Announcement

Collapse
No announcement yet.

Threat from USB Thumb Drives

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts
    SecTrainer
    Senior Member

  • SecTrainer
    replied
    Here's a link to the Vonage thumb-drive/phone flash demo...it may take awhile to load the first time. Click on "Product Gallery" at the upper right for closeups. Vonage soft-phone software is preinstalled.

    Put this baby in your pocket, hook into any computer with (default or improperly configured) Web access, and you're in business. I haven't checked to see what port this uses but as Vonage uses SIP instead of H.323, I'd guess it uses 5060 for signaling and dynamic port assignment for the voice.

    Of course, like so many technologies, it's obviously a very useful tool for perfectly legit purposes, also. Great for travelers, and you can also see how it would enable phone service via your squad's computer if you have the right data link, enough speed and Web service. However, some wireless providers (British Telecom, for one) have started to block port 5060 over wireless themselves to prevent VOIP...meaning you gotta use your phone minutes to make phone calls, by gum! I know they want to limit the data traffic, given their current capacity, but sooner or later they'll be able to sell us a single data link and they won't care whether we're using our Treo as a phone or a modem.

    (This would also solve their "problem" with mobile wireless routers, which enable multiple people traveling together in a car, for instance, all to use one data link on their laptops, or to set up mobile hot-spots. I heard that Verizon had wanted the FCC to make these routers illegal, of all the goofy ideas, but the FCC just gave them the bird.)
    SecTrainer
    Senior Member
    Last edited by SecTrainer; 12-28-2006, 10:20 AM.

    Leave a comment:

  • N. A. Corbier
    Senior Member

  • N. A. Corbier
    replied
    Infoworld and eWeek (Ziff Davis Media) stated that administrators were putting super glue into the USB ports to keep those damn devices out. Usually, you need to reboot into Linux to take control of a target PC, which might be detectable if someone's watching you.

    This is where U3 comes in. (http://www.u3.com/)

    I have a U3 Sandisk device that runs U3 programs encapsulated onto the thumb drive. While it's gonna kill the life of the device (I don't expect it to last a year from all the Read/Write operations), it does make for handy "presence anywhere."

    On it, I keep Firefox, Thunderbird, Trillian, OpenOffice, and Skype. Find a 2k or XP based PC, plug it in, and boom. From any PC, I can run those programs and keep the info on my drive.

    This can augment the USB threat because you don't need to reboot (which looks suspicious as hell), and can run programs that your administrator may not want you running.

    A well locked down XP box, or an XP client on a 2k3 server will obviously prevent this, but lets face it: How many SMBs bother to lock that stuff down, or even have the IT personnel with requisite MS training to do so? Not every company has an MCSE with the Security track on hand.

    Leave a comment:

  • SecTrainer
    Senior Member

  • SecTrainer
    replied
    Originally posted by Eric
    There is always the old fashioned way - email things to your account. It is even easier now with copiers that can scan and mail the document in PDF.
    Yup, that's one electronic version of the dead-drop that has the extreme advantage that no one has to physically go to a specific location, and either party to the drop can be sitting at a computer anywhere in the world. It's also nearly instantaneous, of course.

    Fortunately, email server administrators have caught on to this and will (if they're smart) implement controls not only on what gets emailed in (size, type of attachments, etc.) but also what goes out. This can become quite sophisticated, sniffing not only header packets for destination and other info, but also data packets, looking for keywords, etc.

    Leave a comment:

  • SecTrainer
    Senior Member

  • SecTrainer
    replied
    Originally posted by davis002
    It also mentioned that some administrators went as far as filling USB ports with super glue I'll see if I can find that article, unless you already know which one I am referring to...
    Hadn't heard of that one, but I can easily imagine them trying ANYTHING to disable those USB ports!

    Leave a comment:


  • Eric
    replied
    There is always the old fashioned way - email things to your account. It is even easier now with copiers that can scan and mail the document in PDF.

    Leave a comment:

  • davis002
    Senior Member

  • davis002
    replied
    Good post! I recall reading an article not too long ago about the upcoming Windows Vista release. It mentioned something about administrators will be able to more easily disable USB ports on certain computers with Vista installed. It also mentioned that some administrators went as far as filling USB ports with super glue I'll see if I can find that article, unless you already know which one I am referring to...

    Leave a comment:

  • SecTrainer
    Senior Member

  • SecTrainer
    started a topic Threat from USB Thumb Drives

    Threat from USB Thumb Drives

    The threat to information systems posed by visitors or disgruntled employees, vendors, etc. who might bring USB thumb drives to your facility is growing as these devices not only have grown in capacity to hold many GB of data, but also are showing up in many "disguised" forms, such as a "lipstick", or this ballpoint pen/USB drive. Adding to the problem, there are complete operating systems (sometimes called "LiveDistros", such as Damn Small Linux) now for these drives that permit the user to mount the drive, boot into the OS on the thumb drive, conduct business using a variety of apps he brings with him (for instance, there's a complete VOIP PBX/soft phone called "[email protected]" you can run, complete with the OS and Apache server, from a 2GB drive) and then he carries virtually every crumb of the evidence of his activity away with him instead of leaving it on the computer whose USB port he uses. There's a thumb drive, incidentally, that has the jacks required for a microphone and ear buds that you can use with the VOIP application to make Internet phone calls from your parasite machine. These things, together with the LiveDistros and the apps they can implement, are becoming very scary. Even if you just used such a device in an old-fashioned dead-drop operation, it wouldn't take but a few drops to transfer the important content from a research lab system right out the front door. And you'd probably chuckle when you stop at the front desk to sign the security log as you leave...using your USB thumb drive/pen.

    If only Sandy Berger had had one of these and one of the tiny USB-ported pocket scanners, he wouldn't have had to stuff documents from the National Archives down the front of his pants. So much more elegant...
    Attached Files
    SecTrainer
    Senior Member
    Last edited by SecTrainer; 12-26-2006, 09:11 PM.

Leaderboard

Collapse
Working...
X