No, Spotify, You Shouldn't Have Sent Mysterious USB Drives To Journalists (techcrunch.com) 53
Zack Whittaker, writing for TechCrunch: Last week, Spotify sent a number of USB drives to reporters with a note: "Play me." It's not uncommon for reporters to receive USB drives in the post. Companies distribute USB drives all the time, including at tech conferences, often containing promotional materials or large files, such as videos that would otherwise be difficult to get into as many hands as possible. But anyone with basic security training under their hat will know to never plug in a USB drive without taking some precautions first.
Concerned but undeterred, we safely examined the contents of the drive using a disposable version of Ubuntu Linux (using a live CD) on a spare computer. We examined the drive and found it was benign. On the drive was a single audio file. "This is Alex Goldman, and you've just been hacked," the file played. The drive was just a promotion for a new Spotify podcast. Because of course it was. Jake Williams, a former NSA hacker and founder of Rendition Infosec, called the move "amazingly tone deaf" to encourage reporters into plugging in the drives to their computers.
Concerned but undeterred, we safely examined the contents of the drive using a disposable version of Ubuntu Linux (using a live CD) on a spare computer. We examined the drive and found it was benign. On the drive was a single audio file. "This is Alex Goldman, and you've just been hacked," the file played. The drive was just a promotion for a new Spotify podcast. Because of course it was. Jake Williams, a former NSA hacker and founder of Rendition Infosec, called the move "amazingly tone deaf" to encourage reporters into plugging in the drives to their computers.
Huh? (Score:5, Funny)
Seems to me if you were a reporter and you just plugged this thing into your computer and listened to that file, it would scare the shit out of you and you might not do it again.
Re:Huh? (Score:4, Informative)
Yeah I don't see what the problem here is. It's bad to encourage journalists to plug in random USB drives? Anyone who did that just got their hand slapped.
Re: (Score:2)
If their employer actually though of IT security, they may have a PC off network setup and ready to be cleaned and reinstalled at a moment notice.
Re:Huh? (Score:5, Insightful)
Re:Huh? (Score:5, Interesting)
It does remind me of the sort of infosec training used by some corporations where they send phishing mails to their employees where the link leads to a page reminding them not to click links in an email.
Re: (Score:3)
Re: (Score:3)
My former university did that once. I promptly clicked on the link. When I got the followup nasty e-mail I replied that sending the phishing e-mail from the IT department's official address, through a completely legitimate university-servers-only path didn't really make it much of a test.
Re: (Score:2)
Except it *IS* a valid test. In simulation, the bad guy got a mis-configured mail server to send you a legit looking email. You clicked and helped them widen the crack in the armor.
Re: (Score:2)
If your institution has misconfigured e-mail servers, and misconfigured web servers that let the bad guys not only send you e-mails from that institution but also set up fake web pages on that institution's servers, well, there's not much hope, is there?
Re: (Score:2)
So you advocate hard and crunchy outside, soft and squishy inside?
If the bad guy manages to get control of one server, it's bad news. If he gets control of things on the other side of the DMZ, it's worse.
Re: (Score:2)
The issue of whether organizations should be sending around e-mails with links in them at all is separate. Personally, I don't think you should be training people to click on links in e-mail, but they do.
So if you're going to make a habit of sending legit e-mails with links that need to be clicked, don't make your fake phishing messages come from legit servers and link to legit addresses. Spend a few bucks and get yourself a shady server with a shady address and use that.
Re: (Score:2)
Seems to me if you were a reporter and you just plugged this thing into your computer and listened to that file, it would scare the shit out of you and you might not do it again.
The journalists were careful and wasted time plugging in into secure disposable machine, to have their time wasted by a stupid message that doesn't apply to them and just an annoying ad.
what about DVD, audio cd, VHS autoplay in an non c (Score:2)
what about DVD, audio cd, VHS autoplay in an non computer box?
Re: (Score:3)
Re: (Score:2)
Optical and Magnetic Media? What do you live in the 00's?
Besides these "Non Computer Boxes" are just as much computers as your desktop is. Compared to a USB stick These media options are much larger and obvious packages, and prone to damage much quicker.
Re: (Score:1)
It's a good reason to buy the DVD and not the brown-ray version of a film.
Re: (Score:2)
I love security testing (Score:3)
Re: (Score:3)
I'll pick your daughter up after school, take her to a nice tour of the city in my car, them bring her back home, unharmed, in time for supper.
That'll teach you about the security of your children ! The world will be a better place for it, right ?
Re: I love security testing (Score:2)
Could you? She spends far too much time playing video games
Re: (Score:2)
What's the problem? (Score:3)
I don't understand the problem -- sure, security conscious reporters aren't going to just plug it in and see what it does, but there are plenty who will, and that's probably the target audience for the security podcast. I thought they were going to say that the drives contained malware or some auto-installing application.
Re: (Score:2)
I would hope that most tech journalists would be smart enough to run any thumb drives they receive on an air gapped system by now. I'd only imagine how much malware they must have received from disgruntled readers in the past.
Re: (Score:2)
Re: (Score:2)
Although there is the axiom of "any news is good news' in PR circles, Spotify just pissed off a lot of journalist.
Someone in Spotify's marketing dept thought this was a good idea. Yes, it got a lot of ink, but most of the ink will make Spotify look plainly stupid, because they were, in fact, stupid. If this is the level of sophistication in the podcast episodes, might as well cancel it now.
Re: (Score:2)
If this is the level of sophistication in the podcast episodes, might as well cancel it now.
Why? How many breaches are the result of end users doing something they shouldn't have, vs hackers gaining access to a system completely from the outside.
Re: (Score:2)
More useful would be something that doesn't immediately put up mental blocks in journalist's minds. Most journalists would find great skepticism in such an approach, IMHO.
There are a lot of podcasts that deal with exactly the scenario posited by Spotify. It's neither unique, or gives a good impression.
It was an expensive stunt, and is unlikely to have rewarded Spotify in the manner Spotify desired. PR is full of bad stunts. This was one of them.
Re: (Score:2)
I was more commenting around the "level of sophistication" aspect of your post. Quite possibly I misunderstood what you meant.
I can see ways that this stunt would backfire, and I don't doubt that some journalists may be put off by being made to look dumb...
It is appauling that USB is insecure (Score:2)
We just assume that of course, when you plug in a USB drive, it can take over your entire system. Everybody knows that.
Linux is no better than Windows. The USB can pretend to be a keyboard and pump in commands.
You NEVER know that a USB is safe. Even if you burnt it yourself it could contain latent malware.
It should ALWAYS be safe to plug in an unknown USB. The computer should not trust it.
BUT THEY ALL DO.
(The USB might fry your computer, but that is not what we are talking about here.)
Re: (Score:2)
We just assume that of course, when you plug in a USB drive, it can take over your entire system. Everybody knows that.
Emphasis mine. That's the problem, not everybody knows that. They should, but they don't. The rest of your post is spot on.
Re: (Score:2)
No. Why should people need to know that? It should be safe to plug in an unknown USB into a machine. That is not rocket science.
If while on the road a colleague gives you a USB with important info on it is that USB safe? Are their computers safe? What is the history of he USB and everything that it has been plugged into? There is no way to know.
So you just plug it in and most of the time you get away with it.
Re: What's the problem? (Score:2)
Expensive? Seems pretty cheap to me. USB drives are a common swag item. They can be had for a few bucks apiece. Cheaper than mailing them a mug and has a lesson attached. Although it does bring up an interesting point of the thousands of people who get free usb drives as swag (or even buy them on amazon) and just assume that they are new and clean.
Yes but you have heard of me. (Score:5, Insightful)
Tone deaf, maybe, but here we are reading about it and talking about it.
Sounds like the promotion worked perfectly.
I'm gonna be pedantic (Score:2)
I know the phrase is from TFA, but I'm not actually seeing what is "tone deaf" about this. That phrase usually applies to someone making insensitive and likely hurtful comments in a situation where they should know better - like someone making a joking reference about the possibility of a recently-deceased person being in hell rather than in heaven.
"Inappropriate" would have fit the speaker's intent better, or perhaps "ill advised" - although, as several commenters here have already pointed out, the exercis
Re: I'm gonna be pedantic (Score:2)
"Oh, yes. Please say make about whether this stunt was tone deaf or not. Just don't forget to mention 'You Have Been Hacked', only on Spotify."
-Spotify Public Relations team.
What about Linux? (Score:2)
Assuming I plugged it into my Linux box, I'm not sure just how much harm it could do.
Re: (Score:2)
It will register itself as a USB keyboard, exfiltrate your ssh keys, and send insipid emails to your in-laws
Re: (Score:2)
You forget it is in the drive. It has a boot sector program that will visualize you primary OS, while logging and sending your keystrokes to get you password and other info.
Re: (Score:2)
Sure, *IF* it is actually a USB drive and not an embedded system that pretends to be a keyboard and mouse and such while also presenting USB storage so you don't notice all the other virtual devices.
Upshot? Plug it into something with nothing important on it that you don't mind wiping and re-installing after.
Re:What about Linux? (Score:5, Funny)
Assuming I plugged it into my Linux box, I'm not sure just how much harm it could do.
It might install Windows...
Re:What about Linux? (Score:4, Insightful)
Or it could fry your PC with those bad voltage hacks.
Re: (Score:2)
Where's the profit in that?
Re: (Score:2)
Where's the profit in that?
1) Receive USB drive from mystery source
2) Plug into my PC
3) ???????
4) Profit!
I mean that's the most likely outcome, right?
Re: (Score:2)
Or it could fry your PC with those bad voltage hacks.
Good point. It's not just the software to be wary of these days.
if i recieve a USB drive from a stranger (Score:2)
Re: (Score:3)
Was it *really* a bad idea? (Score:2)
Maybe, just maybe we need more of these examples to show the world that a) it's a bad idea to actually plug this kind of shit in and b) see (a)
My company sends out fake phishing mails to train the workforce (some of them are really clever) so we don't get actually phished. We should see more of this so people aren't caught with their pants down when Russia/China/Facebook/etc actually do something (intentionally|unintentionally) malicious.
Geez, chill out (Score:1)
Re:Geez, chill out, or maybe not (Score:1)
Perhaps the stick's root kit has installed and hidden itself so well they THINK it's only got an audio file on it.
reporters were warned (Score:3)
"A spokesperson for Spotify did not comment. Instead, it passed our request to Sunshine Sachs, a public relations firm that works for Spotify, which would not comment on the record beyond that “all reporters received an email stating this was on the way.” "
they should have been aware this was coming their way, as warning/announcement emails were send.