Contributors - CyberSecurity Malaysia

7.So, is the USB really useful or is it actually aculprit to ICT security?In my opinion, as far as security is concerned, USB is aculprit, because it unquestionably has major securityrisks, as explained in the previous section.The risks are further amplified in the wake of tools thatmake it really easy for anyone to take advantage of peoplewho do not protect their USB ports. For example:a) USB SwitchbladeIt is a piece of software (a community based project)that can be copied to a USB flash drive. When connectedto a USB port on a computer, it will automatically runits "payload" in the background, without your anti-viruseven realising it. The “payload” can be set to copy yourpasswords and documents, and install back doors intoyour computer. It can gather sensitive information fromthe computer such as :-• System information• All network services• A list of ports that are listening• All product keys for Microsoft products on thecomputer• The local password database• The password of any wireless network the computeruses• All network passwords the currently logged on userhas stored on the computer• Internet Explorer®, Messenger, Firefox, and e-mailpasswords• The Local Security Authority (LSA) secrets, whichcontain all service account passwords in clear text• A list of installed patches• A recent browsing historyAll of the information is dumped into a log file onthe flash drive, and the process takes only about 45seconds.b) USB HacksawIt is an evolution of the USB Switchblade. When insertedinto a computer’s USB port, a Trojan is installed on thecomputer, which monitors all USB flash drive insertionevents. It will then e-mail all contents of flash drivesthat are inserted into the computer to a configurableemail account via an encrypted SMTP connection. Aversion has been released that enables “payload” tobe installed onto any drive, enabling infection to othersystems.No doubt, there exist many tools that make anattacker’s work easier, and “payload” will certainly bemore and more damaging over time.CountermeasuresThere are a few countermeasures that can be implementedto tackle the problems introduced by the widespread use ofUSB ports. Some of the countermeasures are listed below:a) Seal all USB ports!Companies can take drastic measures such aspermanently sealing USB ports on all company’scomputers or making sure that purchased computersdon’t come with the ports. This will definitely preventany usage of USB ports.b) Block all removable drivesThe Group Policy in Windows Vista has specific policiesto control the installation of devices. If the driverspecifies that they are removable, installation of newremovable devices can be blocked by the administrator.However, using custom drivers that specify they are notremovable can prevent them from being blocked bythis policy.e-Security | CyberSecurity Malaysia | Volume 21 - (Q4/2009)