Culture and Context:
The weakest link
By Susan Miller
Published on June 9, 2006 - 03:54 AM
Dark reading, the USB way tells the story of a IT security company hired by a credit union to test its network security -- especially in the realm of social engineering. Rather than try to sweet talk their way into a conference room and plug into the network, the testers used thumb drives carrying Trojans that, "when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back to us." The testers then scattered the thumb drives around the grounds and parking lots where credit union employees would find them.
Once I seeded the USB drives, I decided to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desks.
I immediately called my guy that wrote the Trojan and asked if anything was received at his end. Slowly but surely info was being mailed back to him. I would have loved to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, then unknowingly running our piece of software.
After about three days, we figured we had collected enough data. When I started to review our findings, I was amazed at the results. Of the 20 USB drives we planted, 15 were found by employees, and all had been plugged into company computers. The data we obtained helped us to compromise additional systems, and the best part of the whole scheme was its convenience. We never broke a sweat. Everything that needed to happen did, and in a way it was completely transparent to the users, the network, and credit union management.
|
|
 |
|
There are currently no comments to display.
|
|
|
|
To post a comment, you must be a registered user of FCW.com and be logged in. Use one of the forms below to login or register for FREE to FCW.com. To protect your privacy, you can use an alias as your username.
|
|
|
|
