3 ms·

So I've been studying a foreign language, a language from a country active in state sponsored hacking. Two years ago I had the opportunity to participate in a c

So I've been studying a foreign language, a language from a country active in state sponsored hacking. Two years ago I had the opportunity to participate in a competition at the country's embassy. I had to bring some files on a USB that was to be connected to a computer in the embassy. Competition went well, didn't humiliate myself, and came home with a consolation prize and my USB. Only when I got home, did I realize the USB was dead to me with possibly unwanted packages from the foreign government AND the US government. Took a hammer to the USB and the USB went into the garbage.

zghst 10y ago
Throwing it away in its demolished state could have given away how you reacted to discovering the payload.
sandworm101 10y ago
Next time you get one of these, please put it in an envelope and send it my way. Studying the ins and outs of spyware handed out by an embassy to students would make a great paper, or a great toy for feeding them false information. I'm thinking Moon Nazis set to attack a non-existent school in rural Canada. Lets see how many black vans we can get to drive by a particular webcam.
Iv 10y ago
You should really send that to EFF or Tor or to people at the defcon, CCC or blackhat conference
aymenim 10y ago
May be i am missing something, but how did you figure out the USB is infected, it would be very useful if you could share how to recognize that.
- DanBC 10y ago
  Some people's threat model and risk analysis for USB sticks will include "was used on a computer that wasn't under my control". Since USB sticks are cheap enough to be disposable that's not an unreasonable position to take.
- Gustomaximus 10y ago
  He didn't confirm it was infected. Only there was enough of a chance they wouldn't re-use it and find out.
- rabboRubble 10y ago
  Gustomaximus had it right. I didn't know if the USB drive was infected, and I didn't have an adequate test environment to make a determination either way. I just didn't reconnect that USB again to my systems. Basically what I recognized was the risk from the physical environment. The event was held at reception hall within the embassy intended to host events with industry and government officials. The student competition was just one type of event there, and almost certainly the least important type of event. The hall had backroom audio visual system with a Windows PC connected to a projection screen. From the foreign government perspective, the AV system great for infecting guest attendees’ USBs to be walked back into secured networks when they return home/work. If I designed the AV system, the system would be completely isolated from the internal embassy network. From a US perspective, to gain entry to the internal embassy network I would insert spyware into this system with the hope that someone in the Chinese embassy would reuse a USB between the AV system and the their internal network.

zghst 10y ago

Throwing it away in its demolished state could have given away how you reacted to discovering the payload.

sandworm101 10y ago

Next time you get one of these, please put it in an envelope and send it my way. Studying the ins and outs of spyware handed out by an embassy to students would make a great paper, or a great toy for feeding them false information. I'm thinking Moon Nazis set to attack a non-existent school in rural Canada. Lets see how many black vans we can get to drive by a particular webcam.

Iv 10y ago

You should really send that to EFF or Tor or to people at the defcon, CCC or blackhat conference

aymenim 10y ago

May be i am missing something, but how did you figure out the USB is infected, it would be very useful if you could share how to recognize that.

DanBC 10y ago
Some people's threat model and risk analysis for USB sticks will include "was used on a computer that wasn't under my control". Since USB sticks are cheap enough to be disposable that's not an unreasonable position to take.
Gustomaximus 10y ago
He didn't confirm it was infected. Only there was enough of a chance they wouldn't re-use it and find out.
rabboRubble 10y ago
Gustomaximus had it right. I didn't know if the USB drive was infected, and I didn't have an adequate test environment to make a determination either way. I just didn't reconnect that USB again to my systems. Basically what I recognized was the risk from the physical environment. The event was held at reception hall within the embassy intended to host events with industry and government officials. The student competition was just one type of event there, and almost certainly the least important type of event. The hall had backroom audio visual system with a Windows PC connected to a projection screen. From the foreign government perspective, the AV system great for infecting guest attendees’ USBs to be walked back into secured networks when they return home/work. If I designed the AV system, the system would be completely isolated from the internal embassy network. From a US perspective, to gain entry to the internal embassy network I would insert spyware into this system with the hope that someone in the Chinese embassy would reuse a USB between the AV system and the their internal network.