Two-Thirds of Lost USB Drives Carry Malware

What do you expect .. by roguegramma · 2011-12-07 09:55 · Score: 5, Funny

.. they were lost by the 10% of commuters stupid enough to lose an USB stick.

--
Hey don't blame me, IANAB

Re:What do you expect .. by DemonGenius · 2011-12-07 10:02 · Score: 1, Offtopic

And I just used up all my mod points too...
Re:What do you expect .. by Marxist+Hacker+42 · 2011-12-07 10:18 · Score: 5, Interesting

I was thinking of a different self-selecting sample- the script kiddies willing to spread malware-infected USB sticks around in public to see which computers phone home.

--
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
Re:What do you expect .. by BitterOak · 2011-12-07 10:18 · Score: 3, Insightful

.. they were lost by the 10% of commuters stupid enough to lose an USB stick.
Why is this modded troll? Is it unreasonable to assume there might be some correlation between those people who are less careful with possessions and those who are less careful about encryption/malware, etc.? I'm not suggesting that it is impossible for a very careful person to drop something or have it fall through an unknown hole in the pocket, but at the same time, I don't think it is unreasonable to suspect that a population of those who left their USB sticks on the subway aren't necessarily perfectly representative of the population of USB stick users as a whole.

--
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Re:What do you expect .. by geekoid · 2011-12-07 10:41 · Score: 2

Because he implies when someone loses something it's because they are stupid; which is false.
Which implies all people not losing stuff are smart.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:What do you expect .. by MurukeshM · 2011-12-07 10:48 · Score: 4, Informative

They considered that angle. But then

Ducklin said that the likelihood of the USB sticks being left on trains on purpose by hackers or penetration testers so they are picked up by corporate users and plugged into their work computers, is very low.
"We didn't find any evidence to support the theory that the USB sticks had been deliberately planted," said Graham Cluley, a senior technology consultant at the company.
"The malware involved was mostly very prevalent, general-purpose, zombie stuff," Ducklin explained. The security expert believes that this method of malware distribution is not even viable because most lost USB sticks are being handed into lost property rather than being plugged into computers by users.
[TFA]
Re:What do you expect .. by Anonymous Coward · 2011-12-07 10:49 · Score: 1

Because he implies when someone loses something it's because they are stupid; which is false.
Which implies all people not losing stuff are smart.
Your logic is flawed.
Re:What do you expect .. by aix+tom · 2011-12-07 10:50 · Score: 3, Insightful

People who lose stuff are not necessarily more "stupid", but they are definitely more "careless"
And yes, people who care enough to double-check all their possessions lose less than people who don't.
And the people who double-check their possessions are probably also the ones who double-check their virus scanner and/or their encryption.
It has little to do with "stupid". In fact, one of the stereotypes of a careless person is the highly intelligent "absent minded professor"
Re:What do you expect .. by nine-times · 2011-12-07 11:00 · Score: 4, Insightful

It seems likely that people who are careless also lose things more often.
Re:What do you expect .. by BasilBrush · 2011-12-07 11:02 · Score: 3, Interesting

Is it unreasonable to assume there might be some correlation between those people who are less careful with possessions and those who are less careful about encryption/malware, etc.?
It's not an unreasonable hypothesis to raise. It is unreasonable to assume it's true.
Re:What do you expect .. by BasilBrush · 2011-12-07 11:09 · Score: 1

And yes, people who care enough to double-check all their possessions lose less than people who don't.
How exactly does one double-check, and in what way is it superior to single-checking?
What about those with zipped pockets or bags versus open pockets or bags. Do you think that might be a factor? And how exactly do you imagine that relates to "carelessness".
Do you imagine the use of zips correlates with computer literacy?
Re:What do you expect .. by jabberw0k · 2011-12-07 11:17 · Score: 5, Insightful

most lost USB sticks are being handed into lost property rather than being plugged into computers by users.
100% of items handed in, have been handed in -- what a surprise! How do they track lost items that were not handed in? This is as accurate as Gracie Allen's telephone poll -- 100% of people she phoned, had a phone.
Re:What do you expect .. by icebike · 2011-12-07 11:54 · Score: 0

What evidence did he expect to find? How hard did he look?
He just announced that the probability was low, without a shred of justification other than he didn't find any evidence.
Was he looking for manifestos or something?
Further, this clown does not believe that this method of malware distributions is even viable. REALLY?
Hello, Mahmoud Ahmadinejad, is that you?

--
Sig Battery depleted. Reverting to safe mode.
Re:What do you expect .. by Anonymous Coward · 2011-12-07 12:26 · Score: 0

When you leave home and check that you have your wallet, phone and keys, that's single checking.
When you get off the train (or whatever) and check that everything is still in your pockets, that's double checking.
What about those who don't use the zippers?
Re:What do you expect .. by chaboud · 2011-12-07 12:32 · Score: 1

You know that someone is at their first computer conference when they un-velcro their bag in the middle of a panel. Zips, magnetic clasps, or straps, people. That, or they're just an ass.
Double checking is pretty straightforward for the neurotic among us. First, you check for something. Then, you check again. I inventory my laptop bag before a trip, then I take it downstairs, put it by the door, and do a second, less complete, inventory before I walk out. Keys, thumb-drives, headphones, ear-plugs, glasses, iLoks, pens, business cards, passport.
I'll know if the laptop has been left out when I lift the bag.
Re:What do you expect .. by chaboud · 2011-12-07 12:34 · Score: 1

I think it's reasonable to assume it's likely, which, statistically, has more in common with true than false.
Once we've wandered into statistics on small non-random samples, I think we can say these things comfortably...
Re:What do you expect .. by hairyfeet · 2011-12-07 14:13 · Score: 2

Call me paranoid but maybe some of the infected ones were lost on purpose? There are plenty of places to buy REALLY cheap USB sticks, especially if you get the smaller ones. IIRC there is a place selling the 256Mb sticks for something like 40c in bulk. If I wanted to spread malware to as many people as possible it sounds like an awful cheap way to do it, just leave sticks around the places where those that work at the place i ant to hack frequent, like say the subway they use at the time of the day they use it? Who cares if a couple get picked up by nobodies or end up in lost and found, they're cheap!
But the fact that they find so many whether lost intentionally or not really doesn't surprise me, hell I've lost some of my smaller sticks here and there. but of course i don't keep in data i give a crap about on them either, just drivers and flash tools for cleaning boxes. if someone was to find that 1gb stick i lost somewhere all they'll get is a bunch of freeware cleaners and the latest realtek drivers that were out at the time. Maybe the reason they weren't encrypted is like me many simply didn't have anything worth giving a shit about?

--
ACs don't waste your time replying, your posts are never seen by me.
Re:What do you expect .. by Just+Brew+It! · 2011-12-07 14:47 · Score: 2

But it is not unreasonable to expect that people who are less careful with physical possessions may also be less careful in other ways as well. So it would not surprise me if there is a correlation between "tends to lose USB sticks in public places" and "tends to get infected with malware".
Re:What do you expect .. by Dahamma · 2011-12-07 15:36 · Score: 1

Which implies all people not losing stuff are smart.
No it doesn't. If you lost a USB stick you are stupid, does not mean if you didn't lose a USB stick you are not stupid. It means if you are not stupid, you haven't lost a USB stick. Contrapositive, not inverse.
But I do agree carelessness != stupidity :) Though I would also argue carelessness it much more common in malware infections, so the correlation could still be there...
Re:What do you expect .. by cpt+kangarooski · 2011-12-07 15:39 · Score: 0, Offtopic

IIRC there is a place selling the 256Mb sticks for something like 40c in bulk.
Goddammit. I remember when I used to buy 230 MB Bernoulli disks for like $100 a pop (not to mention the $500 drive to put them in), and how it was a pretty large amount of storage at the time. While I'm not upset that things are faster, better, and cheaper, must I feel old?

--
-- This and all my posts are in the public domain. I am a lawyer. I am not your lawyer, and this is not legal advice.
Re:What do you expect .. by spazzmo · 2011-12-07 16:11 · Score: 1

Ha ha. I don't think you are replying to what you think you are replying to. No-one mentioned being able to tell if a virus was calling home. They were talking about USB sticks being lost as opposed to planted.

--
The cheese stands alone...
Re:What do you expect .. by spazzmo · 2011-12-07 16:12 · Score: 1

Oh and well done on the gratuitous verbal abuse to the people you weren't replying to...

--
The cheese stands alone...
Re:What do you expect .. by DeathSquid · 2011-12-07 16:32 · Score: 1

Because he implies when someone loses something it's because they are stupid; which is false.
Which implies all people not losing stuff are smart.
I sure as hell feel stupid when I lose stuff.
That in no way implies that I feel smart when I don't lose stuff.
Re:What do you expect .. by mjwx · 2011-12-07 17:15 · Score: 2

They considered that angle. But then

Ducklin said that the likelihood of the USB sticks being left on trains on purpose by hackers or penetration testers so they are picked up by corporate users and plugged into their work computers, is very low.
"We didn't find any evidence to support the theory that the USB sticks had been deliberately planted," said Graham Cluley, a senior technology consultant at the company.
[TFA]
Trains are not logically a good place to leave sticks lying around for an attack. People treat things found on trains as suspicious, worse yet will hand them over to security. In order to attack via this angle you need to get people where they feel safer, such as in a workplace where they'll see a USB stick in the work dunny and thing "Free USB stick".

Also, never ascribe to malice what can easily be explained by stupidity. Steve the Salesman with his Blackpad and iBerry is paying zero attention to what he is doing could easily lose a USB stick out of his pocket, Given it will cost his companies IT dept $10 to replace, he just doesn't care.

--
Calling someone a "hater" only means you can not rationally rebut their argument.
Re:What do you expect .. by Jafafa+Hots · 2011-12-07 18:55 · Score: 2

When you get off the train and check your pockets, that's double checking.
When your double checking reveals that the USB stick is not in your pocket but is instead still on the train that's just just closed its doors to pull away, that means by the GPs logic that you, having just lost the stick, are careless.
Therefore we must conclude apparently that double-checking is a sign of carelessness.

--
This space available.
Re:What do you expect .. by Neil+Boekend · 2011-12-07 19:42 · Score: 1

Dunno about him, but I do. If I am speaking English (I am dutch) I refer to an USB thumbdrive as "An USB stick".
I am curious to know: what is wrong about that?
"An" --> The rule of thumb for a/an I learned years ago was "a" if the next word starts with a consonant (B, C, D, F, G, H, ...) and "an" if the word starts with a vowel. The "U" in USB is a vowel. If that is incorrect I'd like to know.
USB --> USB could be said in full, but I'd guess that isn't what you meant for that sounds silly.
"Stick" --> I knew "stick" to be a oft-used word for these things. It's as good as any. I have seen it quite often and, due to the fluidic nature of language, that means it's accepted (for it's not a misspelling or a fault in grammar).
Please don't think I am trolling, I am curious to know: there is no sarcasm in this.

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.
Re:What do you expect .. by aix+tom · 2011-12-07 20:16 · Score: 1

How exactly does one double-check, and in what way is it superior to single-checking?
Single-checking would be to check "do I have everything" before you leave home in the morning.
Double (or multiple-) checking would be to check when you leave home, before you get on the bus, before you get off the bus, before you leave the office, etc...
I'm that kind of paranoid after I lost the master key to a company I worked for for only a month ages ago. ;-)
(Then of course I'm so "AH, I'm home" - relieved when I get home that I pretty much proceed to stuff the clothing with the USB drives right into the washing machine, but hey, at least no black hat gets at my data)
Re:What do you expect .. by tbird81 · 2011-12-07 20:19 · Score: 2

The incorrect part is saying "An".
You should use "an" as the article if the next word begins with a vowel sound. So we say "a European" (pronounced you-row-pean), "a universal serial bus", "a U-boat", "a yellow banana". We say "an apple", "an honourable discharge", and "an yttrium semiconductor" (pronounced ittrium),
So the rule is based on the sound and how things flow, not the actual letter of the alphabet used.
Re:What do you expect .. by altstadt · 2011-12-07 21:10 · Score: 2

The a/an rule of thumb is to use "a" if the next word sounds like it starts with a consonant, and "an" if it sounds like it starts with a vowel.
To English ears, a German speaker says "ooh ess bay", while an English speaker says "you ess bee". The y sound in this case is a consonant, so a native English speaker will say "a you ess bee stick".
All bets are off when the word following a/an starts with an h, since the letter can be silent or verbalized depending on the word and where you grew up.
Re:What do you expect .. by vrt3 · 2011-12-07 22:34 · Score: 1

I speak Dutch too (I'm Flemish). I'm often inclined to write "an USB stick" like you do, because I often think of the Dutch pronunciation of USB which indeed starts with a vowel.
But what matters when writing English is, of course, the English pronunciation, not the Dutch one. In English it is pronounced like joe es bie, so the first sound is not a vowel, so it should be "a USB stick".

--
This sig under construction. Please check back later.
Re:What do you expect .. by hairyfeet · 2011-12-07 23:21 · Score: 1

Don't feel bad friend, somewhere in one of my boxes in storage is a 64Mb CF card with card reader that I used as a thumbstick and paid close to $100 too. I thought when I got it "Wow these are DOZENS of floppies worth of data, how will i ever use it all up?" and now I carry around a 16Gb I paid $14 for on sale and have 4gb which is bigger than the first 5 HDDs i had on my keyring that was given to me free by a guy that basically uses the things like calling cards!
So don't feel bad friend, we're just antiques from when 8 tracks were playable in any car and dinosaurs roamed the earth. you want to feel old my oldest boy is in his second year of college and he has NEVER had an 8-track, cassette, or LP, ever! And he talks about how old he must be getting since his first PC ran windows 98 and had a Voodoo card!

--
ACs don't waste your time replying, your posts are never seen by me.
Re:What do you expect .. by RockDoctor · 2011-12-07 23:28 · Score: 2

100% of items handed in, have been handed in -- what a surprise! How do they track lost items that were not handed in?
It shouldn't be that difficult. The statistics would be a but wobbly, giving fairly wide error bars, but the data should be available.
(Caveat : this applies to Scotland ; it may not apply to the rest of Britain, let alone Australia ; the German system doesn't seem terribly different). I've lost mobile phones in the past - in the back of taxis normally - and on one occasion out of IIRC three, it's been in the police's lost property office (most taxi companies are pretty good about this ; it's ultimately not in their interest to not do so). Each time I go into the lost property office, they take a note of my name, a description of the item lost, and the approximate location (because a lot of taxi companies only make one run to the lost property office a week ; perfectly reasonable, no charges of "theft by finding" if there's an established record from the company and some sort of record-keeping).
So, those records of lost property enquiries constitute a sample of the actual amount of lost property.
The records of lost property actually handed in constitutes a different sample of the actual amount of lost property.
The "hit rate" of matching lost property to enquiries should be enough to tie the two data sets together. I think the situation is comparable to a capture-tag-release-recapture-count tags experiment for estimating populations of wild animals, which is a standard operation. Hyper-geometric distribution, IIRC.
Oops, phone calls ... got to go and be transport for people.

--
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Re:What do you expect .. by Anonymous Coward · 2011-12-08 03:00 · Score: 0

Well you sure don't count as smart.

When someone get his head chopped off, he's dead. That does not imply all those who don't get their heads chopped off are alive.
Re:What do you expect .. by Anonymous Coward · 2011-12-08 05:06 · Score: 0

It was a troll post, dude, and you fell for it. Just leave it be.
Re:What do you expect .. by Anonymous Coward · 2011-12-08 05:53 · Score: 0

The fact that you have gone to enough "computer conferences" to have made this observation about a certain class of attendee makes me really, really sad inside.
Re:What do you expect .. by Neil+Boekend · 2011-12-12 21:53 · Score: 1

Thank you all for helping me out. I must have misremembered the rule.

--
Well, I might have a way, but it only works on a semi spherical planet in a vacuum.

Mac by cyachallenge · 2011-12-07 09:56 · Score: 5, Insightful

FTA

One interesting aspect of the results was that based on their data and formatting seven of the infected storage devices belonged to Mac OS X users or had been extensively used under this OS.

Re:Mac by Anonymous Coward · 2011-12-07 10:24 · Score: 2, Interesting

... which unfortunately doesn't really tell us anything, since they don't mention how many of the uninfected storage devices were like that.
Re:Mac by Rockoon · 2011-12-07 10:37 · Score: 3, Funny

... which unfortunately doesn't really tell us anything, since they don't mention how many of the uninfected storage devices were like that.
Yes they did, and then the guy you replied to did also.

It was seven. Were you looking for digits? 7.

--
"His name was James Damore."
Re:Mac by geekoid · 2011-12-07 10:42 · Score: 1

0111

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:Mac by ciotog · 2011-12-07 10:45 · Score: 0

"uninfected" != "infected". You sure mouth off a lot for a dumbass...
Re:Mac by John+Bresnahan · 2011-12-07 10:47 · Score: 4, Funny

FTA

One interesting aspect of the results was that based on their data and formatting seven of the infected storage devices belonged to Mac OS X users or had been extensively used under this OS.
Which means that those USB drives had been plugged in to a Windows machine at least once.
Re:Mac by Anonymous Coward · 2011-12-07 10:49 · Score: 0

Yes, 7 of the 33 infected were used with Macs.
What AC is asking is how many of the 17 ***uninfected*** drives were also used with Macs.
Re:Mac by MurukeshM · 2011-12-07 10:50 · Score: 1

... which unfortunately doesn't really tell us anything, since they don't mention how many of the uninfected storage devices were like that.
Yes they did, and then the guy you replied to did also.
Uninfected devices.
Re:Mac by msauve · 2011-12-07 10:51 · Score: 1

Yes they did
No, they didn't. There were 7 infected ones. The GP said "uninfected," and he's correct (unusual for a AC, I know) - without knowing how many uninfected ones qualify as "used under MacOS," the figure has no significance.

--
"National Security is the chief cause of national insecurity." - Celine's First Law
Re:Mac by BasilBrush · 2011-12-07 11:15 · Score: 3, Funny

We have a winner!
Re:Mac by Alomex · 2011-12-07 12:04 · Score: 2

A few years back Mac USB keys were much more likely to be carriers of Windows viruses since Macs did not scan for those.
Re:Mac by antifoidulus · 2011-12-07 14:01 · Score: 1

Well, they don't really say what they meant by "formatting", if the sticks were formatted as HFS+ then I doubt they had been plugged into Windows computers, or at the very least got the malware from the Windows machine as right now there is no tool that can write directly to an HFS+ disk..... It's possible that they picked them up through using shared folders with a Windows VM and had their USB shared, but that seems pretty unlikely

However, more than likely what they meant by that statement is that they found .DS_Store directories on the disk which indicates that they have been plugged into a Mac(those directories are how finder remembers how you had your icons organized etc.)

--
Monstar L
Re:Mac by microcars · 2011-12-08 03:02 · Score: 1

agreed, every USB stick I have used has been formatted FAT32 so it could be used on either Mac or Windows. Students I know tend to carry around their data on these things so they can use whatever computer is available wherever they are. I've found about six USB drives in various places off campus and they have all been filled with student homework.

--
I like microcars
Re:Mac by Anonymous Coward · 2011-12-08 05:00 · Score: 0

FTA

One interesting aspect of the results was that based on their data and formatting seven of the infected storage devices belonged to Mac OS X users or had been extensively used under this OS.
Doesn't surprise me at all. I have no default procedure for checking for Windows malware on my Mac. If someone hands me an infected USB flash stick for some reason, I'm going to plug it in, do what I need to do, and hand it back in the same infected state it was given to me.
I could configure a malware scanner if I had to, but I see no reason to use my system resources to provide a free USB stick sanitizing service.

Truecrypt? by shellster_dude · 2011-12-07 09:56 · Score: 2, Insightful

How would they know if it had been encrypted by something like Truecrypt which is designed to be invisible to prying eyes?

Re:Truecrypt? by mr1911 · 2011-12-07 10:01 · Score: 4, Insightful

TrueCrypt does not make invisible containers. It makes encrypted containers.

There is an exception for the container hidden in an container, but that only offers plausible deniability as the existence of the larger container is obvious.

--
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
Re:Truecrypt? by shellster_dude · 2011-12-07 10:20 · Score: 3, Insightful

Still, how would they know if some sort of stenography was being implemented, or if I had a Truecrypt volume called "ProgramA.bin"?
Re:Truecrypt? by tverbeek · 2011-12-07 10:23 · Score: 1

Because the kind of people who are that careful with their data don't lose the USB sticks on the train and then fail to come looking for them.

--
http://alternatives.rzero.com/
Re:Truecrypt? by black3d · 2011-12-07 10:24 · Score: 5, Informative

Truecrypt isn't designed to be invisible at all. Aside from entirely encrypted drives, it's fairly obvious if someone HAS encrypted data. Truecrypt is about hiding that data via hidden paritions within outer encrypted containers, and plausible deniability.
Truecrypt volumes are generally detectable:
http://www.jadsoftware.com/?page_id=89
https://code.google.com/p/tcdiscover/
And if the researchers discovered drives that are filled entirely with random data, then they know they're either securely formatted or encrypted, and would likely consider them the latter - if they're securely formatted the file system appears intact. If the entire drive is encrypted (or securely erased from the MBR up) then the FS is not intact, and it's a fair bet that the researchers are claiming they found all sticks with intact file systems, formatted to the same volume as the stick, with single partitions.
As are those hidden within files:
http://16s.us/TCHunt/index.php
But - the reason for the ramble: Never make the mistake of thinking Truecrypt is invisible. It's not. What's "invisible" should be your second hidden volume within the Truecrypt container - if you've set it up correctly. And there have previously even been attacks on that, in the event attackers are able to gain access to the external container. Work on your plausible deniability. Don't rely on TC to do the work for you or you'll end up with leaks everywhere.
http://www.schneier.com/paper-truecrypt-dfs.pdf

--
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Re:Truecrypt? by DigiShaman · 2011-12-07 10:25 · Score: 1

I've only used TrueCrypt in two instances. First being a file container in which I could mount and store stuff. The other in which I provisioned a USB drive to store data. With regarding the last option, I was aways nagged about the flash drive not being formatted and proceeds to ask me if I wish to do so. So my wife finds the sucker and formats thinking it was up for grabs. Though I am curious. Does TruCrypt anticipate the drive being encrypted by reading a certain set of LBA blocks? Is it something in the MBR? Just how obvious is the hidden container when viewing the drive raw with a hex editor?

--
Life is not for the lazy.
Re:Truecrypt? by amRadioHed · 2011-12-07 10:26 · Score: 1

An encrypted volume would not look the same as a binary file. Binary's are far from random.

--
We hope your rules and wisdom choke you / Now we are one in everlasting peace
Re:Truecrypt? by Anonymous Coward · 2011-12-07 10:30 · Score: 0

Still, how would they know if some sort of stenography was being implemented, or if I had a Truecrypt volume called "ProgramA.bin"?
Steganography?
Re:Truecrypt? by black3d · 2011-12-07 10:32 · Score: 1

As I posted elsewhere, but in case you don't see it - for finding truecrypt volumes hidden in files: http://16s.us/TCHunt/index.php

--
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Re:Truecrypt? by Anachragnome · 2011-12-07 10:42 · Score: 1

"TrueCrypt does not make invisible containers. It makes encrypted containers..."
Another question.
I am assuming that encrypting a container--in this case a USB stick--would also disable any malware already written to the drive as that code would be unrecognizable as code by the computer it was plugged in to...until it was decrypted. On the other side of the coin, if that same encrypted stick was plugged into an infected system, I assume the malware could be written (un-encrypted) to the drive intact and function when that stick was later plugged into another system. In essence, the malware can be installed on the stick while the drive is mounted via Truecrypt, as well as when it is plugged in but not mounted via Truecrypt. This would leave the user vulnerable twice.
Is this correct? Am I missing something, or is the encryption and malware two separate issues, because I don't see how encryption helps protect against malware once the drive or folder is decrypted.
Re:Truecrypt? by geekoid · 2011-12-07 10:43 · Score: 2

Based on... what? Routine makes fools of us all from time to time.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Re:Truecrypt? by Ichijo · 2011-12-07 10:46 · Score: 1

Binary's are far from random.
Are ASCII files more random? How about self-extracting archives?

--
Any sufficiently unpopular but cohesive argument is indistinguishable from trolling.
Re:Truecrypt? by black3d · 2011-12-07 10:50 · Score: 1

It should appear as random data (as opposed to an empty or freshly fully-formatted drive which appear zeroed or one'd depending on the case). This then means either it is encrypted, or has been securely erased. However, sometimes byte chains can be detected within the data. Use a tool like https://code.google.com/p/tcdiscover/ to test your volume.
Although there are more advanced tools available to LEA. Plausible deniability is more important than how hidden the volume is, and you should never give up the key to your external volume until forced to do so or in dire circumstances. It should be currently almost impossible (in most cases) to detect the second hidden volume within the outer volume.
So, work on that outer volume. Frequently write files to it - generally, as often as you're writing files to your hidden volume. So many people leave an empty outer volume and then expect plausible deniability to work when the volume was created 2 years ago and last modified 3 days ago. While it's "possible" that they "just erased all their data a few days ago", it's not plausible, hence the turn of phrase.

--
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Re:Truecrypt? by Vegemeister · 2011-12-07 10:52 · Score: 1

Truecrypt containers have an encrypted header in a particular chunk of the file. Truecrypt attempts to decrypt the data at this location with the given key. If it succeeds, then we know the file is a Truecrypt container. There is also another location that potentially holds an encrypted header describing a hidden volume.
Re:Truecrypt? by black3d · 2011-12-07 10:52 · Score: 1

You're quite right. The researchers were simply pointing out that not only a) are none of them encrypted but also, b) they've got malware on them. Two separate issues. Although yes, an encrypted drive can't be infected by malware while encrypted as there's no file system there for it to infect (unless it writes its own MBR, in which case goodbye data) but as soon as its decrypted and in use that doesn't really matter.

--
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Re:Truecrypt? by tqk · 2011-12-07 10:59 · Score: 1

TrueCrypt does not make invisible containers. It makes encrypted containers.
I don't know about TrueCrypt but last I heard, MS Win* can't even see multiple partitions on USB keys. It only sees the first one (I don't know if this is still true wrt more recent versions of Win*); anything past the first one is invisible.
I don't bother to encrypt my USB keys either. I've not many secrets worth hiding, and a bzipped afio/cpio archive in a second to N extN ptn should be fairly unreadable for ca. 99% of humanity. Anyone who could read them would be disappointed. Not much for me to worry about there.
Medical doctors or bank employees might have more reason to consider encryption.

--
"Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
Re:Truecrypt? by Anonymous Coward · 2011-12-07 11:06 · Score: 0

Please, are you for real ?
ascii is far from random as it features a-z and white space a lot.
All self-extracting archives start with a standard program header and the self-extracting code part (either at the beginning or the end of the file). There are only so many variants of that.
Re:Truecrypt? by Anachragnome · 2011-12-07 11:13 · Score: 4, Funny

Thanks.
I guess the old adage still applies...
"Careful where you stick that thing, son..."
Re:Truecrypt? by Fjandr · 2011-12-07 12:00 · Score: 1

An infection can write to the MBR without destroying the data; many malware programs do exactly this.
If it destroys the data, there's a large possibility that the drive will be erased completely, thus obliterating the malware. By only writing over the first section of the MBR the partition table remains intact, so nothing appears to be wrong with the drive.
Re:Truecrypt? by LinuxIsGarbage · 2011-12-07 12:11 · Score: 1

A factory formatted drive may appear as all 0's (that's how a new SD card appeared to me), however a drive reformatted by traditional software will still show the previous contents (except where the FAT or equivalent was overwritten)
I repeat, a full-format does not zero the drive. A full format just performs a READ-verify on the volume. You need DBAN, Eraser, Roadkil's Disk Wipe, or similar to securely wipe the drive (1 pass is sufficient).
Also, True crypt doesn't change the modified date of the container file when you mount and use the volume, though not having it appear "stale" is a good idea.
Re:Truecrypt? by Artifakt · 2011-12-07 12:21 · Score: 4, Funny

how would they know if some sort of stenography was being implemented
You are correct. There is no known way to detect which files were transcribed in shorthand by a person taking dictation before being entered by keyboard...
Oh, wait, you meant "steganography", didn't you?

--
Who is John Cabal?
Re:Truecrypt? by chaboud · 2011-12-07 12:39 · Score: 1

I believe that there is a TrueCrypt mode for starting the data portion of the TrueCrypt partition in RAW after some specified number of bytes. This allows you to put some files on a drive and hide your encrypted partition after it.
Just put some goatse on there to keep the snoopers from digging too deep.
Re:Truecrypt? by black3d · 2011-12-07 12:39 · Score: 1

That's true in most cases (although a format in Windows 7 of an SSD will request TRIM, erasing the data, but as we're talking about USB sticks that's not completely relevant here), and in those cases it doesn't appear as random data, but quite easily visible data. And if the perp's deniability is that he just formatted it, the random data is a dead-giveaway.
I wasn't intending to suggest to OP that he could format his drive and clear his data, but rather answering his question as to how his data should look as opposed to non-randomized data. Naturally, intact files are also obviously non-random. :) Ie, if the data is all zeros or all ones, it's clearly not encrypted.

--
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
Re:Truecrypt? by Anonymous Coward · 2011-12-07 12:47 · Score: 1

Because the kind of people who are that careful with their data don't lose the USB sticks on the train and then fail to come looking for them.
I encrypt my data because I'm careless, and when (not if) I do lose a stick I don't bother going back for it because I know the data is protected, and of course I have backups.
Re:Truecrypt? by Hyperhaplo · 2011-12-07 14:04 · Score: 1

This is why I have a bunch of files on various devices and drives some of which are encrypted files (mostly with a single text file with "ha ha, made you look!" in them) and some of which are splices of encrypted files (and completely impossible to decrypt.. or tell if you can actually decrypt them).
In a subtle attempt at reverse psychology, half of these have innocent sounding names for which would be immediately discarded (based only on the name of the file) - and hence would be checked first should anyone be in the position to want to look at my files.
As for the $5 wrench.. well, then I'm screwed. There's no way to decrypt a file made up of the middle 1/3 of a 80 GB truecrypt container.
Without the $5 wrench.. well.. it would be fun to watch them try.
The USB device I use has built in encryption. No access without the password. If it is lost, then so is my data. Excellent.

--
You have a sick, twisted mind. Please subscribe me to your newsletter.
Re:Truecrypt? by Anonymous Coward · 2011-12-07 16:10 · Score: 0

Truecrypt is about hiding that data via hidden paritions within outer encrypted containers, and plausible deniability.
Much like the Spanish Inquisition's chief weapon of surprise, Truecrypt's features include hidden containers inside encrypted containers. If Truecrypt were really about that feature, then the deniability would never almost never be plausible, because the existence of Truecrypt encrypted containers would itself be an almost-certain signal that there are hidden containers.
Re:Truecrypt? by Anonymous Coward · 2011-12-07 16:11 · Score: 0

Doubtful. Binaries usually contain readable strings in an understandable language. Encrypted space usually does not.
Re:Truecrypt? by Stuarticus · 2011-12-07 23:23 · Score: 1

DO you actually have time to make any files worth hiding while carrying on that level of subterfuge?

--
If you think someone isn't free to have a different definition of "freedom" you may be a tyrant.
Re:Truecrypt? by Hyperhaplo · 2011-12-08 01:23 · Score: 1

I don't make many files actually.. not that are worth obscuring on this level.. this is more about hiding and obscuring files other people have made :-) .. to give someone the runaround in the event my files fall into someone else's hands.
Note that Australia is quite close to being in the same situation America is.. see the articles about the IINet case currently in the courts - http://whirlpool.net.au/
Someone could literally bust my door down at any time. I would have no warning.. and no time to nuke anything.
This ruse is more about slowing an attacker down and costing an attacker resources than anything else. I smile every time I see one of those files, sitting there, waiting to be "cracked". I do so hope that if they want to try and go through my files that they try one of these first.
Meanwhile, I've just spent an hour and a half on a new short story. No doubt if this machine goes walking it will make light entertaining reading for the (government) thieves.

--
You have a sick, twisted mind. Please subscribe me to your newsletter.
Re:Truecrypt? by VortexCortex · 2011-12-08 01:34 · Score: 1

"Oh, wait, you meant "steganography", didn't you?"
What exactly does dinosaur drawings have to do with any of this?
Re:Truecrypt? by rollingcalf · 2011-12-08 08:15 · Score: 1

To avoid that nagging Windows message about formatting encrypted USB drives, don't use encrypted partitions. Just format it as FAT or NTFS, then create a big encrypted container file on it.

--
---------
There is inferior bacteria on the interior of your posterior.
Re:Truecrypt? by Anonymous Coward · 2011-12-08 08:54 · Score: 0

Still, how would they know if some sort of stenography was being implemented, or if I had a Truecrypt volume called "ProgramA.bin"?
Most forms of steganography require large quantities of data of specific kinds, generally either videos, pictures or images. I'd hazard that such data is not actually all that common on USB memory sticks, which in general are not large enough to store enough of such data to be useful. As for your other suggestion, it's actually pretty damned simple to detect that such a file is an encrypted file (at least under the assumption that nobody's carrying around large quantities of totally random data... the only likely purpose of which would be for cryptographic use anyway), so I'd assume if that were the case Sophos would have realised it had happened.

I can't believe that many people... by Fallingcow · 2011-12-07 09:57 · Score: 4, Funny

... carry acroread.exe and/or iexplore.exe around on their USB sticks.

Weird.

Re:I can't believe that many people... by kju · 2011-12-07 09:59 · Score: 1

Well, i was too lazy to RTFA, but maybe these infected sticks are "lost" on purpose? I mean this has reportedly been done before.
Re:I can't believe that many people... by The+MAZZTer · 2011-12-07 10:05 · Score: 1

TFA says they think this is unlikely due to the type of malware they found.
Re:I can't believe that many people... by ColdWetDog · 2011-12-07 10:06 · Score: 1

TFAuthors didn't think so. The logic being that these sticks would more likely end up in the dump than on somebody elses computer and that the malware on the sticks was 'generic zombie stuff' (zombies are generic these days?).
Not a particularly tight argument, but there you have it.....

--
Faster! Faster! Faster would be better!
Re:I can't believe that many people... by cyachallenge · 2011-12-07 10:08 · Score: 1

That's actually pretty interesting; what if some of these sticks were left intentionally. First, I wouldn't expect a USB stick to have malware. Second, I wouldn't feel bad about using a USB stick that somebody lost (they're mostly cheap and replacable). Arguably, that could be a good attack vector even for tech savy people.
Re:I can't believe that many people... by 1729 · 2011-12-07 10:20 · Score: 4, Informative

This is a routine trick in a security audit: drop some USB sticks in the employee parking lot, and see how many folks just plug it into their computer.
Re:I can't believe that many people... by jd · 2011-12-07 10:36 · Score: 3, Funny

I'm more inclined to think that the trains in Australia are carrying viruses and simply infect the USB sticks on contact.

--
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Re:I can't believe that many people... by Anonymous Coward · 2011-12-07 11:08 · Score: 0

Internet explorer has not been insecure in quite a few years. Unless your a corp with an ancient unpatched version like IE 6 or IE 7, the last 2 versions of IE (8 & 9) are secure if you run Windows Vista or higher. IE 9 has the best security ratings and less holes than any other browser.
Re:I can't believe that many people... by StikyPad · 2011-12-07 11:22 · Score: 2

At work? Count me in. It's not my computer.

--
https://www.eff.org/https-everywhere
Re:I can't believe that many people... by icebike · 2011-12-07 12:01 · Score: 1

Neither of those assumptions makes any sense. The guy's assumptions are simply naive.
You find a usb stick, you are likely to try it out to see what's on it.
The younger you are the more likely you will be to do this.
Generic malware is just as likely to be spread this way as any other. In fact this is a common method of untraceable introduction of a new virus or zombie.

--
Sig Battery depleted. Reverting to safe mode.
Re:I can't believe that many people... by chaboud · 2011-12-07 12:41 · Score: 1

I take a look at a found USB stick. I might be able to identify someone and return their data. I do this on a Linux VM, generally, but...
Re:I can't believe that many people... by flappinbooger · 2011-12-07 15:35 · Score: 2

This is a routine trick in a security audit: drop some USB sticks in the employee parking lot, and see how many folks just plug it into their computer.
Or, an autorun CD with "top secret" or "big huge boobies" written on it with a sharpie.

What percent "success" rate do the pen testers get seeding a parking lot with removable media?

I'd label a CD-R with the name of a current large project or some other verbiage and make it look like someone was sneaking out confidential design files. Drop it some place someone will see it who knows about that project, and you'd be almost guaranteed it will get stuck in a computer, they will have to try and see what was being walked out of the building and by whom.

--
Flappinbooger isn't my real name
Re:I can't believe that many people... by Anonymous Coward · 2011-12-08 09:24 · Score: 0

It wouldn't be a big strecth. Australian wildlife is known for wanting and being able to kill you wherever you are: sky, underwater or on the ground. It just adapted to human using trains I guess.

Encryption by Hatta · 2011-12-07 09:58 · Score: 5, Insightful

The whole point of portable USB sticks is to access your data from strange computers. Plugging an encrypted USB stick into a strange computer completely defeats the point of the encryption. None of my USB sticks are encrypted; they don't need to be because they have no personal information on them.

--
Give me Classic Slashdot or give me death!

Re:Encryption by Anonymous Coward · 2011-12-07 10:06 · Score: 5, Informative

That's not the only point of USB sticks - they can also be used to syncronise two trusted computers at different locations. I use one for just this purpose. However, mine is encrypted.
Re:Encryption by Baloroth · 2011-12-07 10:09 · Score: 1

Or to carry sensitive data often accessed and modified which you don't want on the Internet at all, or to carry the private key for data that is on the Internet. In either case, encryption would be useful. I can think of a few cases where encryption on a USB drive makes sense. Not a lot, true. And in almost any case, invisible encryption would be more useful, so they wouldn't have seen it anyways.

--
"None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Re:Encryption by Spodi · 2011-12-07 10:09 · Score: 1

They are also useful for cheap offline storage. Once or twice a year, I export my KeePass (password manager) database as XML on a thumb drive, put that in an ecrypted archive, then store the USB in a safe somewhere. That way I know I can always get to it even if something ugly goes down, like my main KeePass db gets corrupted and I don't notice until after I do my regular offline backups. Can never to be too cautious when dealing with thousands of distinct passwords.
Re:Encryption by Jahava · 2011-12-07 10:10 · Score: 1

The whole point of portable USB sticks is to access your data from strange computers. Plugging an encrypted USB stick into a strange computer completely defeats the point of the encryption. None of my USB sticks are encrypted; they don't need to be because they have no personal information on them.
A common solution is to have multiple versions of encryption/decryption software (such as TrueCrypt) alongside the actual encrypted partition/blob. What you would do is plug it into the "strange" computer, install the software, and then have access your otherwise-encrypted valuable blob data. Depending on the situation, you can even have multiple encrypted blobs/partitions for different levels of trust.
Re:Encryption by devitto · 2011-12-07 10:18 · Score: 1

errrrrrrrr, that's a pretty unusal use - only data that's 'public' on a USB stick.
Truecrypt is easy soloution, and is small enough to fit on the stick - problem solved.
Re:Encryption by The+Mister+Purple · 2011-12-07 10:20 · Score: 1

Excellent point and practice.

--
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Feynman
Re:Encryption by Hatta · 2011-12-07 10:33 · Score: 1

If the computer you plug it into is compromised, your truecrypt key can be sniffed.

--
Give me Classic Slashdot or give me death!
Re:Encryption by Vegemeister · 2011-12-07 10:54 · Score: 1

The last time I checked, Truecrypt used a kernel mode driver, and thus required admin privileges to run on Windows.
Re:Encryption by plj · 2011-12-07 10:56 · Score: 1

I'll encrypt my sticks as soon as somebody makes an encryption software that works seamlessly in Windows AND Mac OS X AND Linux, and is easy to install and use. Currently, the only one that comes even close is Truecrypt, but due to its stupid vanity licence it isn't a real option on Linux, as it is not included in repos and as such isn't easy to install.
LUKS can work on Windows (with FreeOTFE) but not on OS X, so that isn't an option, either.

--
“Wait for Hurd if you want something real” –Linus
Re:Encryption by godel_56 · 2011-12-07 11:02 · Score: 1

The whole point of portable USB sticks is to access your data from strange computers. Plugging an encrypted USB stick into a strange computer completely defeats the point of the encryption. None of my USB sticks are encrypted; they don't need to be because they have no personal information on them.
I think Rohos encrypted containers are fully portable (with a copy of Rohos on the key), unlike TrueCrypt which requires you to have administrator access to the computer. Also there's nothing to stop you encrypting individual files on a USB key, such as with AxCrypt or the encryption options of 7Zip or Zip Genius.
Re:Encryption by Anonymous Coward · 2011-12-07 11:05 · Score: 0

I do similar, but for critical data like KeePass files, I prefer adding an additional layer of security. IronKeys are more expensive, but what they give is the fact that an intruder has only 10 guesses before the key fries itself. I use this in combination with a proven encryption utility (TrueCrypt) just in case. Even if there was a weakness in IronKeys, it won't mean that I have less security.
Disclaimer, I don't work for Ironkey.
Re:Encryption by Hatta · 2011-12-07 11:07 · Score: 1

You can't do anything with the encrypted data unless you decrypt it. Once you decrypt it, the host computer has full access to it and your encryption keys. Decrypting files on an untrusted computer is a big no-no.

--
Give me Classic Slashdot or give me death!
Re:Encryption by Ken_g6 · 2011-12-07 12:20 · Score: 1

I'll (fully) encrypt my sticks as soon as somebody makes an encryption software that is preinstalled in Windows AND Linux. (AND Mac OS X would be nice too). If I can't use it on a computer I don't have admin rights on, full-disk encryption is worthless to me.
On the other hand, I store my backups encrypted with AES-256 in openssl. I keep a Windows binary of OpenSSL on the drive so I know I can decrypt them if I really have to.

--
(T>t && O(n)--) == sqrt(666)
Re:Encryption by CTU · 2011-12-07 12:32 · Score: 0

Same here, the most I might have on my USB stick is an episode of a TV show or a download from another system, or just a few useful programs or something. So why encrypted something that is not really secretive?
Re:Encryption by petman · 2011-12-07 16:08 · Score: 1

Huh? I installed Truecrypt on my Ubuntu box easily enough from a PPA.

--
Dropbox drops it like it's hot.
Re:Encryption by Anonymous Coward · 2011-12-08 09:11 · Score: 0

That's not the only point of USB sticks - they can also be used to syncronise two trusted computers at different locations. I use one for just this purpose. However, mine is encrypted.
Among other purposes. I use one for backups of my most important personal data. It stays in my pocket at all times when it is not actually being updated, so if (for example) my house burns down, then unless I get stuck and die in the fire the data will escape it. If I die, I'm unlikely to care. The memory stick is, of course, encrypted: there's a whole load of stuff on there I wouldn't want falling into random hands.

Maybe they weren't lost? by Anonymous Coward · 2011-12-07 09:58 · Score: 0

Perhaps this is the latest malware distribution method.

On purpose by Anonymous Coward · 2011-12-07 09:59 · Score: 0

It's a good way to spread your malware: "lose" a USB stick and hope the person that finds it puts it in his work machine (if you make sure you lose it during the morning commute).

Re:On purpose by camperdave · 2011-12-07 10:31 · Score: 2

Actually, leaving it on a bus is a pretty poor way to spread malware. If you are going to be dropsticking, then you want to do it in and around internet cafes and libraries - places where you expect people with computers to be.

--
When our name is on the back of your car, we're behind you all the way!
Re:On purpose by icebike · 2011-12-07 12:05 · Score: 1

Actually, leaving it on a bus is a pretty poor way to spread malware. If you are going to be dropsticking, then you want to do it in and around internet cafes and libraries - places where you expect people with computers to be.
Because we all know, people who take buses and trains don't use computers, right?
Which begs the question of why these usb sticks were found on trains in the first place.

--
Sig Battery depleted. Reverting to safe mode.
Re:On purpose by chaboud · 2011-12-07 12:45 · Score: 3, Funny

Dude. Stop with the brain hurt.
Clearly, people got these because they are dumb. We know that they are dumb because they ride public transit. They ride public transit because they are poor. Dumb, poor, train people got sticks without understanding what they were for. They probably tried to eat them and left them in the train.
Because they're dumb, poor, non-computer people.
QED.
Now I have to go catch a train home.

Lost? Riiigghtt... by wjcofkc · 2011-12-07 10:01 · Score: 4, Interesting

I can see someone "loosing" a couple in the employee smoking area outside of a bank or large tech company. Lost, sure they were.

--
Brought to you by Carl's Junior.

Re:Lost? Riiigghtt... by Anonymous Coward · 2011-12-07 10:05 · Score: 0

http://www.darkreading.com/security/article/208803634/index.html
Re:Lost? Riiigghtt... by Anonymous Coward · 2011-12-07 10:24 · Score: 1

I remember this attack in the past. At the time, it was the early 2000s and "Free MP3 CDs" were used. The autorun.inf ran some software that had a keylogger, and it also did some fairly fancy PPP over SSH tunneling.
It managed to completely compromise the business, and because their bread and butter was their software build tree and code, a competitor started overseas, got in touch with every single one of the business's clients to offer the same exact software for 1/4 the price, and the original business was shuttered within six months because they lost not just customers, but a needed VC funding round.
It used to be I'd just stuff a random USB flash drive into a Linux box, dd if=/dev/zero of=/dev/sdwhatever, but newer Trojanized ones actually register as a keyboard/mouse and start trying Windows commands once inserted.
Re:Lost? Riiigghtt... by StikyPad · 2011-12-07 11:29 · Score: 1

I can see someone "loosing" a couple
Me too. I think it was called goatse.

--
https://www.eff.org/https-everywhere
Re:Lost? Riiigghtt... by Anonymous Coward · 2011-12-07 16:16 · Score: 0

Most people highlight their pathetically misspelled word using all caps. But not you. You use quote marks.
Re:Lost? Riiigghtt... by Lunzo · 2011-12-07 17:56 · Score: 1

WHOOOSH!

Conclusions by Rudisaurus · 2011-12-07 10:01 · Score: 4, Insightful

Conclusions you can draw from this study: people who ride transit and lose their USB memory stick while doing so are

(a) unlikely to encrypt the contents of their memory stick, and
(b) prone to malware infections

I'm not certain that this group is representative of the general population, however.

--
licet differant, aequabitur

Re:Conclusions by MozeeToby · 2011-12-07 10:09 · Score: 1

(c) Blackhats are leaving infected USB sticks on public transit on purpose to act as honey pots and spread infections.
Re:Conclusions by Anonymous Coward · 2011-12-07 10:15 · Score: 1

Alternatively, one could conclude that infected memory sticks are more prone to being left on trains.
Re:Conclusions by BasilBrush · 2011-12-07 11:28 · Score: 1, Insightful

Conclusions you can draw from this study: people who ride transit...
I'm not certain that this group is representative of the general population, however.
You must be American.
Re:Conclusions by Anonymous Coward · 2011-12-08 05:00 · Score: 0

Conclusions you can draw from this study: people who ride transit...
I'm not certain that this group is representative of the general population, however.
You must be American.
Maybe so - in America we all drive cars and the leechers in society grab the government teat and lose their USB sticks on the government subway

Safe USB by FuzzyHead · 2011-12-07 10:03 · Score: 5, Funny

I practice safe USB plugging. I put a rubber cover over my USB stick before I try to plug it in to anything. I have never once caught a virus on it.

Re:Safe USB by Anonymous Coward · 2011-12-07 10:50 · Score: 1

That's a hardware solution of dubious value. :-)
I prefer to make a fake, read-only AUTORUN.INF directory with a read-only text file in it (usually I say what it's there for and call it "readme.txt"). Until malware gets smart enough to look at what's on the usb drive first before blindly writing it's own bogus AUTORUN.INF file, this seems to immunize them pretty effectively (the write will fail, both because the directory is read-only and because it is a non-empty directory rather than a file). Between that and disabling autorun on every machine I use, even if a worm gets on there: A) the payload doesn't get run automatically by the AUTORUN.INF file because the file is broken, and B) it doesn't get run when it gets plugged into my machines. Usually I just see a lonely payload file on there, often hidden in the Recycler, and delete it.
Re:Safe USB by couchslug · 2011-12-07 12:25 · Score: 2

I just pull out early.

--
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
Re:Safe USB by The+Wild+Norseman · 2011-12-07 17:41 · Score: 1

I practice safe USB plugging. I put a rubber cover over my USB stick before I try to plug it in to anything. I have never once caught a virus on it.
Meh. I just rely on the box I plug into to be using an IUD (Intrausb Device).

--
"A government is a body of people usually -- notably -- ungoverned." -Shepherd Book
Re:Safe USB by Anonymous Coward · 2011-12-08 00:37 · Score: 0

I pull out without ejecting.

Sample issues by igorthefiend · 2011-12-07 10:08 · Score: 2

This isn't lost USB sticks - this is USB sticks that were lost and weren't reclaimed long enough to end up in a transit authority auction.

There's another sample out there of sticks that WERE encrypted, or DID have useful data on them that were recovered by their owners. IE they were USB sticks that nobody gave a shit about. Why would we be surprised that there's malware on them and that there was no sensitive data. The other sticks were likely reclaimed.

Re:Sample issues by icebike · 2011-12-07 10:22 · Score: 4, Insightful

This isn't lost USB sticks - this is USB sticks that were lost and weren't reclaimed long enough to end up in a transit authority auction.
Auctioning these thing seems the height of irresponsibility. I wonder what legal ramifications there are for the Rail Corporation in releasing private information, (even if accidentally lost) to total strangers.
From TFA:

he Sophos researchers found personal information belonging to the former owners of the devices, as well as their families, friends and colleagues. The recovered files included images, documents, source code, audio files, video files, XML files and even AutoCAD drawings.

--
Sig Battery depleted. Reverting to safe mode.
Re:Sample issues by dissy · 2011-12-07 13:54 · Score: 2

Auctioning these thing seems the height of irresponsibility. I wonder what legal ramifications there are for the Rail Corporation in releasing private information, (even if accidentally lost) to total strangers.
http://en.wikipedia.org/wiki/Lost,_mislaid,_and_abandoned_property
Concerning abandoned or lost property, generally the finder must attempt to locate the original owner (title owner), usually by way of handing the property over to the authorities so they can attempt to return it.
However, if the lost property is not claimed after a time, then it legally becomes the property of the finder, and the finder gains the right to claim ownership over the item, to everyone except the title owner and any other previous holder of the item.
If the item is not claimed at all, they then gain ownership with all the rights that entitles, including reselling the item.
I admit the addition of copyright law, concerning the actual data on the flash drive, might be an entirely different matter.
However the rail corp never copied the data on the drives, so they are not in violation of copyright. Property law says they own the drive and the data, so reselling the data is also allowed, as long as they didn't make a copy to keep after the sale is complete.
There might be a problem if the final buyer did copy and distribute the data, but that violation would be committed by the final buyer, not the rail corporation.
Re:Sample issues by Anonymous Coward · 2011-12-08 10:13 · Score: 0

The issue isn't property or even copyright. The problem is data protection law. I don't know about Australia, but at least here in the UK the law is that a business/government body can't transfer personal data about individuals without going through a formal registration process and, in many cases, getting permission from the data subject. They clearly do not have that permission in this case, and are unlikely to have registered for the purpose, so they appear to have violated the law. If this were a UK case, they'd specifically have violated this provision:

55 (1) A person must not knowingly or recklessly, without the consent of the data controller—
(a)obtain or disclose personal data or the information contained in personal data, or
(b)procure the disclosure to another person of the information contained in personal data.
In the case of data on a lost USB memory stick, it would appear that "data controller" means the original owner of the memory stick.

CityRail = CityFail by Anonymous Coward · 2011-12-07 10:10 · Score: 4, Interesting

It is more likely that the USB's got infected when someone at CityRail plugged them in to see if there was 'anything good' stored.

Re:CityRail = CityFail by The+Mister+Purple · 2011-12-07 10:26 · Score: 4, Insightful

That hadn't occurred to me. I wonder if the study included a security audit of the CityRail computers?

--
"For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." Feynman
Re:CityRail = CityFail by Teun · 2011-12-07 10:44 · Score: 2

In that case they would all have carried the same virus.

--
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Re:CityRail = CityFail by Yvan256 · 2011-12-07 11:00 · Score: 1

Not if they were plugged into different computers. As Mister Purple said above, a security audit of the CityRail computers should have been done first. And as Icebike said above, I'm also wondering about the legal ramifications for the CityRail about selling things which includes private information.

Most turned in? by Anonymous Coward · 2011-12-07 10:11 · Score: 0

How is it that they know that most lost USB sticks are turned into the lost and found? I find that to be highly unlikely.

Very nice of the Rail Corporation to auction them? by sirdude · 2011-12-07 10:11 · Score: 2

So, RailCorp decided to auction off lost property that could well be of a sensitive nature to some random member of the public? How responsible is that? Shouldn't the fact that they are able to sell lost (and used) property off at twice their retail value ring a few alarm bells?

Two-Thirds of FOUND USB Drives Carry Malware by Anonymous Coward · 2011-12-07 10:14 · Score: 0

Perhaps the title should read

Where's the respect for privacy? by Mr0bvious · 2011-12-07 10:18 · Score: 0

These USB flash drives should be destroyed, not auctioned off to the highest bidder.

Considering that these devices probably contain personal information, I just don't understand how anyone can think it's right to hand them over to anyone for analysis.

Do we do the same for personal diaries? Peoples wallets? I certainly hope not.

Personally I think it's disgusting that they are not being treated with the respect that they should be.

Of course I understand that a lot of these we probably not 'lost' but planted for nefarious reasons, but still, some will be legitimately lost personal items that could contains a wealth of personal information!

--
Never happened. True story.

Re:FAT by Anonymous Coward · 2011-12-07 10:19 · Score: 0

Ext2 is so yesterday!

Scammers by Anonymous Coward · 2011-12-07 10:23 · Score: 0

A huge amount of "lost" USB drives with no vital information but lots of spyware? Maybe some lucky rider will find one and stick it in their laptop.

Maybe that's exactly what someone wanted them to do.

Re:Scammers by sixsixtysix · 2011-12-07 16:51 · Score: 1

this is exactly what i was thinking. purposely left for goal of infecting.

--
...

Re:Very nice of the Rail Corporation to auction th by icebike · 2011-12-07 10:27 · Score: 4, Insightful

My thoughts exactly.

None of these (256 meg to 8 Gig) were so valuable that their destruction would have been considered a huge waste, and the potential damage to the forgetful owner could be massive. You would think that the LEAST they could do was format them, which itself is far from fool proof. But releasing them intact just seems dumb, even if not illegal.

he Sophos researchers found personal information belonging to the former owners of the devices, as well as their families, friends and colleagues. The recovered files included images, documents, source code, audio files, video files, XML files and even AutoCAD drawings.

--
Sig Battery depleted. Reverting to safe mode.

Summary... by Chelloveck · 2011-12-07 10:27 · Score: 4, Insightful

Anti-virus vendor says there's yet another way to get a virus, and you need their product even more. Film at eleven.

--
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.

hello, good samaritan by Thud457 · 2011-12-07 10:34 · Score: 1

Hey, you found my virus collection! I've been looking for that.
Don't worry about returning the thumbdrive, I'll just download a copy of your computer.

--

the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff

Two-thirds of drives were on a Windows computer by Teun · 2011-12-07 10:36 · Score: 1

One clear outcome of this investigation is that 2/3 of these USB drives were inserted into Windows computers.

Because it's generally accepted more than 66% of computers run on an MS OS we can guestimate how many of them are infected.

--
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."

Re:FAT by mlts · 2011-12-07 10:42 · Score: 0

Formatted in FAT is one thing. However there is just no excuse for not encrypting a USB flash drive. On Windows, BitLocker is a right click away. If one doesn't have an edition with BDE, then TrueCrypt is an easy install. Linux, there is TrueCrypt, LUKS, or loopback encryption. Macs have TrueCrypt and other items.

The reason I like using BitLocker or TrueCrypt for encrypting Windows data on a USB flash drive is that if someone finds the drive, can't access it, so formats it, the format.exe command in Windows explicitly will overwrite the sectors containing BitLocker key data, and also will overwrite the volume header in TrueCrypt (not by explicit design, but as part of putting the new filesystem in place.) This way, even if someone gets the password or key later on, the data is gone, barring someone bypassing the disk controller and going cell-by-cell around the wear levelling algorithm.

How to safely use a USB drive? by Anonymous Coward · 2011-12-07 10:45 · Score: 1

What are the best practices for accepting and retrieving files from a USB drive someone gives you?

(assuming I trust the author of the files)

1) turn off autoplay on your system
2) plug it in
3) scan the mounted drive with antivirus software
4) drag and drop the select data files

Aside from having up to date antivirus, windows patches. and app patches, are ther any other good security steps specifically related to USB drives / portable drives?

Re:How to safely use a USB drive? by SuricouRaven · 2011-12-07 11:04 · Score: 1

At my workplace,

1) Give it to either my boss, who has a Mac at his desk, or a coworker with a Ubuntu desktop. Failing that, boot a spare laptop off my my ubuntu boot-stick and use that.
Re:How to safely use a USB drive? by LinuxIsGarbage · 2011-12-07 12:27 · Score: 1

Autorun / Autoplay should be permanently disabled anyways. I believe Vista/7 are a bit tighter than XP as far as Autorun, and XP is slightly better than nothing
The default action in XP is to execute autorun on CDs. This is how Sony rootkits get spread, and poses a hazard with U3 drives which have a partition that appears like a CD.
With flash drives by default XP will load the "what do you want to do?" window and the first option will be the autorun. However if you cancel this dialog, and at any point double click the drive in explorer it will execute the autorun anyways. I think Win7 is less big on running autoruns on a flash drive, and will now ask by default on a CD.

Bad sample data by Anonymous Coward · 2011-12-07 10:46 · Score: 0

We already know that a common attack method is to leave an infected USB stick in the parking lot of the company you're going after. There's no reason it won't work equally well on the public by dropping them in public transportation.

Re:Very nice of the Rail Corporation to auction th by geekoid · 2011-12-07 10:47 · Score: 2

No. IT's normal SOP. It's not there responsibility to correct everyone else's mistakes. You lose a USB stick and don't claim it? TFB.

The fact they sell it for more the retail just says idiots are buying it.

--
The Kruger Dunning explains most post on /. http://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

There are two conclusion possible by drolli · 2011-12-07 10:53 · Score: 1

a) either a lot of pseudo-security researchers jumped on the 'lets loose USB sticks on the train' train

b) being careless enough to loose a usb stick is correlated with being careless enough not to encrypt it and both are correlated to be careless enough not to run your virus checker very often.

Re:FAT by SuricouRaven · 2011-12-07 11:01 · Score: 1

There is one very good excuse. Portability. That's what USB sticks are used for. You want to be able to take your stick and use it on your desktop, your laptop, your work (/school) computers where you don't have admin access, your friends' computers, and so on regardless of what OS. And right away, not after first installing additional software. None of those solutions solve this problem.

Re:FAT by Vegemeister · 2011-12-07 11:06 · Score: 2

Can an arbitrary Windows machine read an ext2 volume? Can an arbitrary Linux machine mount a BitLocker volume? Can you install Truecrypt and mount containers on arbitrary Windows and Linux machines without root privileges? Thought not.

Re:FAT by mlts · 2011-12-07 11:17 · Score: 1

There is not much that works cross platform. If I were moving data between completely different platforms, I'd use something standard that would work on a file basis, rather than a filesystem or disk basis basis. The answer to this is gpg. Most platforms have a working gpg ported to them, be it Android, Solaris, AIX, Windows, Linux, BSD, or even iOS (both jailbroken and non jailbroken apps). I'd just encrypt a file using a passphrase and call it done. If it were a bunch of files, create a bit of chaff of a random size, tar that up, gpg the tar file and copy that to the drive.

So, with this in mind, TrueCrypt or BitLocker do the job well enough. Oftentimes, I'm just moving data from a Windows box to a Windows box, or from a Mac to a Mac. These cases, Disk Image or BitLocker is good enough.

Re:Very nice of the Rail Corporation to auction th by Nidi62 · 2011-12-07 11:23 · Score: 1

You lose a USB stick and don't claim it? TFB.

Because when you lose a USB stick the first place you think to look is the subway...

--
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil

Re:Very nice of the Rail Corporation to auction th by Anonymous Coward · 2011-12-07 11:29 · Score: 1

The fact they sell it for more the retail just says idiots are buying it.

Or, you know, it says that lost USB sticks are more valuable than new, blank sticks. Think about why that might be.

Re:Very nice of the Rail Corporation to auction th by LordLucless · 2011-12-07 11:29 · Score: 1

Or that people are fishing for data rather than hardware

--
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face

Ethics of selling your misplaced information? by AaronLS · 2011-12-07 11:46 · Score: 1

I find the actions of the rail corporation to be pretty alarming.

So if someone leaves private information, financial documents, etc. laying around my home or business, I can just collect them up, claim them as my own, and auction them off to the highest bidder?

Aside from the fact that they were foolish to not encrypt the information on their drives, it doesn't justify ethical handling of the found information. You don't find someone's wallet then sell it to someone who could be a potential white collar criminal, and then try to make moral excuses for yourself by saying "Oh they should have encrypted their wallet..."

Re:Very nice of the Rail Corporation to auction th by Anonymous Coward · 2011-12-07 12:02 · Score: 0

You would think that the LEAST they could do was format them...

So the infected sticks could infect the Rail Corporations computers? Who pays for the time and effort to wipe the sticks and potentially clean the computers.
The rail company probably held these devices for several months waiting for the owners to claim them. If your USB stick has data that is valuable/compromising/whatever and it is not protected, it is your responsibility to not loose it, and if lost, contact lost and found to get it back.
The rail corporation (or anybody else for that matter) has no responsibility to ensure that this information is secure.

Re:Very nice of the Rail Corporation to auction th by icebike · 2011-12-07 12:29 · Score: 2

The Rail corporation has no moral right to sell information that could be damaging to the financial well being of another person
JUST BECAUSE that person accidentally dropped something.

There are laws covering lost property in almost every jurisdiction, and most of them give the finder more rights to the property than anyone other than the original owner. Never the less, selling damaging personal information is in itself a crime (invasion of privacy) and that it was carried out by government funded organization is inexcusable.

Rail corp's own Code of Conduct page links to a Corporate PDF that outlines their expectations, including:

You must:
Take care when collecting, storing, using
and disclosing personal information in
order to protect individuals’ privacy

They demand this of their employees, but think nothing of the rights of their customers?

--
Sig Battery depleted. Reverting to safe mode.

Re:Very nice of the Rail Corporation to auction th by Anonymous Coward · 2011-12-07 13:34 · Score: 1

Considering the highest bidder in the auction was a security company, it would seem that the black hats already know that these memory sticks are unlikely to contain anything valuable. We'd see a black market if they did, with petty criminals scouring the streets for lost USB sticks, and fences purchasing them.

Communications Skills by Ghaoth · 2011-12-07 13:43 · Score: 1

"a passel of USB sticks" WTF is a "passel"

--
Nos Morituri te salutamus

Re:Communications Skills by __aajfby9338 · 2011-12-07 15:55 · Score: 1

"a passel of USB sticks" WTF is a "passel"
Some of the hallmarks of good communication skills are having a large vocabulary, and knowing how to add new words to it.
Definition of passel
Re:Communications Skills by flyingfsck · 2011-12-07 15:59 · Score: 1

A passel is a large number of something. It is a variant of the word parcel. So, the word is correctly used in this story.

--
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Re:Communications Skills by Ghaoth · 2011-12-07 17:12 · Score: 1

Agreed but..."passel" is a posh American corruption introduced by nasal congestion and definitely not a new word, just bad spelling by phonetics. A bit like coral parlips.

--
Nos Morituri te salutamus

" The company analyzed 50 USB sticks" by mapuche · 2011-12-07 13:45 · Score: 1

A too small sample to come with any conclussion.

Re:" The company analyzed 50 USB sticks" by flyingfsck · 2011-12-07 15:57 · Score: 1

No, 50 is actually a magical number where sets are generally considered to be statistically significant.

--
Excuse me, but please get off my Pennisetum Clandestinum, eh!

How _would_ you wipe one if you got it? by mbourgon · 2011-12-07 14:00 · Score: 3, Interesting

Okay, so say you find one. Or your relative/friend/coworker gives you one. OR, you need to loan them yours for a few minutes (happens more and more often now that computers don't come with floppies). What then? Once you get it back, how do you wipe it such that you can reuse it, but it doesn't have anything on it? I'd rather not kiss a $3 drive goodbye everytime that happens. On Linux you'd have to mount it, so (IIRC) you'd be able to just format the partition before mounting.

But how about on Windows. Mac OS? Or if I have autostart (or whatever it's called) off, am I safe? (and yes, I'm pretty sure that last one isn't right).

--
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples

Re:How _would_ you wipe one if you got it? by L4t3r4lu5 · 2011-12-07 21:58 · Score: 2

Personally, use a LiveCD (Dr Web) in an old laptop with no hard disk as a sheep-dip station. If I'm handed a memory stick, it gets scanned before it touches a network connected device. It's not 100% foolproof, but it eliminates a lot of risk. Once scanned, I plug it in to my workstation to see what's on it. Disabling auto-run prevents automatic launch of any payload, and media-insertion scan from $favouriteAVproduct will let you know of anything else untoward.
br.Failing that, snap the thing in half and chuck it in the recycling. Hey, it's $3. Or, free at any trade show.

--
Finally had enough. Come see us over at https://soylentnews.org/

Re:Very nice of the Rail Corporation to auction th by demonlapin · 2011-12-07 15:14 · Score: 1

I suspect that a greater problem is trying to convince the lost and found jobsworth that that one is yours.

Want to bet? by Paul1969 · 2011-12-07 15:46 · Score: 3, Funny

I find it hard to believe that none of the folks who turned in "lost" USB sticks took a minute to check if there was any hot pr0n on them first.

Good news and bad news by Sloppy · 2011-12-07 16:01 · Score: 1

He meant steganography but

that is a very long word and people hate to type it
he didn't want you to know what he was talking about, or even know that he was talking about something else

so he used encoded shorthand for it.

Fortunately, you were able to expand the shorthand, so the meaning wasn't lost. Unfortunately, you guessed the code, so the meaning wasn't lost.

--
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.

Virus Collection by Anonymous Coward · 2011-12-07 17:53 · Score: 1

Ah someone has finally found my missing virus collection!
Please return it, no questions asked.

PO Box 10110110110
Virus Park, Washington DC.
20001 /sarc off

Re:Very nice of the Rail Corporation to auction th by Anonymous Coward · 2011-12-07 19:51 · Score: 0

For perspective, here's an analog analogy:

Suppose, instead of a USB stick, it was a folder full of good old-fashioned paper, perhaps of a sensitive or private nature. Surely they wouldn't have just given the thing out so cavalierly just because nobody claimed it.

I acount for 12 of those by Anonymous Coward · 2011-12-07 23:35 · Score: 0

Except I never "lost" them, I left them around for people to find with a few random pictures and PDF's on them, so people though "yay, free memory stick!". They also had a worm I was writing at the time on it; I had a 100% success rate on payload delivery too.

See a USB stick on the floor? By all means pick it up and keep it, but plug it into an old and offline box and run some scans, format it, check it for viruses before it comes near anything important to you.

The Stupidity of Windows AutoRun by Anonymous Coward · 2011-12-08 00:12 · Score: 0

I once got a virus on a USB by loading it into a photo print booth. Stuck it on my PC and it ran the virus immediately, thanks to Windows default AutoRun settings. Microsoft should really have a page on their web site with photos of its employees who made stupid decisions like this. The misery and loss of time and data this person caused are huge. (And also that annoying 'Index your help file' window, but that's another story).

In other news... by bcmm · 2011-12-08 01:03 · Score: 1

In other news, totally impartial research conducted by Dettol shows that your bathroom isn't clean enough.

--
# cat /dev/mem | strings | grep -i llama
Damn, my RAM is full of llamas.

AV Marketing? by ProfanityHead · 2011-12-08 04:36 · Score: 1

From TFA:

The experiment was done by antivirus firm Sophos, which acquired three bags of USB sticks lost by commuters on trains in the Greater Sydney metro area at an auction organized by the Rail Corporation New South Wales.

Sounds like something drummed up by their marketing department?

Not really enough here by Anonymous Coward · 2011-12-08 04:49 · Score: 0

This story really is too thin for a headline.
Give me five or ten locations and a bigger sample and you'd have something.

An antivirus firm finds malware...surprise by doston · 2011-12-08 09:01 · Score: 1

Sophos has every reason to find more malware than anyone on here would expect to find on lost USB sticks. I've been an SA for a long time and Malware just isn't as common as the antivirus firms would like everyone to believe it is. I'd like to know what their definition of malware is for this informal "study". It's probably so loose as to be a joke. Whenever I've found malware, it's never removed by any antivirus program out there. They're all completely worthless, but I guess it keeps people working and that's great. If they did indeed find actual malware, which I highly doubt, then I'd say the USB sticks were planted for fools to pick up and shove in their hungry usb holes.

This isn't necessarily indicative of anything... by Vrtigo1 · 2011-12-08 09:46 · Score: 1

I have a whole bunch of unencrypted USB sticks...because the stuff I put on them isn't worth encrypting. As a geek I put stuff like drivers, or maybe music or a movie on them. Hardly stuff I care about other people getting their hands on. What would be more telling is the percentage of unencrypted sticks that contained sensitive information such as financial or medical data.

Re:FAT by Vegemeister · 2011-12-10 11:55 · Score: 1

But the entire point of USB flash drives is being able to carry your data around and access it on random systems. When I want security, I carry a flash drive with portable WinSCP and putty. Create a password-protected ssh key just for that flash drive, and you can just remove it from ~/.ssh/authorized_keys if the flash drive gets lost.

Slashdot Mirror

Two-Thirds of Lost USB Drives Carry Malware

196 comments