USB Hacks: Who needs endpoint security?

GadgetTrak Anti-Theft Products For Cell Phone, PDA and Mac Theft Recovery

Although not directly USB related, I got a newsletter from GadgetTrak today with some interesting new products that I found quite interesting, I even bought the Mac solution. You may remember GadgetTrak as the provider of the “LoJack for USB devices” with theft recovery software for iPods and other gadgets. Well they are at it again. They now have anti-theft products for cell phones and PDAs as well as Apple computers. The approach with these tools is just slick.

The cell phone and PDA software works by the software detecting if an unauthorized SIM card is put in the phone, at which point is fires of an SMS message to pre-defined numbers with the new phone number and ID numbers that can be used to identify a subscriber via the carrrier.

The Mac software has some pretty rutheless techniques, not only does it email back network data such as IP address etc, but it also hijacks the iSight camera connected to the device and sends a video of the thief to you as well. One other feature I particularly like as well is that it gathers information regarding all of the wireless networks in the area as well.

Sony USB Thumb Drives Install Rootkit

So, it appears Sony did not learn from their little rootkit lesson back in 2005 when they installed trojan like behavior to protect digital rights on their CDs. Now it appears that lines of Sony’s Micro Vault line has crossed the line yet again. When the built in fingerprint reader installs a driver which hides a directory under c:\windows\. This directory and any files within are hidden when viewing files and subdirectories in the Windows directory. This driver then opens up a way for malware to sneak into that system as if you know the name of the directory you can sneak other files into it thus hiding them as well, not only does this hide the file from the user, but also from anti-virus scanners.

Not exactly complex stuff, but it is interesting to see that even commercial companies are relying on “USB hacks” to implement security mechanisms, the downside here however is that it can open the customer’s system up to malware. Sony has promised to release a fix…however it is not ready yet.

How To Make Money & Pwn Concert Fan’s Computers

So, it appears the latest craze in music is to sell live recorded versions of concerts at the concert and share them with others. Can you say “sweet new endpoint security attack vector”. Instead of just scattering your drives around a parking lot, why not bring them to a live concert and sell them to unsuspecting concert goers and then let them do the work for you by spreading the USB virus love around to their friends drives like a bad case of the crabs. Not only do you pwn a whole lot of computers, but you could also make a buck at the same time.

You could actually run an app that streams a recorded mp3, this could then distract the owner of the system while processes run in the background.I might be conducting a little experiment at the next concert I attend to see if I can just get drives to ping back home and let you know the results.

Dateline NBC - iPod Theft

Dateline NBC is featuring a story tonight on iPod theft. GadgetTrak is mentioned as a tracking software solution to track stolen ipods.

Banks and Endpoint Security

As you can guess we get a lot of inquiries regarding the tools on this site and USB security in general. A lot of people ask for help with various projects, ranging from academic papers, security penetration tests and even a few black hats looking for assistance with their packages. However, I think the more interesting ones are those that ask us to help someone create a special package to aid in compromising bank systems or other illegal acts, many using their real names. And to save you the suspense the answer is no, we do not commit, nor do we condone illegal acts. Our goal here is not to help hack systems or assist in committing criminal acts, but instead to help raise awareness of endpoint security threats. The tools on this site are kittens compared to some others that are out there in the wild.

This raises some interesting security questions though. I remember on one occasion while sitting in a bank (a credit union actually) at a desk. In front of me was a desk where a loan officer was filling out some paperwork on his computer. He had his computer on top of his desk with the back facing me…and some lovely shiny USB ports winking at me. The offices all shared printers outside the office, every time he printed something he left the office, walked a bit down the hall and into another cube, sometimes waiting a bit while the printer finished the job. In my right hand were my keys with USB flash drive (never leave home without it) chock full of some particularly tasty tools.

I never actually considered doing it, but the scenario did run through my mind. The particular banker we were dealing with was a manager. He probably has access to only customer records, but probably lots of other systems and tools, if his system were compromised with a backdoor trojan or even data I could slurp off his system in a matter of seconds it could lead to a larger compromise of the network and the bank itself. We have heard of banks being compromised in pen tests using USB drives, simply scatter infected drives around the parking lot and wait for the employees to pick them up and open them on their computers. Human curiosity is the hackers greatest tool.