10 ms·

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend

If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.

walrus01 8y ago
previously, the "pwn plug": https://www.google.com/search?client=ubuntu&channel=fs&q=pwnplug&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=pwn...
scroot 8y ago
This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.
- cobbzilla 8y ago
  No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.
  - lachlan-sneff 8y ago
    Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.
    - haimez 8y ago
      It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.
      - lachlan-sneff 8y ago
        I do remember reading about that. It exploited a bug in windows to load an executable when the usb was plugged in. It then installed a usermode rootkit and hid its files.
      - scroot 8y ago
        I likely got the "parking lot" impression from Alex Gibney's Zero Days, but it's been a few years since that came out.
    - westpfelia 8y ago
      It probably got in via usb in the parking lot, but there hasn't been an official statement that I know of. It was confirmed that the hack into the DHS intranet was done by USB stick in the parking lot.
  - Anarch157a 8y ago
    Natanz was air gapped. Stuxnet penetrated the facility on a phisical device, once inside it spread over the LAN. The Widespread distribution of it on the open Internet was because of a bug in the code.
    - Zimahl 8y ago
      > The Widespread distribution of it on the open Internet was because of a bug in the code. It's presumed that the Israelis got a little bit greedy and, even though it was doing it's job, tried to make the virus do it's job a little better. They made it more virulent which made it spread outside of the systems it was only targeted to spread to.
- tacon 8y ago
  My understanding is that stuxnet got out of Natanz, by mistake. The world was never supposed to see that code. It was planted inside the Natanz secure perimeter.
  - mrfredward 8y ago
    Well, certain versions of stuxnet were sent to Natanz suppliers first, and I believe the infection made it out into the world from one of these suppliers, not Natanz itself.
- usrusr 8y ago
  If you lack physical access to the parking lot, the classy way to launch your cyber attack is by miniature trebuchet.
nixpulvis 8y ago
This is why, as much as I hate it most of the time, it's a good idea not to have your devs with access to your network setup. If your a small shop, limit the access as much as reasonably possible.
- Falkon1313 8y ago
  Emphasis on reasonable. If you limit workers' access too much for them to do their jobs they will find creative workarounds. Some of those can be more dangerous than just giving them the access that they need in a way that you control. Examples being if you make it so that the only way developers can debug a system is by adding in backdoors, or if you lock down the network so much that they need to use an unsecured public network to do their work. I've seen those things happen. Developers and IT need to work together, not be adversaries.
  - nixpulvis 8y ago
    > Developers and IT need to work together, not be adversaries. This.
Merad 8y ago
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
- ravenstine 8y ago
  That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.
  - goldenCeasar 8y ago
    I would guess that some people may try more than one, or if there are lots of people and few thumbs given time someone more gullible will try them.
  - a3n 8y ago
    Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.
    - ghaff 8y ago
      Companies routinely distribute software/presentations/etc. on USB drives. I suppose it's poor security hygiene these days but it's still routine.
    - TheOtherHobbes 8y ago
      Especially when stupid is an observable attribute in the industry. Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent. We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's default culture is to think of security as an esoteric side issue, and not a non-negotiable critical feature in all IT systems.

walrus01 8y ago

previously, the "pwn plug": https://www.google.com/search?client=ubuntu&channel=fs&q=pwnplug&ie=utf-8&oe=utf-8 https://www.google.com/search?client=ubuntu&channel=fs&q=pwn...

scroot 8y ago

This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.

cobbzilla 8y ago
No, iirc stuxnet spread itself without anyone physically leaving a USB stick anywhere. On a system infected via the network, it would try to infect any USB drives connected to the system.
- lachlan-sneff 8y ago
  Stuxnet is fascinating. Still, as far as I can tell, the most complex, interesting malware ever found in the wild. I believe it's unclear how stuxnet found its way into the enrichment facilities.
  - haimez 8y ago
    It did contain a USB device exploit delivering a dropper with a completely separate payload specifically targeted at the Natanz facility. A compromised USB device picked up in the parking lot would do the trick, but there are certainly other ways to get something through the front door and that information is unlikely to be public knowledge any time soon.
    - lachlan-sneff 8y ago
      I do remember reading about that. It exploited a bug in windows to load an executable when the usb was plugged in. It then installed a usermode rootkit and hid its files.
    - scroot 8y ago
      I likely got the "parking lot" impression from Alex Gibney's Zero Days, but it's been a few years since that came out.
  - westpfelia 8y ago
    It probably got in via usb in the parking lot, but there hasn't been an official statement that I know of. It was confirmed that the hack into the DHS intranet was done by USB stick in the parking lot.
- Anarch157a 8y ago
  Natanz was air gapped. Stuxnet penetrated the facility on a phisical device, once inside it spread over the LAN. The Widespread distribution of it on the open Internet was because of a bug in the code.
  - Zimahl 8y ago
    > The Widespread distribution of it on the open Internet was because of a bug in the code. It's presumed that the Israelis got a little bit greedy and, even though it was doing it's job, tried to make the virus do it's job a little better. They made it more virulent which made it spread outside of the systems it was only targeted to spread to.
tacon 8y ago
My understanding is that stuxnet got out of Natanz, by mistake. The world was never supposed to see that code. It was planted inside the Natanz secure perimeter.
- mrfredward 8y ago
  Well, certain versions of stuxnet were sent to Natanz suppliers first, and I believe the infection made it out into the world from one of these suppliers, not Natanz itself.
usrusr 8y ago
If you lack physical access to the parking lot, the classy way to launch your cyber attack is by miniature trebuchet.

nixpulvis 8y ago

This is why, as much as I hate it most of the time, it's a good idea not to have your devs with access to your network setup. If your a small shop, limit the access as much as reasonably possible.

Falkon1313 8y ago
Emphasis on reasonable. If you limit workers' access too much for them to do their jobs they will find creative workarounds. Some of those can be more dangerous than just giving them the access that they need in a way that you control. Examples being if you make it so that the only way developers can debug a system is by adding in backdoors, or if you lock down the network so much that they need to use an unsecured public network to do their work. I've seen those things happen. Developers and IT need to work together, not be adversaries.
- nixpulvis 8y ago
  > Developers and IT need to work together, not be adversaries. This.

Merad 8y ago

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

ravenstine 8y ago
That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.
- goldenCeasar 8y ago
  I would guess that some people may try more than one, or if there are lots of people and few thumbs given time someone more gullible will try them.
- a3n 8y ago
  Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.
  - ghaff 8y ago
    Companies routinely distribute software/presentations/etc. on USB drives. I suppose it's poor security hygiene these days but it's still routine.
  - TheOtherHobbes 8y ago
    Especially when stupid is an observable attribute in the industry. Time and time again the technology industry has failed to consider security as a serious issue, never mind develop systems that are robust and transparent. We don't have botnets, booby-trapped mail attachments, script-hackable servers, USB drives that can carry a viral payload, and all the rest because users are stupid, but because the industry's default culture is to think of security as an esoteric side issue, and not a non-negotiable critical feature in all IT systems.