by Martin Quinn (Principal Consultant) 15 May 2013
When performing social engineering tests as part of a penetration test (ethical hack), there are several avenues available which rarely miss the target. The number one attack is sending an email impersonating the targets friend or colleague with an attached document loaded with a backdoor. But the next most successful attack is usually through a USB attack, what I like to call a USB snare attack.
In this attack a strategically placed USB stick (office corridor, or reception area) loaded with a tantalising document, (something along the lines of Executive Salary Figures.pdf or Executive Bonus Structure.xls), is left to lie in wait to snare a victim.
Again this document is loaded with a backdoor or Trojan. Curiosity gets the better of an unsuspecting victim, and its human nature to pick it up and plug it into their local machine and they view the document – game over – the back door is executed and I now have access to their machine (remotely).
So, what is this new twist on this attack? If you have heard of identity thieves stealing mail from your letter box, well it’s like this but in reverse. Imagine an identity thief putting a flyer in your letterbox with a USB stick attached, veiled as a sales gimmick – perhaps a free USB stick with all of the pricing for their bogus plumbing service?
How easy would it be for someone within the household to plug this into a machine at home? Maybe even their corporate laptop? The attacker would only have to play the numbers and drop off these “flyers” in an affluent area and inevitably they would get some hits, snare a victim and game over.
The only way you can defend against human nature is to educate and inform. Intact Security provides security awareness training which uses real world scenarios to educate and inform staff of the threats and risks posed from plugging in simple unknown USB device and the repercussions if it is loaded with malware, backdoors or Trojans.
Contact Intact Security today on (02) 9227 8201) for an bligation free consultation on how we can help you better secure your business
Relax. Your security is Intact
Author: Intact Security
Google
