Seven Deadliest USB Attacks

Brian Anderson, Barbara Anderson

• Publisher: Syngress
• Year: 2010
• Print ISBN: 9781597495530
• eBook ISBN: 9781597495547
• Topic: Business
• Subtopic: Information Management
• Index: Business

Seven Deadliest USB Attacks provides a comprehensive view of the most serious types of Universal Serial Bus (USB) attacks. While the book focuses on Windows systems, Mac, Linux, and UNIX systems are equally susceptible to similar attacks. If you need to keep up with the latest hacks, attacks, and exploits effecting USB technology, then this book is for you. This book pinpoints the most dangerous hacks and exploits specific to USB, laying out the anatomy of these attacks including how to make your system more secure. You will discover the best ways to defend against these vicious hacks with step-by-step instruction and learn techniques to make your computer and network impenetrable. The attacks outlined in this book are intended for individuals with moderate Microsoft Windows proficiency. The book provides the tools, tricks, and detailed instructions necessary to reconstruct and mitigate these activities while peering into the risks and future aspects surrounding the respective technologies. There are seven chapters that cover the following: USB Hacksaw; the USB Switchblade; viruses and malicious codes; USB-based heap overflow; the evolution of forensics in computer security; pod slurping; and the human element of security, including the risks, rewards, and controversy surrounding social-engineering engagements. This book was written to target a vast audience including students, technical staff, business leaders, or anyone seeking to understand fully the removable-media risk for Windows systems. It will be a valuable resource for information security professionals of all levels, as well as web application developers and recreational hackers. - Knowledge is power, find out about the most dominant attacks currently waging war on computers and networks globally - Discover the best ways to defend against these vicious attacks; step-by-step instruction shows you how - Institute countermeasures, don't be caught defenseless again, and learn techniques to make your computer and network impenetrable

CHAPTER

1

USB Hacksaw

INFORMATION IN THIS CHAPTER

• Sharing Away Your Future

• Anatomy of the Attack

• What is the Big Deal?

• Evolution of the Portable Platform

• Defending against This Attack

The Universal Serial Bus (USB) Hacksaw was devised by a posse of self-proclaimed “IT ninjas” acting on behalf of the Hak.5 organization. Hak.5 is a wiki Web community which produces monthly videos, forums, and articles demonstrating various types of hacks for almost anything electronic you can imagine.^A The Hacksaw is one mutation of many USB-related hacks that have been released on this site. Another clever tool created by this community will be covered in Chapter 2, “USB Switchblade.”

The original Hacksaw version was designed to use any configurable flash drive that can be customized with a compact disc, read-only memory (CD-ROM) partition. A SanDisk U3-enabled flash drive with a customized version of the LaunchPad software is preferred and will be discussed in this chapter. By leveraging the unique features of the U3 flash drives, it has the capability to install silently upon insertion. The drive will then act in a Trojan-like fashion as it copies the payload to an inconspicuous location, typically by way of an autorun mechanism enabled by the U3 CD-ROM emulation. The payload will then reside on the host by executing an initialization script each time the system is restarted. Once this is accomplished, the program monitors the system for external drives, and when detected, it will compress, split, and replicate all data to a mail account of the attacker in a stealthy manner.

SHARING AWAY YOUR FUTURE

Albert was a junior executive for a major oil firm, who was having a typical week. He had been juggling flaming torches, which were passed his way from all directions. He kept every single torch in the air and managed to extinguish all but one, which happened to be the most critical. This last torch, which was soaked in napalm, was a presentation that he needed to provide to the senior management and shareholders. The research material had been compiled by the latest groundbreaking technological enhancements in the field. His presentation was to highlight this technology, its current state, and where they needed to drill. The company providing the technology had isolated 10 regions of significant interest deemed to have the most potential for new oil, and he needed funding. He was slated to give this presentation the following week after attending an executive management seminar out of town on Monday through Wednesday.

After an exhausting Friday evening at work, Albert decided he would try and finish up the presentation and his other remaining work on the flight and during downtime while he attended the conference. He saved his work and proceeded to shut down for the night but remembered a Windows blue screen that had occurred on his computer earlier in the day. He didn’t have time to deal with technical support on this issue, especially since they had just been outsourced. Albert also didn’t want to risk losing all of his acrobatic accomplishments earned this week, so he decided to use his thumb drive as a backup just in case.

The backup of his presentation and related material to the thumb drive was almost complete when an error popped up, indicating he was out of space. He recalled that he had copied his entire Outlook PST file on there earlier in the day when he first received the “blue screen of death.” Fortunately, he had several personal items on the drive, which could be removed to clear up some room. His resume, QuickBooks backup, and fishing photos were just a few of the personal items he had been storing here. After clearing off some of the high-resolution pictures, he was finally able to save his presentation data.

Monday, we find Albert checking into his hotel after a long flight. He has been able to get some work done on his presentation and feels great. He’s now using the version on his flash drive as the active copy just in case something happens, “such brilliance is hard to come by,” he thinks to himself. After the first day of the conference, he returns to the hotel eagerly to work on his precious presentation. He opens PowerPoint and begins sifting through the data when suddenly everything goes blue. Repeated reboot attempts prove futile and produce the same results. The rage begins to boil, and a bead of sweat drips from his brow. He picks up his computer but then suddenly stops, realizing a fling across the room will do nothing good. A visit to the hotel bar to blow off some steam seems like a more indulging approach.

Two scotches into his pity party, and he recalls a message that was left for him at the front desk. On the way to the lobby area, he passes a room with a printer and a few Windows computers available for guest usage. Suddenly, brilliance strikes again! Albert remembers that he has the current version saved to his thumb drive just in case something like this were to occur. He decides to stop by the bar for one more drink to celebrate this magnificent accomplishment!

About a month prior to Albert’s arriving at the hotel, a college computer guru paid a visit to the same location. She was hired by an international crime syndicate to strategically deploy different attacks at predetermined locations. One of the programs she injected onto all computers in the hotel was the USB Hacksaw.

Albert heads to the room to grab his thumb drive and then goes down to the lobby in the printing and computer area. He slaps his drive into the computer, and a few clicks later – bingo! He’s working toward completing his presentation. What he doesn’t realize is that a malicious program is currently downloading all data from his drive and packaging it up for e-mail delivery to some newfound international friends whom he has never met. Albert is not only losing valuable corporate data but also his resume, QuickBooks backup, and other personal data, which are enough to damage his identity, bank accounts, and his personal well-being.

Not too far from Albert’s hotel, a team of university IT students were diligently finishing up a major implementation. A recent project called for kiosks to be strategically placed all over the campus for students and faculties. These kiosks allow students to register, modify classes, or check their grades. They could even alter personal information including methods of payment for respective services offered by the university.

To accomplish all of this, they were required to carry a USB drive that contained a certificate and account information used for validation onto the kiosk systems. An additional layer of protection was in place that forced the users to have a six-digit secret code. The deployment was a huge success with good feedback from users and management, and the team could envision accolades in the near future.

A week later, a few students started receiving alerts from their financial institutions. All of these were regarding suspicious usage at questionable locations on the Internet. This could be easily blamed on their own computer usage or any number of other possibilities. Soon, several more students came forward with similar issues. Was this a virus running rampant around the campus? Had their firewalls been penetrated and their databases owned? Was this an insider?

Questions abounded, and answers were nowhere to be found. The kiosks were the most recent major introduction onto their infrastructure in quite some time. They did provide access to the universities’ backend systems and were strung all over the campus, some even on wireless. Could there be a rogue wireless router on their network or packet sniffers involved? There were so many potential culprits and so little time and resources to get the job done right.

The kiosks had some additional security measures in place aside from the typical software solutions. The devices were reasonably secure from a physical standpoint, having only the USB port exposed in the front. Access to the keyboard and other ports would be a difficult task without alerting someone to what had been done. Each and every kiosk was completely rebuilt every night by an automated process so to ensure nothing would remain resident if anything was able to infiltrate the system. It seemed nearly impossible for an intruder to use one of the kiosks as an attackvector.

Rigorous checks were made by each team responsible for their particular sector of the IT department. Each had their own opinion on how and where money and resources should be spent. After spinning their wheels for hours with debate, they finally decided to give network access control (NAC) a shot because it could cast the widest net.

The kiosk team took matters into their own hands. They knew how long it would take to get the intrusion detection system/intrusion prevention system (IDS/IPS) project moving, and two of their teammates had been affected by fraud incidents, which they attributed to a leak somewhere. Finally, they decided to update their daily builds with some diagnostic programs, which could monitor the level of detail this would require. Scripts would be used temporarily to get the logs back to a central location for review and analysis.

The first build was deployed that next morning and was immediately a tremendous success. Their log intervals were set for every hour and accounted for peak times on system and network resources. They had their first replication of log data from the machines, but nothing seemed out of place. Sur...

Table of contents

• Cover
• Copyright
• About the Authors
• Introduction
• Chapter 1 USB Hacksaw
• Chapter 2 USB Switchblade
• Chapter 3 USB-Based Virus/Malicious Code Launch
• Chapter 4 USB Device Overflow
• Chapter 5 RAM Dump
• Chapter 6 Pod Slurping
• Chapter 7 Social Engineering and USB Come together for a Brutal Attack
• Index