Social Engineering, the USB Way

June 8th, 2006

WE RECOMMEND

A security firm hired by managers at a Credit Union to find gaps in the security of their network chose an interesting method to test. By dropping USB drives around where employees congregate, they were able to gain access to the company network when employees plugged the drives in.

The article was placed on Digg and has over 100 comments so far. A quick read of the comments has raised some valid questions concerning the methods used to obtain the data. When the employees plugged the drives in and executed files (by means that were not mentioned) data was mined from the computers including password information to the local system and other computers on the network. The part that gets dicey is that the information was then emailed back to the security companies office.

I don't know about the banking industry, but in the health care industry transmitting non-secured data that could be of personal nature of patients can get a company sued and fined. Whether or not the security company encrypted the data was not mentioned. I know I would not want my bank hiring a security company that sent passwords that could allow someone to access my personal information across the Internet.

Filed under USB Flash Drives

About Everything USB

USB technology is the de facto connectivity standard for PC peripherals & consumer electronics; it has evolved from USB 1.1 to USB 2.0, Wireless USB and USB 3.0. Everything USB takes an in-depth look at these products and other offbeat USB gadgets, and brings you information and reviews needed for you to make a purchase decision. Welcome and enjoy your stay.

If you would like to contact us with a tip or comment, please write to: newstips@everythingusb.com