• Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

Social Engineering, the USB Way

Those thumb drives can turn external threats into internal ones in two easy steps

Jun 07, 2006 | 04:15 AM

By DarkReading
DarkReading

We recently got hired by a credit union to assess the security of its network. The client asked that we really push hard on the social engineering button. In the past, they'd had problems with employees sharing passwords and giving up information easily. Leveraging our effort in the report was a way to drive the message home to the employees.

The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information, as well as bring in potential vulnerabilities such as viruses and Trojans. Several other clients have raised the same concern, yet few have done much to protect themselves from a rogue USB drive plugging into their network. I wanted to see if we could tempt someone into plugging one into their employer's network.

In the past we had used a variety of social engineering tactics to compromise a network. Typically we would hang out with the smokers, sweet-talk a receptionist, or commandeer a meeting room and jack into the network. This time I knew we had to do something different. We heard that employees were talking within the credit union and were telling each other that somebody was going to test the security of the network, including the people element.

We figured we would try something different by baiting the same employees that were on high alert. We gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with our own special piece of software. I had one of my guys write a Trojan that, when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back to us.

The next hurdle we had was getting the USB drives in the hands of the credit union’s internal users. I made my way to the credit union at about 6 a.m. to make sure no employees saw us. I then proceeded to scatter the drives in the parking lot, smoking areas, and other areas employees frequented.

Once I seeded the USB drives, I decided to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desks.

I immediately called my guy that wrote the Trojan and asked if anything was received at his end. Slowly but surely info was being mailed back to him. I would have loved to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, then unknowingly running our piece of software.

After about three days, we figured we had collected enough data. When I started to review our findings, I was amazed at the results. Of the 20 USB drives we planted, 15 were found by employees, and all had been plugged into company computers. The data we obtained helped us to compromise additional systems, and the best part of the whole scheme was its convenience. We never broke a sweat. Everything that needed to happen did, and in a way it was completely transparent to the users, the network, and credit union management.

Of all the social engineering efforts we have performed over the years, I always had to worry about being caught, getting detained by the police, or not getting anything of value. The USB route is really the way to go. With the exception of possibly getting caught when seeding the facility, my chances of having a problem are reduced significantly.

You’ve probably seen the experiments where users can be conned into giving up their passwords for a chocolate bar or a $1 bill. But this little giveaway took those a step further, working off humans' innate curiosity. Emailed virus writers exploit this same vulnerability, as do phishers and their clever faux Websites. Our credit union client wasn’t unique or special. All the technology and filtering and scanning in the world won’t address human nature. But it remains the single biggest open door to any company’s secrets.

Disagree? Sprinkle your receptionist's candy dish with USB drives and see for yourself how long it takes for human nature to manifest itself.

— Steve Stasiukonis is VP and founder of Secure Network Technologies Inc. Special to Dark Reading


Subscribe to RSS









Bugs
ENTERPRISE VULNERABILITIES
Vulnerability:basilic
Published:2009-08-20
Severity:High
Description:Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote attackers to execute arbitrary SQL commands via the idAuthor parameter to (1) index.php and possibly (2) allpubs.php in publications/.
Vulnerability:matchmaking
Published:2009-08-20
Severity:Medium
Description:Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) browse_ladies.php and (2) browse_men.php, the (3) gender parameter to search.php, and the (4) id parameter to services.php.
Vulnerability:saphplesson
Published:2009-08-20
Severity:Medium
Description:SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.
Vulnerability:world's tallest buildings
Published:2009-08-20
Severity:Medium
Description:Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to inject arbitrary web script or HTML via the rank parameter.
Vulnerability:world's tallest buildings
Published:2009-08-20
Severity:High
Description:SQL injection vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to execute arbitrary SQL commands via the rank parameter.
<font class="redsmallestplain"><font class="redsmallestplain"><font class="redsmallestplain"><font class="redsmallestplain"><font class="redsmallestplain"> &lt;A HREF="http://as.cmpnet.com/event.ng/Type=click&amp;FlightID=145041&amp;AdID=230206&amp;TargetID=322&amp;Segments=117,2692,3108,3448,8623,10296,13988,14467,14495,15091,15146&amp;Targets=322,2625,2878,6296,10067&amp;Values=34,46,51,63,77,87,91,102,140,206,222,227,442,657,1255,1311,1405,1431,1716,1767,1785,1830,1925,1935,1936,1945,1970,2246,2299,2310,2313,2327,2352,2678,2727,2762,2767,2862,2878,2942,3552,3712,3714,3725,3890,3904,4079,6293,6391,6392,6393,6422,6424,6440,6502,6541,6567,6580,6815,6892,6967,7035&amp;RawValues=&amp;Redirect=http://apm.solutionscenter.techweb.com/?cid=websky_con_entsoft" target="_top"&gt;&lt;IMG SRC="http://i.cmpnet.com/ads/graphics/as5/kls/ca/tw_0904059_apm_160x600.gif" WIDTH=160 HEIGHT=600 BORDER=0&gt;&lt;/A&gt; </font></font></font></font></font>


Briefing Centers
POWERFUL INFORMATION
AT YOUR FINGERTIPS
(SPONSORED LINKS)
Service Assurance: Join the Community
Virtualization Resources to Improve Productivity and Cut Waste
VMware Data Backup and Recovery Best Practices
Best Practices for BPM with SOA to Maximize ROI