USB memory sticks pose new dangers
Some new drives can be used to automatically run malware
Computerworld - The ability to use tiny USB memory sticks to download and walk away with relatively large amounts of data has already made the ubiquitous devices a potent security threat in corporate environments. Now, the emergence of USB flash drives that can store and automatically run applications straight off the device could soon make the drives even more of a security headache.
Demonstrating the potential danger, Hak.5, a security-related podcast, earlier this month showed how a USB memory stick can -- in just a few seconds -- be turned into a device capable of automatically installing back doors, retrieving passwords or grabbing software product codes.
Hak.5's "hacking framework" is called USB SwitchBlade and gives hackers a way to automate different payloads running on a USB flash drive, said Darren Kitchen, the Williamsburg, Va.-based co-host of Hak.5.
SwitchBlade takes advantage of a relatively new technology from Redwood City Calif.-based U3 LLC that allows software and applications to be executed directly from USB drives. U3's technology is designed to increase mobility by letting users store their personal desktops -- including their programs, passwords, user preferences and other data -- on a memory stick and then run it on any computer without worrying about whether those applications are installed on that system.
Unlike traditional USB flash drives, U3 memory sticks are self-activating and can auto-run applications when inserted into a system. They're part of an emerging set of "smart" flash drives becoming available from vendors such as Migo Software Inc. and Route 1 Inc.
But the same functions that allow for such mobility also give hackers another way to break into systems, said John Pescatore, an analyst at Gartner Inc. in Stamford, Conn. "Most people think of these things as storage sticks. But U3 is a little computer on a thumb drive" that could be dangerous in the wrong hands, he said.
Hak.5 has developed code that can replace parts of the original content on a U3 flash drive with a payload for "instantly" retrieving Windows password hashes when a memory stick is inserted into a computer, Kitchen said. Also available within the Hak.5 community are payloads that in seconds can retrieve AOL Instant Messenger and MSN passwords, browser histories and software products keys. Payloads can also be used to install back doors and Trojan horse programs on computers.
None of the hacker tools used in SwitchBlade are new. And security analysts have for some time now been warning that USB-connected devices such as flash drives and iPods can be used to sneak viruses and other malware into corporate environments,
But the fact that such tools can now be run automatically on a self-activating flash drive makes them far more accessible and easier to exploit, said Ken Westin, a security analyst at Centennial Software Ltd. a Swindon, England-based IT asset management company. "The combination is creating a perfect storm," he said.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Enhancing Application Protection and Recovery with a Modern Approach to Snapshot Management This CommVault Business Value and Technology White Paper explains how Simpana IntelliSnap® Recovery Manager can make your application recovery fast and reliable.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts