4 ms·

Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail

Supposedly, the "drop USB drives in the parking lot" works pretty well to get around air-gapped systems. As well as mailing USB drives to the receptionist, mail room, etc. Also, this thing was running as a local admin on a domain controller. So either the DC's weren't patched or some zero-days were used. Or perhaps an inside job.

peterwwillis 10y ago
Not supposedly. Every pen testing company worth their salt uses dropped USB drives and have a very high success rate, because humans suck at security. The malware infects non-gapped systems until it infects a file which is being copied to a gapped system.
PeanutNore 10y ago
Well it worked on Mr Robot at least
montecarl 10y ago
The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though. [1] http://cdsetrain.dtic.mil/cybersecurity/ http://cdsetrain.dtic.mil/cybersecurity/
superuser2 10y ago
> the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.
- drzaiusapelord 10y ago
  Its trivial to do with WSUS and off-line updates. But yeah, if its a shit run environment, it will get owned by someone eventually.
  - paulfurtado 10y ago
    An air-gapped set of servers performing updates from a non-air-gapped WSUS server are not air-gapped servers at all. If the WSUS server were also air-gapped, then you're in the business of manually downloading each update, verifying it, and copying it to over to the air-gapped WSUS server offline. Microsoft's Windows Update servers have also been compromised in the past. Depending on the level of security you're operating at, taking new windows updates on your air-gapped systems may require having someone decompile and review each update. In general, being air-gapped prevents infinitely more exploits than windows updates could ever possibly cure; that is, until one of your admins uses his admin privileges to disable the USB port restrictions for 5 minutes that one time to copy that one file quickly so he can go home for the day. For this, there are epoxied USB ports.
noinsight 10y ago
> running as a local admin on a domain controller To nitpick, domain controllers don't have local accounts at all. It was probably running as SYSTEM which equates to the domain controller's computer account for AD.

peterwwillis 10y ago

Not supposedly. Every pen testing company worth their salt uses dropped USB drives and have a very high success rate, because humans suck at security. The malware infects non-gapped systems until it infects a file which is being copied to a gapped system.

PeanutNore 10y ago

Well it worked on Mr Robot at least

montecarl 10y ago

The DoD Cybersecurity Awareness training[1] covers this and a number of other physical attacks. I'm not sure how serious anyone takes it though. [1] http://cdsetrain.dtic.mil/cybersecurity/ http://cdsetrain.dtic.mil/cybersecurity/

superuser2 10y ago

> the DC's weren't patched As I understand it, airgapped systems are not in the habit of bringing software updates across the airgap, so unpatched everything is likely.

drzaiusapelord 10y ago
Its trivial to do with WSUS and off-line updates. But yeah, if its a shit run environment, it will get owned by someone eventually.
- paulfurtado 10y ago
  An air-gapped set of servers performing updates from a non-air-gapped WSUS server are not air-gapped servers at all. If the WSUS server were also air-gapped, then you're in the business of manually downloading each update, verifying it, and copying it to over to the air-gapped WSUS server offline. Microsoft's Windows Update servers have also been compromised in the past. Depending on the level of security you're operating at, taking new windows updates on your air-gapped systems may require having someone decompile and review each update. In general, being air-gapped prevents infinitely more exploits than windows updates could ever possibly cure; that is, until one of your admins uses his admin privileges to disable the USB port restrictions for 5 minutes that one time to copy that one file quickly so he can go home for the day. For this, there are epoxied USB ports.

noinsight 10y ago

> running as a local admin on a domain controller To nitpick, domain controllers don't have local accounts at all. It was probably running as SYSTEM which equates to the domain controller's computer account for AD.