it only detect USB MSDs?

[chill]

The tool detects all USB events, but the main focus is on mass storage devices.

You are over estimating the threat model they're targeting. This isn't about spies or coordinated data theft. It is designed to deal with the 99% part of the problem that is clueless users plugging in USB drives because it is faster and more convenient than the approved methods.

"Burning to a CD takes too long! I'm just gonna use this USB drive I found in the office..."

It might not happen in the NSA, but it is pervasive in the other civilian gov't agencies.

Re:Does it only detect USB MSDs?

[Dogbertius]

Ah, makes sense. Thanks!

filter driver???

[dltaylor]

The "geniuses" at the NSA couldn't even come up with a filter driver to detect the connection in real time (and block access)? I worked at a company years ago that had such a tool commercially available. Sweeping the registry is sort of "after the fact".

On Linux, you could control users' (not "root", but if they've got local "root" access ...) ability to mount USB/Firewire/... removable storage with a simple change to the udev rules.

Re:filter driver???

[Blakey Rat]

Maybe they think it's more valuable to identity what data was being smuggled (and by whom) than just blocking it outright. More to the point, since they've been using this for years, and since they created the specs for it, I'm sure it already does exactly what they want it to-- so why question it?

I don't see the point of this

[Anonymous Coward]

Who are these network admins that are worried about USB usage on only Winodws machines, but will not deny USB usage (which Microsoft actually makes fairly easy to do), but wants to stealthy detect USB usage?

Windows already does this

[nurb432]

And there are 100's of ways to monitor/report on windows activities as they happen.

High tech solution to a low tech problem

[Anonymous Coward]

a bit of epoxy in the usb ports of all the computers that are connected to the network would be 10x as secure. (And it would run on Linux!)

Is A BotNet

[Anonymous Coward]

considered to be a USB Storage Device?

Yours In Novosibirsk,
Kilgore Trout.

Necessary?

[Anonymous Coward]

Shouldn't OSs provide an option to disable auto-mounting of USB devices? It makes more sense than requiring admin access to "safely remove" usb storage devices.

Re:In other news...

[MobileTatsu-NJG]

I suppose it's a coincidence that you posted that around lunch-time.

This post...

[danwesnor]

... is bait meant to lure out Slashdotters who can't be bothered to RTFA. The article does not mention anything about how the device works. The mention of the registry comes from a footnote in a DHS report (you know, the guys who can't find bombs if they're in your underwear). It is not sourced, and most likely an assumption since the NSA isn't in the habit of telling anybody how their $#!+ works.

Re:This post...

[Minwee]

It is not sourced, and most likely an assumption since the NSA isn't in the habit of telling anybody how their $#!+ works.

Yup, that darn NSA never tells anybody about their stuff or lets them see how it works. Nosireebob.

Re:This post...

[Anonymous Coward]

But why would the DHS be in my underwear?

Re:This post...

[Anonymous Coward]

By making selinux available to the general public they also provide selinux to any deep-cover agents in the field while hey are pretending to be the general public.

Everyone is missing the point here...

[vrmlguy]

If you work for the government and you want to get a co-worker in trouble, go buy an iPod and plug it into his computer whenever he's away from his desk. The next time there's a security audit, he be taken to some windowless office, denying everything and not being believed.

Re:Everyone is missing the point here...

[Anonymous Coward]

Only if you don't register it as your own and it has your name when it appears in the logs, with a serial tracing it back to... you....

4/10 for an idea, but it's got a hole that a bus just drove through

Re:Everyone is missing the point here...

[Anonymous Coward]

I work for the government, and everyone here connects iPods to their computers (except the people who use other brands of mp3 player). The internet filter blocks some podcasts, but City Hall also provides free wifi which is unfiltered.

Oh, you meant some specific level of government?

Lame

[KriticKill]

Is that what the government is wasting our tax dollars on these days? Detecting thumbdrives on networks? Come on, it shouldn't take the NSA to come up with something like this. I'll bet money that somebody has already written a piece of software to do just this. Even if they haven't there are loads of ways within Windows to watch and report stuff like this. I guess if they could upgrade it to work remotely on computers outside a network it might be useful (and if and only if, it gives specific details on the media and extends to other types beyond USB), but I don't really see the point on a network.

Re:Lame

[Registered Coward v2]

Is that what the government is wasting our tax dollars on these days? Detecting thumbdrives on networks? Come on, it shouldn't take the NSA to come up with something like this. I'll bet money that somebody has already written a piece of software to do just this. Even if they haven't there are loads of ways within Windows to watch and report stuff like this. I guess if they could upgrade it to work remotely on computers outside a network it might be useful (and if and only if, it gives specific details on the media and extends to other types beyond USB), but I don't really see the point on a network.

A few points:

Given it was developed in house, the NSA probably has done all the testing and certification need to allow an install without having t jump through the purchasing / getting approval to use a COTS product. That alone is worth something, especially if you are installing it on classified networks (where it would be most useful).

TFA did not say what it does or how. Just that it's free to US government agencies.

As a tool, it allows you to determine who is doing what and watch for patterns that may indicate nefarious, vs simply stupid or lazy, motivations. Patterns can b as important as simply knowing someone used a USB device.

Don't underestimate the value of free - government agencies that might not buy such a tool now have a non-budget way to add the capability.

Zen Endpoint Security for the win?

[Kennon]

Congrats NSA! Novell has been performing this miraculous feat of software wizardry for a few years now... http://www.novell.com/products/zenworks/endpointsecuritymanagement/

Good plan

[rickb928]

Halfway to completing the suite, and offering a tool to detect and READ USB storage devices on networks.

NSA is nothing if not ambitious. Good job, guys!

Already is use...

[Anonymous Coward]

http://www.sophos.com/sophos/docs/eng/supps/devctrl_10_aeng.pdf

Works like a charm :)

Two-part Epoxy

[GumphMaster]

In a certain secure environment I worked in there was a complete ban on use of the USB ports. We could have paid a bazillion dollars to have machines delivered without USB ports, spent many hours investigating bullet-proof ways to stop the USB ports from functioning in the OS, or simply fill the connectors with two-part epoxy. In the end the KISS principle ruled - epoxy and simple software tweaks on the off chance someone managed to free a port. :)

If you have physical access to a machine...

[TheSpoom]

The security game has already been lost.

Re:If you have physical access to a machine...

[quiet_guy]

At the moment, this is being used as a defense-against-the-user, not against intruders. Problem came up when malware got loaded onto a clean network via a USB drive, unknown to the user. Many of the military networks are set up to protect against intrusion from the outside, with decent firewalls/etc between the internet and the 'inside' network. The USB used by a stupid user obviously jumps the firewall....now the worm/trojan/whatever is loose on the inside. Network policies already say "don't use the same drive at home and at work"...but if everyone followed the rules, we wouldn't have malware....can't easily kill the USB ports since most of the keyboards/mice/etc are USB-only. Essentially, all this thing does is provide a way to sweep the networks and check for compliance. File transfers between classified and unclassified systems are a completely different problem.

Re:If you have physical access to a machine...

[pclminion]

The intent here is to make it more difficult for insiders to surreptitiously export data without going through proper security controls. This kind of argument always puzzles me. It's like you're saying that because there is no perfect security, we should therefore do nothing.

In a locked-down environment, a user with physical access to a machine may still have difficulty exporting large gobs of data. Transfer over the network may be difficult, and certainly is monitored. Data can be printed out, but this requires a printer, and a way to smuggle paper out of the facility without suspicion. A cell phone with a camera could be used to photograph a computer screen, but this is very low-bandwidth, and certainly looks strange to anyone happening to observe. A USB stick is easily hidden, easily plugged and unplugged, and can have a very large capacity. It's an important vector of attack.

Even without malicious intent, a user might decide for some reason that transferring data via USB stick is more convenient than another method. They may have good intentions, but the data still leaks onto the USB stick and you lose control over it. Just because something could be defeated doesn't make it worthwhile. And software which monitors connected machines for insertion/removal of media is not exactly hard to design. It doesn't cost you a billion dollars.

Re:If you have physical access to a machine...

[ProppaT]

" It's like you're saying that because there is no perfect security, we should therefore do nothing."

This is the key. The biggest security risk is the lay person who uses the system on a daily basis, not the enemy. This is a key reason why credit checks are a regular part of gaining a security clearances. Most sensitive information leaks are from internal sources, not from enemy infiltration.

Re:If you have physical access to a machine...

[Joey Vegetables]

https://myhomeserver.example.org/stealSensitiveData.php?data=SENSITIVE_DATA_I_WANNA_STEAL

Re:In other news...

[PsyciatricHelp]

Um. esata? Firewire?

Yeah, I wrote one of those once.

[gestalt_n_pepper]

Management eventually figured out that if you couldn't trust the guys you hired, you were screwed from go. More effective to treat your employees fairly in the first place. We stopped installing the service on new machines.

Fun to write though.

Preventing USB use--

[sillivalley]

Some places fill the USB connectors with hot glue.

I prefer 3 inch drywall screws.

They're system agnostic...

a definite FAIL story in the pursuit of the...

[exabrial]

Using Windows machines to hold Top Secret documents.

Re:a definite FAIL story in the pursuit of the...

[RoboRay]

What do you suggest? CP/M?

-1 Troll

[c 0xFF]

Oh, please. Like nobody else has ever created duplicate software before.

Yes, there are probably other utilities that do this. Maybe the NSA was unaware of them. Maybe they were incompatible with their legacy tools or infrastrcture. Maybe they didn't do what the NSA needed.

And even then, sometimes it's worth a rewrite, just to make things better.

Re:-1 Troll

[AHuxley]

The problem is still MS and do you even need physical access to most shipping and legacy MS products to gather useful info from the US gov with an open market value?
Is this an internal NSA MS boondoggle?
Are low level US gov secrets leaking via MS networks and physical access?

Re:-1 Troll

[jon3k]

And sometimes (usually) the government is just incompetent and wastes our money. Occam's razor, dude.

No USB, no problem.

[iwaybandit]

Use the VGA output and an A to D converter. If the system is running at 1280x1024, 24-bit color and 72 Hz, you can capture a bit over 2 GiBits/sec. Sure, you lose some speed using bits for error detection/correction, but you can turn the screen resolution up a little and it doesn't matter if the monitor can sync it. The hard part is installing a client program on the system to turn data into pixels. I'd use a keyboard simulator to input the binary into debug.exe, if it's still included with Windows. If not, there's notepad.

eeeh... okay...

[KZigurs]

How is that different from group policy now?
(kick off usb storage drivers towards the stairwells, disable usb hubs)

Re:eeeh... okay...

[jd2112]

Version 3.0 = Version 1.0 was written in the Windows 2000 days before Group Policy could lock out USB storage. It's probably still being developed for the benefit of government agencies that are still on older Windows domains and/or clients.

I use my USB drive to fix security holes

[aztektum]

I formatted it with a bootable Ubuntu installation image!

+1 Insightful

[Itninja]

Indeed. It's even more irritating when you see it in action. I used to work a half-block away from the County seat building in a decent sized city on WA State. Every year we would see a lot of County employees milling around our building after they would normally have gone home. Once I asked one of them about it and he said they had to 'meet their annual overtime budget' or they would lose it the next year. So they just 'made' overtime once a year. Tax dollars at work.

Obligatory xkcd reference

[Requiem18th]

Obligatory xkcd reference
http://xkcd.com/463/

wrong category

[Anonymous Coward]

Why the heck is this filed under "hardware?"

Uh... Plenty of software to do this already...

[Anonymous Freak]

The company I work for makes to different pieces of security/monitoring software that can both detect this.

It's not exactly a new thing...

bunkware

[Anonymous Coward]

I'm going to guess this is a windows equivalent of ssh root@foo 'fdisk -l'

How to sneak data out of the NSA

[Anonymous Coward]

Method 1
0) Put on some gloves
1) Copy sensative info from network onto the C: (maybe need to take screenshots)
2) Shut down the computer, unplug the network cable
3) Open the computer case
4) Reset the BIOS password (move the jumper on the motherboard)
5) Boot up the computer
6) Go into the BIOS
7) Configure the PC to boot off external device
8) Connect the external device then boot off it
9) Copy all the stuff from the C: to your removable microSD card.
10) Hide the microSD card inside your hollowed out nickle, put it up your butt, conceal it in your hair, badge, keychain, etc.
11) Reboot PC, clear the BIOS logs (if applicable), and reconnect network cable.
12) Change boot sequence back to how it used to be. Leave work.
13) Find some random open wireless network.
14) Upload data to Wikileaks
15) If anyone ever asks you why the BIOS password was reset, just say "BIOS?" whats that.

Method 2:
0) Bring the data up on the screen
1) Exploit the "analog hole" by taking screenshots with your 2M pixel spy pen you bought off ebay for $5 + $25 shipping.
2) Copy screenshots onto your laptop
3) Modify screenshots to remove any identifying information.
4) Find some random wireless network.
5) Upload data to Wikileaks.

Re:How to sneak data out of the NSA

[Renraku]

You raise interesting points, because if you have physical access to a computer, that's half the battle. In theory, they COULD lock down a computer so it can't be opened or tampered with, but that would just make everything a pain in the ass for IT to work on. Though, I'm sure the unions at those particular government facilities would love that.

Re:How to sneak data out of the NSA

[pedestrian crossing]

Method 1 has all kinds of problems. You will be caught.

Method 2 looks more promising, but odds are you will be caught either in the act or after the fact.

Both methods assume you have both physical and system access, which are pretty big assumptions.

Re:Uh... Plenty of software to do this already...

[ProppaT]

The thing is, the software is useless to the NSA if they don't have full access to all of the source and no one else does. They have to make sure that there are no holes are security issues with the software and they have to make sure no one else has access to the software source to find potential security holes.

The fact that this software exists isn't any big news....big whoop, it's not really any amazing feat that hasn't been done already. The fact that the NSA has software for this that is approved is big news. Security officers will let out a collective sigh of relief now as they don't have to worry about idiots trying to charge their cell phones/mp3 players via the USB port.

lol

[Charliemopps]

I could secure their entire network from USB thumb drives in a couple of hours with a flat-head screwdriver. This reminds me of the old story about NASA and the million dollar investment into pens that could write in a weightless environment while the soviets just used pencils.

Re:lol

[Slashcrap]

This reminds me of the old story about NASA and the million dollar investment into pens that could write in a weightless environment while the soviets just used pencils.

Ha ha, yes. And what's even funnier is that Americans still swallow that story whole and never stop to think about what the effect of graphite dust would be in a space ship. I don't know, is it poor science education that leads to you not knowing how conductive graphite is, or is it just a complete lack of crititcal thinking ability?

So THAT'S what that means?

[assaultriflesforfree]

Interesting. For years my computers have been telling me whenever I plug in a USB device. This little balloon in the lower right corner of the screen always pops up saying something like "Device detected." I guess the NSA has taken over my computer!

Old News?

[RandomUsr]

Not quite, but I've been able to use the registry in XP well enough to control USB devices by vendor ID, device class, and permissions etc, among a few more not to mentions. All it would take is a well written root kit, by oh say, Sony? and bingo, no detection. Further, I've done the proof of concept in setting the device as keyboard led, or some type of robotic device. And I'm not even a Sys Admin! I just read a book.

software or hardware?

[jasomenaso]

The company I currently work for implements a software solution akin to the one mentioned in the article (for security purposes). Another company that I am aware of simply used crazy glue in all the usb ports and headers.

Re:software or hardware?

[Anonymous Coward]

Our banking institution uses something like the described product NOW... I can charge my IPod... but it won't appear on the system at all.

I'd classify this as a non-story...

New invention with

[Anthelme]

Version 3.0 in the name is probably not so new...

What happens when people have Cyberbrains?

[jameskojiro]

I guess they will have to have lobotomies each day before leaving work...

USB != 100% of Removable Media

[davecason]

The government forgot iSCSI, Firewire, and eSATA? Really? And, unless they have locked down new hardware discovery, you could add these in with a PC Card or Express Card slot on any laptop. iSCSI only requires a source system and rights to set up the drive. Even easier: map a network share on an unmanaged asset that you brought along to take advantage of DHCP.

And you don't need any magic or special software to trap a drive connection event, just use WMI. It works for any drive type: just listen for a drive connection event... like ten lines of code, max. You could set up an agent or script to watch for these on any Windows computer with almost zero effort... you could even do it remotely with the proper rights.

Plenty of vendors have software to help, too. Off the top of my head, McAfee, Symantec, and Cisco all have something. The catalog of features they offer attempt to manage the DLP idea a little more completely any one USB drive solution... although I admit none of the vendors have it absolutely right yet.

I will ask a question I always ask about something like this: What's the goal? If it is Data Loss Prevention (DLP) then I believe they have failed. If it is to prevent virus installations then could start with disabling autorun.inf and supplementing that effort with a little drive connection detection using WMI.

Re:USB != 100% of Removable Media

[BitZtream]

Since its written for machines that are likely in physically secure facilities which are stictly controlled, its more likely that they didn't inlcude firewire and esata because the machines simply don't have the hardware. You aren't likely to be making physical changes to the hardware without a whole heap of people watching you do it.

iSCSI is a network protocol used to emulate a hardware interface, probably easier to just use FTP, but its a safe bet the network is already controlled anyway.

Your post indicates you're looking at this from the perspective of a desktop support monkey, not as the admin of a secured machine in a secured facility.

RE: NSA Develops USB Storage Device Detector

[Anonymous Coward]

You people don't get it do you. This was designed so that it would trigger a "This system will self destruct in 5 seconds... 4... 3... 2... 1..." booom (insert Mission Impossible soundtrack here)

It's been on DoD networks for months.

[Anonymous Coward]

I'm a CSA in one of the AF units and I found this program in our software directory sometime last year. Around the time that the flash drive ban was initiated. It's funny that this is just making 'news' now.

Please point me to such!

[Anonymous Coward]

I am seriously interested to see an open source equivalent. Basic requirements:
* It has to be mass deployable as MSI package (SMS etc)
* It has to contact centralized registry to report unauthorized USB mass storage devices
* There must be some sort of reporting functions that NON-technical security managers can use
* There should also be integration modules for emitting alerts to other systems (ticketing systems etc) about the incidents
* It has to support Windows Vista / 7, both 32 and 64 -bit
* There has to be whitelist system for authorized devices, ie. those that are using full disk encryption using approved application and keys, or those used by authorized technical personnel
    -- The centrally managed full disc encryption suite and its compliance management itself are out of scope
* It probably has to be able to capture the activity performed with the unauthorized devices. User/time/filename/filesize at least are mandatory information.

If someone really did this like 5 years ago I am really stunned that the project isn't widely known. I searched sf.net and came out with nothing actually useful.

Re:Please point me to such!

[b4dc0d3r]

You took a very simple idea (detecting USB) which can easily be cross-compiled for 32 and 64 bit using Microsoft's toolchain, and made it into a gigantic pile of crap, then dared someone to show it to you.

Most of that stuff is already in place, if they wanted it. Most business already have the reporting and alert infrastructure, so you just hook in to that and it takes care of everything you listed except for the 32/64 bit and MSI/SMS installation.

So, now we have a simple tool which has to plug in to an existing reporting and alert system, which explains why they wrote their own. They probably don't want to contact a vendor and give them an API into this thing, nor do they want to expose the API of their reporting thing, so they just write a simple app and the integration points with their configuration management database. Probably faster to do it that way than use whatever was availble 5 years ago, and explains why they didn't use a COTS solution. Simple, yes?

Re:Please point me to such!

[b4dc0d3r]

And I forgot the most important part - half of your requirements aren't even required, since this queries remotely. It doesn't have to run on the client, doesn't have to be 32 and 64 bit, doesn't have to be deployable. It runs remotely and captures data through remote WMI queries. Most of the "Linux already has this" replies are client-side tools, not server-side like this one.

Re:Please point me to such!

[Anonymous Coward]

It's a bit hard to capture disk activity (files copied, created, etc) using WMI :)

I wouldn't touch your kind of solution with a long stick as an IT manager. Things have to work certain way or they do not belong into enterprise environments.

flash drives, jump drives, or thumb drives?

[Anonymous Coward]

From the summary:

flash drives, jump drives, or thumb drives

To quote the borg queen: You imply disparity where none exists.

Stealing Data isn't the only issue

[Adustust]

It's keeping some of the users who shouldn't be on a computer in the first place from mucking it up with stuff they copied from their home systems. The biggest problem of a large installation is the users who think it's a great idea to try to install hacked software they downloaded from TPB, or that it's OK to try to load NES roms that they found somewhere. These are the kind of people who don't even scan the stuff they download on their own systems, and then they install it on a government system without a second thought.

Really?

[new2_60605]

Is our government's most important and highly funded intelligence agency using Microsoft Operating systems and Windows Networking? Really? After DARPA came up with a secure networking system now recognized as THE INTERNET... and the obvious security benefits to ANY *NIX system over Wintendo... REALLY? Meanwhile the Chinese are working on their own *NIX system to remove the need of Wintendo and Microsoft Licensing Fees from their entire way of life we are letting a company run by Steve "BumbleFuck" Balmer to support the Operating System for the NSA's computers? Have none of them ever ran windows at home? Wow... All I gotta say is learn your Mandarin.