Slashdot Log In
Social Engineering Using USB Drives
Posted by
CowboyNeal
on Thu Jun 08, 2006 06:39 PM
from the driving-right-in dept.
from the driving-right-in dept.
Iphtashu Fitz writes "What's the easiest way to hack into the computer systems of a credit union? It turns out that all you need to do is copy a virus/trojan onto USB drives and scatter them around the front door of the credit union. This was how a recent security audit was performed at a credit union where the employees had actually been tipped off to the audit. Security experts collected 20 old USB thumb drives and filled them with images and other data along with a trojan that would collect sensitive information and e-mail it back to them. Early one morning they planted the thumb drives around the entrances to the credit union as well as other public places where the employees were known to congregate. In very little time 15 of the 20 USB drives were plugged into company computer systems and started e-mailing usernames, passwords, etc. back to the auditors."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
wow (Score:5, Insightful)
Oh crap!!! (Score:5, Funny)
Parent
Re:Oh crap!!! (Score:5, Funny)
Parent
Re:wow (Score:4, Funny)
Parent
I know what those USB drives are! (Score:4, Funny)
*wink wink nudge nudge*
Parent
Re:wow (Score:5, Insightful)
Sure, you might not fall for a renamed executable on a USB drive, but what if it's taken a step farther?
Imagine you are walking into work early, and find an open folder on the floor, with some papers strewn around and a CD or DVD in with it. Imagine the paper is an application to put on a SIGGRAPH demonstration, and on the CD is a WINDOWS directory, a LINUX directory, a BSD directory and a SOLARIS directory and each directory has a file named SIGGRAPH_presentation.exe or there is a SIGGRAPH_presentation.jar, (eliminating the need for multiple OS versions), with a README about how to execute it. You figure, "What the heck - I love cool graphics."
Now, while you are watching a cool graphics demo, it checks if you are logged in as root and, if you are, installs a nasty payload. If not, it could simply start emailing every file it finds in your home directory, or delete them, or encrypt them.
I don't care what OS you are running, if you can be convinced to execute something, there will be some damage done. If you aren't root the damage is limited, but there is still damage. The attack may have to involve more research on a person's interests, or require more "found" hardware to convince someone, but it can be done. Maybe someone has to buy some hardware from ThinkGeek and make a fake installation disk, then leave the box, (with the modified disk), somewhere you will come across it.
Being convinced you are immune to the dangers of social engineering is not a good way to avoid being social engineered. A healthy dose of paranoia can go far - and it's only paranoia if there isn't anyone out to get you.
Parent
Re:wow (Score:5, Funny)
I find it a little odd that mine was the only car in the parking lot with such a CD on it. Maybe I shoul@(*$)*@#%^Y@Ba;skONBIAEOSNA NO CARRIER
Parent
Re:wow (Score:5, Funny)
Parent
Doesn't even need root (Score:5, Interesting)
"Now, while you are watching a cool graphics demo, it checks if you are logged in as root and, if you are, installs a nasty payload. If not, it could simply start emailing every file it finds in your home directory, or delete them, or encrypt them."
Doesn't even need root to steal passwords. There are a _ton_ of config files and startup scripts in your home directory, which a trojan can attach itself to. It can load itself in your bash window, as a plugin in your mozilla, launch an extra program in your X, replace icons on your desktop, and god knows what else. One of those will catch on to something.
E.g., if it's, say, Suse, I know that there'll be some programs -- e.g., Yast, every time you run the auto-updater -- where the system will ask for the root password first. I can just replace the link with one to program that shows an identical dialogue.
Or, yeah, transmitting every file in your home directory is indeed another great way to get a ton of info. Source files that contain the URL, account and password to the productive database are the norm, rather than the exception. Or some cutesy script that goes through the firewall to download the latest nasa pic of the day or whatnot with wget, and in the process contains the user's name and password to go through that proxy. (Let's hope he's used that password in more than one place.) Or there'll always be one idiot who exported the productive database onto his local computer, or downloaded the server configs (including all database connections, with name and password) god knows what else he's copied there. There'll often be one idiot who's built some back door because he can't be arsed to go through the IT department to have something reconfigured or to properly log in. I'll love to know about that backdoor. There'll be emails with forgotten passwords. There'll be emails where people tell each other about those backdoors. ("Oh, if you come from the intranet zone, you can bypass the stupid authenticating proxy completely. Just use http//prod.somebank.com/internalurl/some.jsp?secr
Config files outside the home directory? Those can be fun too. E.g., everyone will have access to fstab. Maybe they'll have the name and password for every single file share they use in there, or maybe it'll be offloaded to some
Log files? Now those can be a cornucopia of classified information. I've seen people even log each user's name and password at each login through their clever UserRegistry or Single Sign On module or such. If someone copied a bunch of productive logs to their machine -- or I can get the password to the machine where they are -- I might be able to login and cause mayhem as 1000 of their customers. Or go to those customers' profile pages and find out their personal data.
Etc.
"If you aren't root the damage is limited, but there is still damage."
As I was saying, even if you aren't root, the damage done can be catastrophic. The thinking that all that matters is that the OS survives, can sometimes miss the point. Yeah, some guy's Linux installation survived perfectly. But then I got access to his company's servers. Was it that much better? I'll bet that as far as the company is concerned, they would have cared less if I just wiped out one workstation's hard drive.
Parent
I'd plug it in. (Score:4, Interesting)
OK, maybe I'm too innocent. Normally I run Linux. Are you suggesting that Windows will automatically run executables from any random USB device that gets plugged into the computer?
If not, these people were dumb enough to run random executables. Granted, having both program-as-icon and data-file-as-icon is a very bad UI choice, but still... 15 out of 20? WTF?
If so, that Windows actually does the autorun thing... wait a second while I invent new words to describe this particular quality.
Parent
autorun.inf doesn't work (Score:4, Informative)
Actually, you can't make it autorun off of a thumbdrive with an autorun.inf file even though that may work with a cd, because thumbdrives are considered removable storage like a hd or floppy, rather than removable media, like a cd. I know it because the company I work for had to replicate a ton of thumbdrives and we wanted to make them autorun like our cds, but there's no way to do it without changing the user's registry settings for autorunning.
A more likely scenario would be to name a file, "cute.jpg.exe" and giving it an image icon. Windows hides extensions by default, so all the user would see is a file that looks like an image with a tempting title to click on.
Parent
Re:autorun.inf doesn't work (Score:5, Informative)
Parent
Re:Pretty scary. (Score:5, Insightful)
Parent
It's definitely a problem... (Score:5, Informative)
Why not just disable USB keys [petri.co.il]? They don't need to take that data home with them...the ChoicePoint disaster, several laptops stolen out of cars... these companies need to make are personal data more secure.
Re:It's definitely a problem... (Score:5, Interesting)
They didn't use autoplay, they used an enticing file name on an executable. (My wife Pics.exe (with a zip icon) would do it.)
It's sort of interesting that 15 new devices made it in the building without anyone talking about it. "Hey, look what I found" "Mine is a gig!" "Me too!". They all put it in to see what's on it probably knowing it's against the rules and did it anyway.
It's not ignorance, its "i think i can get away with it."
I wish I could find thumb drives in the parking lot.
On another note, I sure hope that company didn't send the stuff they collected unencrypted. That's a violation of a bunch of rules. Penetrating a network for a security audit shouldn't lower the overall security of the network, if they sent unecrypted that's exactly what they did though.
Parent
Re:It's definitely a problem... (Score:3, Informative)
Re:It's definitely a problem... (Score:3, Insightful)
They could have caused the data to be sent unencrypted to a test machine inside the corporate network somewhere, or directly connected to the corporate network for the purposes of the test but outside the firewalls. That woul
You have to hack the USB drive itself. (Score:5, Informative)
If you flip one of the bits, then it will auto-play just like a CD.
http://en.wikipedia.org/wiki/SCSI_Inquiry_Command [wikipedia.org]
It's the "removable medium" setting.
Parent
Human curiosity kills the computer (Score:5, Insightful)
My best advice for corporations is to lock down the computers and only allow approved devices by security profile. Trying to train people not to act like people will fail.
Any better ideas other then beating the users with a stick or JB Weld in any unused ports on a computer.
Re:Human curiosity kills the computer (Score:3, Insightful)
1) Text file on drive with your name and number.
2) Encrypt every thing else!
You might get your drive back then.
If you want to look at the disk.
1) create non privliged testuser account on your linux (or other non standard OS) box (pref' non x86).
2) view drive contents.
3) remove testuser account when done.
Your chances of getting pwned by some tricky bastard would be much lower.
You could've saved a few words there (Score:5, Funny)
Parent
Autoplay trojan? (Score:5, Funny)
Re:Autoplay trojan? (Score:5, Informative)
http://lastmeasure.com/ [lastmeasure.com]
Last Measure is a wholly owned subsidiary of the Gay Nigger Association of America
The bastards at GNAA created LMOS (Last Measure OS)
http://sam.zoy.org/lmos/ [zoy.org] No matter what depravity you can think of, the Trolls have already been there and raped that idea.
Parent
Close those ports. (Score:3, Interesting)
But USB pose a different trouble. There ARE useful usb devices, like mouses and keyboards...
And further more... there are phones and digital cameras, and even thos 5 in 1 memory readers that can be used to substract information or leak viruses...
or even worse, specific purpouse programms, likt the used at the "audit"...
And also one thing I wonder, is what Antivir was "protecting" the machine? Is nt antivir doing heuristics to look after strange things at the computer, like "something" trying to get the addressbook?
But.. How? (Score:3, Interesting)
I simply could NOT get anything to autorun from any type of flash drive. Autorun.inf wouldn't run
How could they get the trojan to autorun on insert? And if you're picking crap up off the ground, why wouldn't you hold shift while plugging it in if you were running Win?
Re:But.. How? (Score:3, Insightful)
Re:But.. How? (Score:5, Informative)
If you want a great example of autorun look at Pass2Go from the Roboform guys. It sets up autorun on the USB drive it is installed on. The Microsoft wireless network setup wizard (the one the also exports the WEP/WPA keys of an existing connection on an XP machine as plain text) also sets up a USB key to autorun the wizard.
Parent
The word from Microsoft on autorun for nerdsticks (Score:5, Informative)
Parent
Re:The word from Microsoft on autorun for nerdstic (Score:4, Informative)
This is a security hole you could drive a truck through.
Parent
Through the front door (Score:5, Insightful)
You've probably seen the experiments where users can be conned into giving up their passwords for a chocolate bar or a $1 bill. But this little giveaway took those a step further, working off humans' innate curiosity. Emailed virus writers exploit this same vulnerability, as do phishers and their clever faux Websites. Our credit union client wasn't unique or special. All the technology and filtering and scanning in the world won't address human nature. But it remains the single biggest open door to any company's secrets.
There you have it -- invest in fancy firewalls, make people change their passwords every 90 days, filter email from spam, phish, virii, and trojans, and then sit back and watch as your employees bypass all those lovely defenses and lay your system vulnerable.
I've said it before: there's no use building a wall, firing up the boiling oil, and digging a moat and filling it with sharks if you're going to build an 8-lane superhighway through it. Companies are trying to crack down, but the myriad ways that information can get stolen or transferred from a system are enourmous. USB drives, camera phones, MP3 players -- anything that can store data is a potential point of vulnerability, one which a company will be hard pressed to monitor or control. Couple that with this sudden rash of stolen laptops carrying unencrypted and often sensitive data, and the there's no reason for hackers to work too hard any more, when they can just have data handed to them.
Smart idea!! (Score:5, Interesting)
Add this to your weekly 'security' email/meeting as I have a feeling this may happen a bit more often now...
Black Hat Hazards! (Score:3, Interesting)
Before I'd even think of something like this, I'd want signed original 8.5x11 floppies giving me explicit authorization to attack^Hevaluate systems like this.
Even then, the DHS might come after the evaluators or possession and willful use of destructive tools.
If They Were Running Linux... (Score:3, Informative)
And the other 5 trojan drives went where? (Score:5, Insightful)
Thin Clients (Score:3, Insightful)
"Yeah man, we had the day off today..." (Score:5, Funny)
"Why?"
"IT says we got dongled, whatevthefuckthatmeans."
My momma always told me... (Score:4, Funny)
...you don't know where that dongle's been.
Fixed in Vista (Score:4, Funny)
Related work (Score:5, Interesting)
Kevin Mitnick has pointed out that an attack like this could be made virtually certain to work. Desperately ask the receptionist to let you in, just for 90 seconds, just to use the restroom, and drop a CD on the floor labeled "CONFIDENTIAL: Layoff List". Extra points if you got a copy of the company phone directory and copied some or all of it onto the CD for the finder to browse while the autorun program chugs away.
Age old problem... (Score:4, Insightful)
USB devices offers some nasty options (Score:5, Interesting)
Okay, if all of you can keep quiet until April (Score:3, Funny)
Don't disable anything (Score:5, Insightful)
Disabling USB devices will not work. Even if you do it perfectly, that is, disable all storage devices but not keyboards, mice, etc. Why? Because CD-ROM drives have the exact same problem. I don't think floppy drives have any type of autorun function, but you can still put deceptive file names on them. Same problem with Email attachments.
Now, go disable email, CD-ROMs, floppies, USB devices, and memory card readers at your office/school and see how much work actually gets done.
You must either educate people, or restrict them to the point where they can't do their job in order to prevent your network from being infected. Given that the latter results in a huge loss of profit, I'd try to educate people.
Re:Don't disable anything (Score:5, Insightful)
The fact is, in a business setting, the machines should be completely locked down so that users can do ONLY what they need to do, and nothing else.
Of course, politics tend to prevent that from happening. But it is proper "procedure".
Parent
Disabling USB drives is missing the point (Score:5, Insightful)
People love USB drives for good reasons. They make the data personal, tangible, an object that follows physical laws that users know intuitively. To an IT person, data is just ones and zeroes in some arbitrary physical medium. But to most users, there is a big difference between that letter you wrote last week disappearing into some network ether, versus residing on a physical USB drive you can hold in your hand.
Most of the comments in this thread are of the "USB drives are a big security hole! Disable them!" variety. What a classic example of IT snobbery. A good administrator, one who understands his users, would stop to think WHY people use USB drives, and try to create a solution that balances the benefits vs. risk to the users.
Along this line of reasoning, an ideal system would be a thin client that accepts USB drives for file storage, automagically backs them up when they are used, and doesn't run any executables other than what's configured. Kind of like the old Sun smart card idea where the user has a physical, tangible ID card where his files conceptually reside.
If you want your users to respect your network security concerns, you first have to try to respect your users.
Re:Great How-To (Score:4, Funny)
Parent
Re:Unfortunatly... (Score:5, Insightful)
No, but many IT professionals do. Hopefully they educate their users to be wary of anything they dont own. It's not much different then opening an attachment from an email you receive.
Parent
Re:Nice socal engineering. (Score:5, Interesting)
At WinHec this year, Microsoft reported that many companies were using glue guns(!) to secure their networks against USB drives. They then went on to claim that Vista will make this unnecessary (as well as curing world hunger and making you look thin in those pants...)
Parent
Re:Done before? (Score:3, Informative)
Re:Pfft.... (Score:5, Funny)
People that are geeky enough to be able to
Parent