Threat from USB Thumb Drives

[SecTrainer]

The threat to information systems posed by visitors or disgruntled employees, vendors, etc. who might bring USB thumb drives to your facility is growing as these devices not only have grown in capacity to hold many GB of data, but also are showing up in many "disguised" forms, such as a "lipstick", or this ballpoint pen/USB drive. Adding to the problem, there are complete operating systems (sometimes called "LiveDistros", such as Damn Small Linux) now for these drives that permit the user to mount the drive, boot into the OS on the thumb drive, conduct business using a variety of apps he brings with him (for instance, there's a complete VOIP PBX/soft phone called "Asterisk@Home" you can run, complete with the OS and Apache server, from a 2GB drive) and then he carries virtually every crumb of the evidence of his activity away with him instead of leaving it on the computer whose USB port he uses. There's a thumb drive, incidentally, that has the jacks required for a microphone and ear buds that you can use with the VOIP application to make Internet phone calls from your parasite machine. These things, together with the LiveDistros and the apps they can implement, are becoming very scary. Even if you just used such a device in an old-fashioned dead-drop operation, it wouldn't take but a few drops to transfer the important content from a research lab system right out the front door. And you'd probably chuckle when you stop at the front desk to sign the security log as you leave...using your USB thumb drive/pen.

If only Sandy Berger had had one of these and one of the tiny USB-ported pocket scanners, he wouldn't have had to stuff documents from the National Archives down the front of his pants. So much more elegant...

[davis002]

Good post! I recall reading an article not too long ago about the upcoming Windows Vista release. It mentioned something about administrators will be able to more easily disable USB ports on certain computers with Vista installed. It also mentioned that some administrators went as far as filling USB ports with super glue I'll see if I can find that article, unless you already know which one I am referring to...

[Eric]

There is always the old fashioned way - email things to your account. It is even easier now with copiers that can scan and mail the document in PDF.

[SecTrainer]

It also mentioned that some administrators went as far as filling USB ports with super glue I'll see if I can find that article, unless you already know which one I am referring to...

Hadn't heard of that one, but I can easily imagine them trying ANYTHING to disable those USB ports!

[SecTrainer]

There is always the old fashioned way - email things to your account. It is even easier now with copiers that can scan and mail the document in PDF.

Yup, that's one electronic version of the dead-drop that has the extreme advantage that no one has to physically go to a specific location, and either party to the drop can be sitting at a computer anywhere in the world. It's also nearly instantaneous, of course.

Fortunately, email server administrators have caught on to this and will (if they're smart) implement controls not only on what gets emailed in (size, type of attachments, etc.) but also what goes out. This can become quite sophisticated, sniffing not only header packets for destination and other info, but also data packets, looking for keywords, etc.

[N. A. Corbier]

Infoworld and eWeek (Ziff Davis Media) stated that administrators were putting super glue into the USB ports to keep those damn devices out. Usually, you need to reboot into Linux to take control of a target PC, which might be detectable if someone's watching you.

This is where U3 comes in. (http://www.u3.com/)

I have a U3 Sandisk device that runs U3 programs encapsulated onto the thumb drive. While it's gonna kill the life of the device (I don't expect it to last a year from all the Read/Write operations), it does make for handy "presence anywhere."

On it, I keep Firefox, Thunderbird, Trillian, OpenOffice, and Skype. Find a 2k or XP based PC, plug it in, and boom. From any PC, I can run those programs and keep the info on my drive.

This can augment the USB threat because you don't need to reboot (which looks suspicious as hell), and can run programs that your administrator may not want you running.

A well locked down XP box, or an XP client on a 2k3 server will obviously prevent this, but lets face it: How many SMBs bother to lock that stuff down, or even have the IT personnel with requisite MS training to do so? Not every company has an MCSE with the Security track on hand.

[SecTrainer]

Here's a link to the Vonage thumb-drive/phone flash demo...it may take awhile to load the first time. Click on "Product Gallery" at the upper right for closeups. Vonage soft-phone software is preinstalled.

Put this baby in your pocket, hook into any computer with (default or improperly configured) Web access, and you're in business. I haven't checked to see what port this uses but as Vonage uses SIP instead of H.323, I'd guess it uses 5060 for signaling and dynamic port assignment for the voice.

Of course, like so many technologies, it's obviously a very useful tool for perfectly legit purposes, also. Great for travelers, and you can also see how it would enable phone service via your squad's computer if you have the right data link, enough speed and Web service. However, some wireless providers (British Telecom, for one) have started to block port 5060 over wireless themselves to prevent VOIP...meaning you gotta use your phone minutes to make phone calls, by gum! I know they want to limit the data traffic, given their current capacity, but sooner or later they'll be able to sell us a single data link and they won't care whether we're using our Treo as a phone or a modem.

(This would also solve their "problem" with mobile wireless routers, which enable multiple people traveling together in a car, for instance, all to use one data link on their laptops, or to set up mobile hot-spots. I heard that Verizon had wanted the FCC to make these routers illegal, of all the goofy ideas, but the FCC just gave them the bird.)

[Mr. Security]

Post to bury SPAM.

[locknid]

hopefully the most important files and programs on a network are behind passwords, encryption, plus tons of other security software. I don't think the average worker posses the knowledge to get past these security devices. Just like we are hired as security for physical property there are people hired to protect software and information. Now if a person does possess the knowledge to get past security then it seems very well possible, and i had never thought about it before. Sounds kinda scary at how easy things are getting these days.

And its not like you can ban thumb drives from your workplace because many people use them for legitimate purposes. I use mine to back up all my security reports, college work, etc.

[Bill Warnock]

hopefully the most important files and programs on a network are behind passwords, encryption, plus tons of other security software. I don't think the average worker posses the knowledge to get past these security devices. Just like we are hired as security for physical property there are people hired to protect software and information. Now if a person does possess the knowledge to get past security then it seems very well possible, and i had never thought about it before. Sounds kinda scary at how easy things are getting these days.

And its not like you can ban thumb drives from your workplace because many people use them for legitimate purposes. I use mine to back up all my security reports, college work, etc.

locknid:
Agreed; however, unauthorized access is still key to keeping your data safe. Irregardless of encryption, passwords and the like, if the information is valuable to a third party, with time and effort the data can be obtained. For the unsuspecting user, inductive coupling can be disastrous and the bad guy does not even have to enter the protected space.
Enjoy the day,
Bill