Seen any neat USB drives laying around recently? Could be a trick.
If you are like me then you could probably relate to the hapless credit union employees gathering up free USB drives and plugging them into their computers.
There are several reasons:
1. Looking for identifying information on whom the drive belongs to (that would be my reason).
2. Curiosity and general snoopiness (I will not admit to that being my reason).
3. Desire to have a free USB drive (I didn’t take the first 4, but I will take the fifth).
Autorun
You can read the comments at the bottom of the article and see the discussion about Autorun, and I would suggest turning that off.
For Microsoft users, you can grab the TweakUI Powertoy provided by Microsoft, or you can just open up “My Computer” and right click on your CD or DVD drive and select it to “Take no action” or “Prompt me each time . . .” under the “autoplay” tab. For USB drives you can plug one in and then do the same thing. For floppy disks you should just not bother using floppy disks.
Click Click Clickity Click
In the story it appears as though Autorun was not the culprit. Rather it was curiously clicking files that cause them to activate. This would also be a threat for Mac computers if the written code was designed for a Mac. If someone is targeting you then they would write it for your system so the feelings of invulnerability in a Windows world would become a liability.
Security Policies
One commenter stated that all employees who fell for it should be fired. While at the time of this post there were some replies against his comment none of them included an important consideration. I have several people working for me doing security. Each one of them has made a bad mistake that compromised the security of the building. My rule is that a mistake is not a firing offense but rather an opportunity for education. Once the problem has been pointed out and discussed then the likelihood of a repeat on the error is minimal. Why fire someone for making a mistake when the person who hire to replace them will make a similar mistake. If God killed us at the moment of our first sin then I wouldn’t be writing this and you wouldn’t be reading it.
Update – June 12: I have been looking at updates to this story and decided to add them here.
1. According to a response from someone who appears to be with the company that did the USB attack, they simply relied on people having the “hide extensions for known file types” option selected. I hate that option. I have it off on my computers, but I support people who use it and so troubleshooting over the phone is difficult when they have no idea what they are clicking. The extension is one more level of protection to help Windows users.
2. There is software that will help protect you from USB issues like this, but the low tech option looks cheaper (grab some glue).
The next USB drive I find laying around at the church will be plugged into a computer. Hey, if one of the ministers loses important information I want to make sure it gets back to them. However, I will be a little more careful.