Contributors - CyberSecurity Malaysia

6.USB PortA culprit to ICT Security?IntroductionYou just get back from a holiday trip. It was a welldeservedholiday after a long year of hard work. Youimmediately plug-in your friend’s flash drive whichcontains all the memorable pictures taken during theholiday into your laptop’s USB port. After spending sometime looking at the photos, you then start to work on yournew assignment, which involves accessing and handlingcorporate confidential data. You use the same laptopto login to your online banking website and performsome transactions. A few days later, guess what? Yourbank account is broken into. Someone got hold of youronline banking user ID and password, and transferredquite a large amount of money for online shopping.It turns out that a few of your friends were also facingthe same situation. Can you guess what the cause of theproblem was? Yes, somebody had put a malicious programin the flash drive that was happily passed around amongyour circle of friends who went for the trip. The maliciousprogram had infected the laptop through the USB port.Nowadays, by default, every computer comes with one ormore USB ports. It is hard to find one that does not evenhave one USB port.What is a USB?A Universal Serial Bus (USB) is a serial bus standard usedto connect devices to a host computer. It is intended toreplace the many varieties of serial and parallel ports. Asingle USB port can be used to connect up to 127 peripheraldevices at one time, such as mice, modems, keyboards,flash drives, external hard disks, etc. A USB also supportsPlug-and-Play installation and hot plugging.History of the USB:• USB 1.0 Specification – released in January 1996.Itsupports data transfer rates of 12 Mbps.• USB 2.0 Specification – released on April 27, 2000. Itsupports data rates up to 480 Mbps (Hi-Speed USB).• USB 3.0 Specification – released on November 12, 2008.It supports data transfer rates of 4 Gbps.The USB was created to end some problems that peoplewere facing back then (Ref [2]) such as:i. Modems, some printers, and many other devices likePalm Pilots and digital cameras use the serial port.Computers usually have two serial ports at most.ii. Printers are usually connected to parallel ports, andmost of the time we can find only one parallel port ineach computer.iii. For faster connections, some devices use cards, butcard slots inside a computer’s casing are limited and inmost cases, installation of software for the cards is noteasy.Why is it so popular?The Universal Serial Bus is very popular because it is veryconvenient, partly because of the Plug-and-Play and hotpluggingsupport. It gives you a single, standardised, easyto-useway to connect devices to a computer. Compared toconnecting devices via serial, parallel ports, using a USB ismuch, much simpler.Besides the convenience of connecting the devices toa computer, USB devices are also very affordable. Thisfurther contributes to the wide popularity of USB ports.ProblemsIf it is so convenient, so easy to use, and affordable to theuser, then what is the problem? Actually, that is where theproblem lies.A USB facilitates the use of mass storage devices (flashdrives, external hard disks, memory sticks etc), and wetend to connect these devices to our laptop or computer.What if the devices contained viruses, Trojans or othermalicious programs? It could lead to risks like data theft,data loss, and interruption of services, while introducinga backdoor into an enterprise’s network. The scenariomentioned at the beginning of this article is just oneexample; other threats like giving backdoor access into acorporate network could lead to other serious damages.There are a lot of real case scenarios, one of them being the"downadup" worm (also known as "Conficker" and "Kido").As reported in “Windows virus infects 9m computers” (Ref[10]), it exploits vulnerabilities in unpatched corporatenetworks and spreads via the Internet through infectedUSB memory sticks. The malware outbreak was consideredone of the worst malware outbreaks in the past five yearsbased on the number of infected machines.