Slashdot Mirror
Two-Thirds of Lost USB Drives Carry Malware
itwbennett writes "Antivirus firm Sophos acquired a passel of USB sticks lost by commuters on trains in the Greater Sydney metro area at an auction organized by the Rail Corporation New South Wales. The company analyzed 50 USB sticks and found that not a single one was encrypted and 33 of them were infected with at least one type of malware."
.. they were lost by the 10% of commuters stupid enough to lose an USB stick.
Hey don't blame me, IANAB
One interesting aspect of the results was that based on their data and formatting seven of the infected storage devices belonged to Mac OS X users or had been extensively used under this OS.
... carry acroread.exe and/or iexplore.exe around on their USB sticks.
Weird.
The whole point of portable USB sticks is to access your data from strange computers. Plugging an encrypted USB stick into a strange computer completely defeats the point of the encryption. None of my USB sticks are encrypted; they don't need to be because they have no personal information on them.
Give me Classic Slashdot or give me death!
I can see someone "loosing" a couple in the employee smoking area outside of a bank or large tech company. Lost, sure they were.
Brought to you by Carl's Junior.
TrueCrypt does not make invisible containers. It makes encrypted containers.
There is an exception for the container hidden in an container, but that only offers plausible deniability as the existence of the larger container is obvious.
This post comes with a double-your-money-back guarantee!
Any offense taken to this post is at your sole discretion.
Conclusions you can draw from this study: people who ride transit and lose their USB memory stick while doing so are
(a) unlikely to encrypt the contents of their memory stick, and
(b) prone to malware infections
I'm not certain that this group is representative of the general population, however.
licet differant, aequabitur
I practice safe USB plugging. I put a rubber cover over my USB stick before I try to plug it in to anything. I have never once caught a virus on it.
It is more likely that the USB's got infected when someone at CityRail plugged them in to see if there was 'anything good' stored.
Still, how would they know if some sort of stenography was being implemented, or if I had a Truecrypt volume called "ProgramA.bin"?
This isn't lost USB sticks - this is USB sticks that were lost and weren't reclaimed long enough to end up in a transit authority auction.
Auctioning these thing seems the height of irresponsibility. I wonder what legal ramifications there are for the Rail Corporation in releasing private information, (even if accidentally lost) to total strangers.
From TFA:
he Sophos researchers found personal information belonging to the former owners of the devices, as well as their families, friends and colleagues. The recovered files included images, documents, source code, audio files, video files, XML files and even AutoCAD drawings.
Sig Battery depleted. Reverting to safe mode.
Truecrypt isn't designed to be invisible at all. Aside from entirely encrypted drives, it's fairly obvious if someone HAS encrypted data. Truecrypt is about hiding that data via hidden paritions within outer encrypted containers, and plausible deniability.
Truecrypt volumes are generally detectable:
http://www.jadsoftware.com/?page_id=89
https://code.google.com/p/tcdiscover/
And if the researchers discovered drives that are filled entirely with random data, then they know they're either securely formatted or encrypted, and would likely consider them the latter - if they're securely formatted the file system appears intact. If the entire drive is encrypted (or securely erased from the MBR up) then the FS is not intact, and it's a fair bet that the researchers are claiming they found all sticks with intact file systems, formatted to the same volume as the stick, with single partitions.
As are those hidden within files:
http://16s.us/TCHunt/index.php
But - the reason for the ramble: Never make the mistake of thinking Truecrypt is invisible. It's not. What's "invisible" should be your second hidden volume within the Truecrypt container - if you've set it up correctly. And there have previously even been attacks on that, in the event attackers are able to gain access to the external container. Work on your plausible deniability. Don't rely on TC to do the work for you or you'll end up with leaks everywhere.
http://www.schneier.com/paper-truecrypt-dfs.pdf
"The true measure of a person is how they act when they know they won't get caught." - DSRilk
My thoughts exactly.
None of these (256 meg to 8 Gig) were so valuable that their destruction would have been considered a huge waste, and the potential damage to the forgetful owner could be massive. You would think that the LEAST they could do was format them, which itself is far from fool proof. But releasing them intact just seems dumb, even if not illegal.
he Sophos researchers found personal information belonging to the former owners of the devices, as well as their families, friends and colleagues. The recovered files included images, documents, source code, audio files, video files, XML files and even AutoCAD drawings.
Sig Battery depleted. Reverting to safe mode.
Anti-virus vendor says there's yet another way to get a virus, and you need their product even more. Film at eleven.
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Thanks.
I guess the old adage still applies...
"Careful where you stick that thing, son..."
how would they know if some sort of stenography was being implemented
You are correct. There is no known way to detect which files were transcribed in shorthand by a person taking dictation before being entered by keyboard...
Oh, wait, you meant "steganography", didn't you?
Who is John Cabal?
Dude. Stop with the brain hurt.
Clearly, people got these because they are dumb. We know that they are dumb because they ride public transit. They ride public transit because they are poor. Dumb, poor, train people got sticks without understanding what they were for. They probably tried to eat them and left them in the train.
Because they're dumb, poor, non-computer people.
QED.
Now I have to go catch a train home.
Okay, so say you find one. Or your relative/friend/coworker gives you one. OR, you need to loan them yours for a few minutes (happens more and more often now that computers don't come with floppies). What then? Once you get it back, how do you wipe it such that you can reuse it, but it doesn't have anything on it? I'd rather not kiss a $3 drive goodbye everytime that happens. On Linux you'd have to mount it, so (IIRC) you'd be able to just format the partition before mounting.
But how about on Windows. Mac OS? Or if I have autostart (or whatever it's called) off, am I safe? (and yes, I'm pretty sure that last one isn't right).
"Sometimes a woman is a kind of religion, she can save your soul & set you free from all your sins" - Bad Examples
I find it hard to believe that none of the folks who turned in "lost" USB sticks took a minute to check if there was any hot pr0n on them first.