Slashdot Mirror
NSA Develops USB Storage Device Detector
Hugh Pickens writes "Bob Brewin writes on NextGov that the National Security Agency has developed a software tool that detects thumb drives or other flash media connected to a network. The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool, provides 'network administrators and system security officials with an automated capability to detect the introduction of USB storage devices into their networks. This tool closes potential security vulnerabilities; a definite success story in the pursuit of the [Defense Department] and NSA protect information technology system strategic goals.' The tool gathers data from the registry on Microsoft Windows machines (PDF) and reports whether storage devices, such as portable music or video players, external hard drives, flash drives, jump drives, or thumb drives have been connected to the USB port. 'I have a hunch that a bunch of other agencies use the detection software,' writes Brewin."
Wow. Clever. Nobody ever thought of that before.
"USB Detect detects the use of removable drives"
"Shadow Drive evades detection by the following products"
"Latest USB Detect detects Shadow Drive use!"
"New ShadowDrive 2.0!"
Shit, the parent company of both products could make a killing! Hey wait a minute, is this another lame
attempt to bring money in off the books for illegal ops?
-Steve
"I opened my eyes, and everything went dark again"
"The NSA says the tool, called the USBDetect 3.0 Computer Network Defense Tool"
So if this is 3.0 can I assume they have had the tool for some time. Why are bothering to tell anyone at this point?
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
It relies on information from the OS. The OS is too easy to circumuvent. For example, it doesn't report on whether or not the system has been booted from a USB device. Given that they are the NSA, maybe they have the luxury of making the assumption that USB boot is disabled and the BIOS is password protected?
...because the Windows Registry is a secure source of information...
Since you can set the security policy on a domain to ban USB and External devices, and since you can also unplug a machine from the network this tool seems to serve little to no real world purpose. It might inform you after the fact if a device has been plugged in or heck even during, but by then you've just learned that you have configured your systems incorrectly and you will need to re-image your network either way.
Sorry if I'm being negative but Microsoft closed this "hole" a long time ago.
5 or so meeeliionnns of well spent money....our brilliant govt at work.
Got Code?
... is bait meant to lure out Slashdotters who can't be bothered to RTFA. The article does not mention anything about how the device works. The mention of the registry comes from a footnote in a DHS report (you know, the guys who can't find bombs if they're in your underwear). It is not sourced, and most likely an assumption since the NSA isn't in the habit of telling anybody how their $#!+ works.
If anything, USB is less dangerous because it is less capable. Firewire can do DMA. Which, unless you are on modern, high-end hardware(where the I/OMMU will stop you) or on a 64 bit system(where the fact that Firewire DMA is only 32 bit will limit you some) a malicious firewire device can snarf or modify your memory space at its pleasure.
USB just makes it easy to copy files off the system(assuming your environment hasn't already disabled that). Most modern corporate-issue computers let you shut off USB ports at the BIOS level, if you want, and you can block the loading of Mass Storage drivers or the mounting of unauthorized filesystems in any modern OS.
If you work for the government and you want to get a co-worker in trouble, go buy an iPod and plug it into his computer whenever he's away from his desk. The next time there's a security audit, he be taken to some windowless office, denying everything and not being believed.
Nothing for 6-digit uids?
Because DOD got pwned back in November 2008 when some schmuck used a thumbdrive to transfer files between the NIPR and SIPR networks, and they still haven't figured out how to fix the vulnerability.
!#@%*)anks for hanging up the phone, dear.
Management eventually figured out that if you couldn't trust the guys you hired, you were screwed from go. More effective to treat your employees fairly in the first place. We stopped installing the service on new machines.
Fun to write though.
Please do not read this sig. Thank you.
Oh, please. Like nobody else has ever created duplicate software before.
Yes, there are probably other utilities that do this. Maybe the NSA was unaware of them. Maybe they were incompatible with their legacy tools or infrastrcture. Maybe they didn't do what the NSA needed.
And even then, sometimes it's worth a rewrite, just to make things better.
Indeed. It's even more irritating when you see it in action. I used to work a half-block away from the County seat building in a decent sized city on WA State. Every year we would see a lot of County employees milling around our building after they would normally have gone home. Once I asked one of them about it and he said they had to 'meet their annual overtime budget' or they would lose it the next year. So they just 'made' overtime once a year. Tax dollars at work.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
The intent here is to make it more difficult for insiders to surreptitiously export data without going through proper security controls. This kind of argument always puzzles me. It's like you're saying that because there is no perfect security, we should therefore do nothing.
In a locked-down environment, a user with physical access to a machine may still have difficulty exporting large gobs of data. Transfer over the network may be difficult, and certainly is monitored. Data can be printed out, but this requires a printer, and a way to smuggle paper out of the facility without suspicion. A cell phone with a camera could be used to photograph a computer screen, but this is very low-bandwidth, and certainly looks strange to anyone happening to observe. A USB stick is easily hidden, easily plugged and unplugged, and can have a very large capacity. It's an important vector of attack.
Even without malicious intent, a user might decide for some reason that transferring data via USB stick is more convenient than another method. They may have good intentions, but the data still leaks onto the USB stick and you lose control over it. Just because something could be defeated doesn't make it worthwhile. And software which monitors connected machines for insertion/removal of media is not exactly hard to design. It doesn't cost you a billion dollars.
Yeah? Where's the OPSEC problem here? I didn't disclose specific details about how the network was compromised. Moreover, the incident took place 30 months ago, and it was strictly against regulations even then to use thumbdrives on the SIPRNet.
I'm all for OPSEC, but it shouldn't be used as a cover for someone's moronic behavior.
!#@%*)anks for hanging up the phone, dear.
"I sense the force has a strong hold on this one, master!"
I see the Steve Jobs Reality Distortion Field claims another victim. Call me when I can buy a copy and install it on the hardware of my choice without Apple claiming I'm violating their license, even though I bought a full retail copy off the shelf.
Apple OSX is even more locked in than Microsoft Windows. Get over it, or I'll throw another chair at you!
The government forgot iSCSI, Firewire, and eSATA? Really? And, unless they have locked down new hardware discovery, you could add these in with a PC Card or Express Card slot on any laptop. iSCSI only requires a source system and rights to set up the drive. Even easier: map a network share on an unmanaged asset that you brought along to take advantage of DHCP.
And you don't need any magic or special software to trap a drive connection event, just use WMI. It works for any drive type: just listen for a drive connection event... like ten lines of code, max. You could set up an agent or script to watch for these on any Windows computer with almost zero effort... you could even do it remotely with the proper rights.
Plenty of vendors have software to help, too. Off the top of my head, McAfee, Symantec, and Cisco all have something. The catalog of features they offer attempt to manage the DLP idea a little more completely any one USB drive solution... although I admit none of the vendors have it absolutely right yet.
I will ask a question I always ask about something like this: What's the goal? If it is Data Loss Prevention (DLP) then I believe they have failed. If it is to prevent virus installations then could start with disabling autorun.inf and supplementing that effort with a little drive connection detection using WMI.