Saturday, June 10, 2006
Are Your Employees Unknowingly Aiding Hackers?
Posted by Ed Hansberry in "OFF-TOPIC" @ 11:00 AM
http://www.darkreading.com/document.asp?doc_id=95556&WT.svl=column1_1
"We recently got hired by a credit union to assess the security of its network. The client asked that we really push hard on the social engineering button. In the past, they'd had problems with employees sharing passwords and giving up information easily. Leveraging our effort in the report was a way to drive the message home to the employees. The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information, as well as bring in potential vulnerabilities such as viruses and Trojans. Several other clients have raised the same concern, yet few have done much to protect themselves from a rogue USB drive plugging into their network. I wanted to see if we could tempt someone into plugging one into their employer's network."
8O Wow! I must admit, it never occurred to the this is a problem. The article isn't clear, but it seems that the program would automatically run. I don't own a USB drive and the few I have used have been solely for giving large files to someone rather than trying to email a 20MB file across the hallway. If USB drives can run programs automatically when inserted into a PC without the users knowledge this is indeed a scary scenario. As one who has a dozen or so SD/MiniSD/CF cards, I can say I'd be tempted to insert a found card to examine the contents. Will PCs also run those when the card slot is built into the machine? It will certainly put me on my guard from now on before slipping a card or USB drive in my machine.
"We recently got hired by a credit union to assess the security of its network. The client asked that we really push hard on the social engineering button. In the past, they'd had problems with employees sharing passwords and giving up information easily. Leveraging our effort in the report was a way to drive the message home to the employees. The client also indicated that USB drives were a concern, since they were an easy way for employees to steal information, as well as bring in potential vulnerabilities such as viruses and Trojans. Several other clients have raised the same concern, yet few have done much to protect themselves from a rogue USB drive plugging into their network. I wanted to see if we could tempt someone into plugging one into their employer's network."
8O Wow! I must admit, it never occurred to the this is a problem. The article isn't clear, but it seems that the program would automatically run. I don't own a USB drive and the few I have used have been solely for giving large files to someone rather than trying to email a 20MB file across the hallway. If USB drives can run programs automatically when inserted into a PC without the users knowledge this is indeed a scary scenario. As one who has a dozen or so SD/MiniSD/CF cards, I can say I'd be tempted to insert a found card to examine the contents. Will PCs also run those when the card slot is built into the machine? It will certainly put me on my guard from now on before slipping a card or USB drive in my machine.
