Podcast: Play in new window | Download (12.3MB)
Today’s Headlines Include…
Prefer a Direct Download ? (mp3)
Download today’s show.
| Today’s Artist |
|
|
Kevin Kline Track: Let It Rain[3:15] |
| Comments |
USB Social Engineering
by Andrew McCaskey
I found a really interesting report at a Techweb site called DarkReading.com
It was a rather clever hack, involving USB drives.
Steve Stasiukonis is VP and founder of Secure Network Technologies Inc.He recently got hired by a credit union to assess the security of its network. In the past, they’d had problems with employees sharing passwords and giving up information easily. The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information.
There’s been a lot of concern about such download and run thefts yet few have done much to protect themselves from a rogue USB drive plugging into their network.
First, Steve prepared about two dozen worthless vendor giveaway thumb drives collected over the years with a Trojan that, when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back.
Next he had to get the USB drives in the hands of the credit union’s internal users.
He made his way to the credit union at about 6 a.m., to make sure no employees saw him, and then proceeded to scatter the drives in the parking lot, smoking areas, and other areas employees frequented.
Once he seeded the USB drives, he decided to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desks.
Slowly but surely info was being mailed back to him. He said that he would have loved to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, then unknowingly running our piece of software.
After about three days, he figured he had collected enough data. Of the 20 USB drives he planted, 15 were found by employees, and all had been plugged into company computers. The data we obtained helped us to compromise additional systems, and the best part of the whole scheme was its convenience. We never broke a sweat. Everything that needed to happen did, and in a way it was completely transparent to the users, the network, and credit union management.
With the exception of possibly getting caught when seeding the facility, his chances of having a problem were reduced significantly.
His conclusion ” The USB route is really the way to go.”
That should be a cautionary tale.
Save $10 on any order of $50 or more at GoDaddy.com!
Recent Items Mentioned:
Inbox Zero: One of the guideposts along the way will be some articles from the excellent site for personal productivity at 43 Folders , specifically an article entitled “My email diet” in the Inbox Zero – Day 1series.
From the 43Folders Inbox Zero process, I’m learning that these tools are no substitute for ruthless triage of escalating questions:
1. What does this message mean to me and why do I care ?
2. What action, if any, does this message require of me ?
3. What’s the most elegant way to close out this message and the nested action it contains ?
These questions were most valuable getting from 400 to 100 items. After that, the default
Outlook folder “Unread Items” kept the new stuff in one place – just reading headers and sender lines for easy zapping
The free 40 page downloadable e-Book from Rajesh Setty, a fellow Gnomedexer.. “Personal Branding for Technology Professionals”, It’s some heavy reality for anyone in the technology arena – especially the IT field or pure technologists.
Be sure to sign up for our upcoming roundtable. We will be using GoToMeeting. Also, be sure to check out GoToMeeting. Why? Because you can hold meetings right over the Net — from anywhere. Plus, you can hold all the meetings you want for one flat rate. To get your free 30-day trial , visit www.gotomeeting.com/techroundtable.
If you happen to own a Motorola ROKR or RAZR, Nokia 6620, 6630, 6683, or the Sony Ericsson k700, s710 or k750i, check out the Melodeo Mobilcast cell phone podcast player. .
- Take 10% off any order at GoDaddy.com! Code SLASH
- Take $5 off any $30 order at GoDaddy.com! Code SLASH2
- .com Domains $6.95 at GoDaddy.com! Code SLASH3
- More blogs about SlashdotReview…
- Slashdot Review by Email – Sign up here:
