Posted in The Broadcaster's Desktop Resource
By Barry Mishkind
You may never look at a USB thumb drive or cable the same way after reading this. What was just a precaution that seemed like overkill now may be a warning we need to know. See how this all progressed.
USB devices are so common that most people plug them in without a second thought. But that casual habit carries real risks — from data theft to hardware destruction. Here is why you should think twice before connecting an unknown USB device.
Some years ago, I had the opportunity to visit the office of a fairly well-known Group Chief Engineer. As we talked, I offered him a flash drive with information about a matter about which we had previously spoken and emailed. His response surprised me.
“That will not work. All the USB ports in our computers have been disabled and/or blocked. The only exception is one completely isolated unit in the studio for talk show guests,” he said. “If you want to get that information to me, just send it in an email.”
POLICY OVERKILL?
At first, I was taken aback. Flash drives were the key to the “sneaker network” many of us used all the time.
Getting information from studio to transmitter, for example was much easier when we could put it in our pocket and connect on site. IP and network connections, logins, and directory searches were bypassed in a moment.
But, here, all the USB ports were not only disconnected, many (most?) were actually blocked from accepting the plug at all.
A REASON FOR THE TIME
It only took a few minutes for the group chief to explain why this policy evolved.
A few months ago, the corporate accountant had been there and left with his data on a flash drive. A few weeks later, someone in another city, hundreds of miles away, contacted the company. He had found the flash drive on the street. Looking into it, he found out to whom it belonged.
Fortunately, it appeared the finder was an honest person doing good. But it gave corporate executives a severe scare.
Hence, the policy to prevent a reoccurrence.
A UBIQUITOUS ITEM
Over the years, transmission of information has clearly changed.
For a long time, it was paper. You would go to a convention, for example, and come home with a number of brochures and operating information for equipment in which you had interest – and over the years, cabinets bulged with new and old information.
In the 1980s, a combination of paper and floppy disks were used to bring everything from schematics to pictures to installation tips home for use.
Early 5.25-inch floppies could hold something like 360 kB, the later 3-inch floppies started at 1.44MB of data. Miniscule by today’s standards, but a super asset then. With the right computer, you could enlarge and read every part of a schematic.
Of course, technology moved on. Floppies were replaced with CD ROMs, both full-size and some cute smaller ones, some as rectangles, etc., and now with 40 MB to 700 MB. Whole catalogs, manuals, pictures, schematics, and virtually everything else you could use in a small disc.
Some even came with little “bumps” to prevent scratches when stacked. Now, megabytes of data were easy to provide at a convention without the size and bulk of paper or the limitations (size and fragility) of floppies.
… and then the flood doors of data opened wide!
FLASH DRIVES TAKE OVER
In the early 2000s, the CDs started to give way to flash drives – a bunch of memory on a USB stick.
Although the first ones were often in 125 and 250 MB size, these were cheaper and easier to produce than CDs. And you would find them everywhere. During one trade show, I probably had 10-15 flash drives when I got home. (Still have some of them, as 125 MB is about as handy as those old 5 MB hard drives we used to have in the ‘good ole days.’)
And that brings us back to where we started.
CAN YOU TRUST THE FLASH DRIVE IN YOUR HAND?
While the proximate cause of the policy mentioned earlier came via a lost drive with valuable data on it, you can be sure another group was watching.
The bad actors who play with ransomware, data sales, and worse, were also aware that flash drives were proliferating – and that meant there was a good possibility they could be used to infiltrate and infect networks. USB flash drives are one of the oldest and most reliable vectors for spreading malware. When you plug in an infected drive, malicious software can execute automatically – even before you open a single file. The infamous Stuxnet worm, which targeted Iranian nuclear facilities, spread primarily through USB drives, demonstrating that even air-gapped systems (computers with no Internet connection) are vulnerable.
Now, we are not going to tell you every flash drive is bad. Most manufacturers that use flash drives are careful where they buy them, and have them loaded. But, to be totally honest, there is definitely a slight danger there. A dishonest loader could place malware on the flash drive, even hiding it from casual inspection of the drive. A bad guy could “drop” infected drives on the table of exhibitors at a convention, without them knowing it. And they could even send you a drive for what might seem a valid purpose.
It is no wonder, then, that most data at conventions is now offered through file downloads.
WHY YOU SHOULD WORRY
Recently, a couple of videos by Adam Savage – of Mythbusters fame – have exposed how easy it is to have your system compromised by a flash drive – or even a cell phone charging cable.
In 2014, security researchers revealed a deeply unsettling attack called BadUSB. The basic fact: firmware on USB devices can be reprogrammed. A flash drive can then impersonate a keyboard, a network adapter, or other devices entirely. When you plug in what looks like a harmless thumb drive, it could exploit a technique called autorun exploitation, where code runs the moment a drive is inserted – silently typing commands into your computer as if it were a keyboard – downloading malware, creating backdoor accounts, or exfiltrating files – all faster than you can blink.
There is no reliable way to detect this with standard antivirus software because the attack happens at the hardware level. .
The key point: embedded in the flash drive, cables, even a keyboard, can be malware, a WiFi transmitter, or even more dangerous things.
It is worth your time to take a look at these two relatively short videos. They are a vivid demonstrate what a number of cyber security writers are talking about more and more:
https://www.youtube.com/watch?v=OpcuqePIL7k
https://www.youtube.com/watch?v=cFWBatrHbPk
If you are at an airport, etc, this means that the “charging station” cable could infect your phone or laptop, stealing data – or worse – like USB Killer devices designed to deliver a high-Voltage surge directly into a device’s USB port, instantly and, permanently destroying the motherboard in seconds. (There is no recovery.)
Perhaps the best we can do is provide you with the knowledge that studies have shown a significant number of people will plug in a “found” USB drive without hesitation.
WHAT YOU CAN – AND SHOULD – DO
If you have read this far, you now know more than you ever expected to know about USB Drives, cables, keyboards, etc.
Never plug in unknown drives or cables. If you find one, treat it as hazardous.
Did it come from a friend? Still … be careful!
Buy cables from reputable sources and be suspicious of unusually cheap or gifted cables.
Use data blockers (also called “USB condoms”) if you must charge from public ports — they allow power to flow but block data transfer.
Use endpoint security software that monitors USB activity.
Disable autorun on your operating system.
The convenience of USB is undeniable — but so is its potential for harm. A little skepticism goes a long way. –BDR
