Slashdot Mirror

← Back to Stories (view on slashdot.org)

USB Canary Sends An SMS When Someone Tinkers With Your USB Ports (bleepingcomputer.com)

Posted by BeauHD on from the tinker-toys dept.

An anonymous reader quotes a report from BleepingComputer: A new tool released on GitHub last week can help paranoid sysadmins keep track of whenever someone plugs in or disconnects an USB-based device from high-value workstations. Called USB Canary, this tool is coded in Python and currently, works only on Linux (versions for Windows and Mac are in the works). The tool works by watching USB ports for any activity while the computer is locked, which generally means the owner has left his desk. If an USB device is plugged in or unplugged, USB Canary can perform one of two actions, or both. It can alert the owner by sending an SMS message via the Twilio API, or it can post a message in a Slack channel, which can be monitored by other co-workers. USB Canary can prove to be a very useful tool for large organizations that feature strict PC policies. For example, if you really want to enforce a "No USB drives" at work, this could be the tool for the job. Further, with modifications, it could be used for logging USB activity on air-gapped systems.

19 of 40 comments (clear)

  1. USB fishing by Okian+Warrior · · Score: 2

    I've heard stories about how businessmen staying in Chinese hotels leave their laptops in the room while going out, and the "maid" comes in, sticks in a USB drive, and downloads all the files.

    I've often wondered if it's possible to make a spring-loaded trap that would clamp down on a USB device and prevent it from being removed. The USB connector has 2 square holes that square pegs might fit into.

    It might be possible to "fish" for these foreign USB devices, and reverse engineer them to see what sorts of attack they use.

    1. Re:USB fishing by Anonymice · · Score: 3, Insightful

      Better nail your laptop down too, then! If they're going to be rumbled anyway, they might as well just take the fucker.

    2. Re:USB fishing by Misagon · · Score: 1

      How about making ports like the infamous "USB Kill Stick" but in reverse? Any unauthorized device connected to the port would get fried.
      The attacker would probably not find out what happened until afterwards when they try to get the data from the attacking device.

      But yeah, if we knew what kind of attack they used to gain access one could provide another set of files: a honey pot, or just innocuous data.

      --
      "We mustn't be caught by surprise by our own advancing technology" -- Aldous Huxley
  2. After which by tomxor · · Score: 1

    you may as well burn your computer... Why not just have a USB self destruct, once someone has "tinkered" with your USB ports you can't guarantee anything.

  3. That's nothing... by __aaclcg7560 · · Score: 1

    Plug in an unauthorized USB stick at my job and security will be at your desk in five minutes to confiscate it.

    1. Re:That's nothing... by HornWumpus · · Score: 1

      A Rubber ducky? Those look like keyboards to the machines...and run scripts.

      You can hack up a 2gig USB drive into one. Certain models only.

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    2. Re:That's nothing... by __aaclcg7560 · · Score: 1

      A Rubber ducky?

      I personally prefer to have a Hello, Kitty! 8GB USB stick. :P

    3. Re:That's nothing... by HornWumpus · · Score: 2

      IT security guy...you know a 'rubber ducky' is a penetration tool? The ones with actual rubber duckys printed on them are sold to poseurs, real hackers just modify the right old thumb drive.

      PCs with windows or Linux (with autorun disabled) are owned by plugging it in. The computer thinks it's a keyboard and trusts it. It runs scripts, which can be toxic.

      Does IT get called when someone's keyboard gets disconnected then plugged back in or only for USB storage?

      --
      John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
    4. Re:That's nothing... by __aaclcg7560 · · Score: 1

      IT security guy...you know a 'rubber ducky' is a penetration tool?

      I've heard about them, haven't seen them. My job in InfoSec is to fix problems. Scanning and penetration is a different department. I thought you meant this rubber ducky.

      Does IT get called when someone's keyboard gets disconnected then plugged back in or only for USB storage?

      I don't know. I work with workstations and not with users. The workstations are locked down tighter than a virgin nerd's ass. If you create a file and leave it on your desktop for too long (all data is supposed to be stored on the network), you will need administrator access to modify the file.

    5. Re: That's nothing... by __aaclcg7560 · · Score: 1

      It's a shame when us low on the pole IT guys have higher regulation and oversight than the fucking government we serve.

      I work in government IT.

      You can't even create local files [...]

      Local files can be created but they need to move to the network in a timely manner. If the local file is left on the desktop for too long (might be 30 days), admin access is required to move or modify. I can move my own files, but regular users need to call the help desk.

      [...] yet government officials are setting up insecure servers, getting accounts compromised, and falling for phishing scams that my 12 year old son would laugh at.

      Politicians and political appointees don't follow the same rules as government workers and civilians.

  4. Linux has this by s.petry · · Score: 1

    auditd

    --

    -The wise argue that there are few absolutes, the fool argues that there are no probabilities.

  5. LOL by JThundley · · Score: 1

    When I saw the headline, my first thought was "I could probably do this pretty quickly on a Linux machine in Python."

    Then I read the summary.

  6. Windows USB log tool by Anonymous Coward · · Score: 2, Informative

    http://www.nirsoft.net/utils/usb_log_view.html

  7. Re:Actually by DontBeAMoran · · Score: 1

    You know what works even better? Ripping out the USB ports.

    --
    #DeleteFacebook
  8. Re:work around? by AHuxley · · Score: 1

    Hire better staff. Dont use Windows. Set your company up with the expectation that data will walk out with staff or be extracted via the internet.
    Separate your internal networks. Staff data on one network, public blue sky research https://en.wikipedia.org/wiki/... and charity work on another. Contact with customers is kept away from all other sections of the internet networks.
    Emerging projects and work not yet public is kept away from most staff and all other networks.
    The work laptop is not a take home social media "gift" to staff.
    USB devices found around the parking lot don't get looked at inside the company on secure computers.
    Encrypt all data so staff cant walk out with any data. They can work all they want but cant make a backup of all source code and just walk out.
    If a person makes a mistake all they alter is some charity work, blue sky project or encrypted files.
    Dont use wifi, Windows software and always interview all new staff to see if their presented paperwork is correct and have their background story investigated.
    That blocks staff that have no skills and keeps out staff that will walk out with data for some reason that usually shows up in their past politics or social media use.

    --
    Domestic spying is now "Benign Information Gathering"
  9. Race condition! by jenningsthecat · · Score: 1

    Which one wins the race? The USB kill stick as it does its powerful best to fry your MoBo, or the Python code trying to send out a network message before some critical component coughs up smoke? My money's on the kill stick.

    --
    'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
  10. Slaker News?! Orange?! Without permission?! by CustomSolvers2 · · Score: 1

    I came here to read about suicides, death threats, people linking to some research about the pros/cons of a green-to-orange transition in nerd communities, etc. And then I realised about today's date and well... nice one, Slashdot! The doomsday-like alternative would have been much funnier though.

    --
    Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
    1. Re:Slaker News?! Orange?! Without permission?! by CustomSolvers2 · · Score: 1

      Clarification for those with problems to understand context, intention, sarcasm and/or over-3-word ideas: sorry for not having included a closing smiley or LOL in my previous comment to help you understand that I was joking. How could you know it otherwise, right? Because you think that there are lots of people doing really weird things just for a change of name/colour, because Slashdot is exactly the kind of place where these people go and because I would enjoy witnessing such idiocy? (-> all this is more logical than me being joking?! Don't you think that there has to be something really wrong with someone coming to such a nonsensical conclusion? I do).

      --
      Custom Solvers 2.0 = Alvaro Carballo Garcia = varocarbas.
  11. I had a great joke by SCVonSteroids · · Score: 1

    The joke should be pretty obvious though, just read the headline and replace a few words.

    Sorry I just don't want to lose my job or get in any trouble :)

    --
    I tend to rant.