5 ms·

From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. Af

by nickff 6y ago

From memory, I recall the FBI did a study, and found that half of their employees would plug in a USB drive that they found on the ground in the parking lot. After training, that number was reduced to a quarter. If a security-focused government police agency is so vulnerable, it is unreasonable to expect perfection from a (less paranoid) company.

qppo 6y ago
Isn't that how they got Stuxnet into the Iranian nuclear facilities?
- boogies 6y ago
  Something like that (USB exploit of Windows zero days, breaching an airgap). (Edit: though not by leaving flash drives outside of the facilities, by infecting some with a virus that spread from Windows PC to Windows PC around the world.)
Swizec 6y ago
I remember an article a few years ago saying that large % of office employees would trade their password for chocolate. Ah yes here we go, large scale study, 43% of participants gave away their password when bribed with a chocolate bar. People just don't realize how valuable passwords are. https://www.sciencedaily.com/releases/2016/05/160512085123.htm https://www.sciencedaily.com/releases/2016/05/160512085123.h...
- davinic 6y ago
  > If the chocolate was only given out afterwards, 29.8 per cent of participants revealed their passwords. Nearly 30% of people just gave out their password and didn't even know they were getting chocolate! They gave it away for literally nothing.
- manquer 6y ago
  the study says 29% gave the password without chocolate as well . Some where given chocolate before and after , nowhere it says chocolate was offered as payment for sharing the password. Small gifts could have been inducement to establish relationship and trust not the same as a bribe as you characterises it I find it hard to believe 25 /40 % plus people readily share their password to total strangers , without knowing more details it seems unrealistic Social engineering is still a problem but am not sure bribes are the real concern . And to insinuate the cost of bribing is as low as candy for significant chunk of the population is just wrong
  - transitionnel 6y ago
    What kind of mindset would lead to this behavior?? Maybe it doesn't matter. It feels -to me- like simply being exposed to people who say things like: "What?-- no, that's not good" while remaining professional, respectful, and humorous, is a vaccine against not wanting to seem jerky, yet staying secure.
    - manquer 6y ago
      Perhaps it did not come out as I hoped, if it was offensive I appolgize The premise that integrity of most people is bribed by few bars of candy was offensive to me I hope it is to you as well. The sensationalist headline basically claimed that, the abstract was a very different statement. I am tired of studies that are constantly being cited these days: readers, journalists and even the principals invariably sensationalize the headlines. It is a losing battle to get anyone to critically analyse information presented to them, sooner or later you are going to snap. Whether it is alternate medicine, creationism, or conspiracy theories there is a real damage out there everyday , few people ( Jon Stewart? ) are articulate despite being frustrated and are able to civil engage in discussion. Even if the study actually claimed what the headline said, the bar to peer reviewed respected research in much of psychology and social sciences seems so low that just getting some correlation between two parameters is good enough. Raw data is rarely shared, and statistical methods used are superficially understood and discussed, half the analysis's are just putting data into a tool like SPSS with the whatever defaults IBM puts in these days. There is not much scope for replication of a finding, a core principle of the scientific method.
slg 6y ago
Then you need processes in place to make sure a single person being careless cant do this much damage. There are low tech solutions that would greatly improve security[1], however the overhead this introduces is hard to justify in a world in which these breaches aren't that damaging to a company. We need to change incentives for companies by either mandating these security practices or implementing harmful repercussions for choosing a less secure approach. [1] - https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule
- nickff 6y ago
  I agree that better security practices are advisable, but you're victim-blaming. Twitter wasn't 'asking for it', and neither were the individuals who lost bitcoins; the 'hackers' intentionally perpetrated deceptions, misrepresentations, and fraud against both Twitter and the general public. If you compare what these three did to a white-collar crime, the dollar amount was small, but the behavior was egregious.
  - rschneid 6y ago
    Twitter is a platform used widely by some of the most powerful people in the world and in the US government. As a result, there is plenty of justification and precedent for said gov't to regulate their security practices and procedures. To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http. Now, I don't think the government is prepared to do this proactively and effectively, but the idea of a telco that advertises resilience to hacks (whether through social engineering or technical incompetence) sounds like it would be quite appealing to a growing segment of the connected world and whatever such promises that find success in the marketplace might be used to inform legislation or regulation, eventually...
    - saghm 6y ago
      > To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).
enraged_camel 6y ago
>>If a security-focused government police agency is so vulnerable I think calling FBI "security-focused" is a bit too generous. They are essentially glorified police detectives, with greater authority and jurisdiction. I don't believe the average FBI agent is particularly competent, in terms of technical (i.e. computer) skill or knowledge.
- nickff 6y ago
  The FBI literally performs the background checks for security clearances. Like any other organization it has less security focused divisions, but insofar as any organization is security focused, the FBI is.
  - enraged_camel 6y ago
    Like I said, none of this translates to computer literacy.
LeifCarrotson 6y ago
I would be surprised if the average FBI agent was less likely to plug in an unknown USB drive than the average Twitter engineer.
- Nuzzerino 6y ago
  What makes you say that?
  - theelous3 6y ago
    Software engineers are much more aware and focused on the problem of technical attacks. An fbi agent has no innate reason to distrust usb sticks. After all, they're just for "moving files" or whatever other basic tasks they use them for.
    - TheSpiceIsLife 6y ago
      > Software engineers are much more aware and focused on the problem of technical attacks. We’re constantly presented with evidence to the contrary.
      - mewpmewp2 6y ago
        The point was "less likely", not that all engineers would not do that.
    - mejtro 6y ago
      With a corrupted USB drive, the FBI Agent may as well be drawring bleedn ded
gav 6y ago
Security training improves security but it doesn't get close to stopping 100% of attacks. I know it's obvious, but it feels like it's only obvious to those that think about security. It's the same reason that putting your developers through a yearly OWASP Top 10 secure coding course isn't going to get you to 100% secure code. Locking down systems seems draconian, but it's the only way: - Disabling USB storage - Moving away from passwords to hardware authentication - Strong controls on internet access - Stop incoming calls from reaching most employees. Better: take away phones altogether And so on.
- manquer 6y ago
  in a remote only or remote first working environment, many of these policies are not feasible , ultimately employees have to be able work somewhat productively . Such clean room requirements could perhaps work when the threat model include nation state actors or your are handling sensitive financial applications. Most companies are not defence contractors or banks the security levels you propose won’t be worth the cost to a typical internet tech company .
- lobster45 6y ago
  Anytime there are humans involved, there is no way to 100% secure it
Veserv 6y ago
Except this is not expecting perfection, it is expecting a level of security that can prevent children, literal children, from walking right through it. Which would not even be a problem except for the fact that this is far, far less than what Twitter has led their average user and stockholder to believe. To illustrate my point, if Twitter told the truth in big bold print at the top of every page so every user knows: "Determined teenagers can take over your account at any time." do you think this might outrage their users or harm their stock price? Did Twitter at any point say anything that might indicate that this is the truth of the matter and that would not be easily misconstrued by users? The evidence indicates yes, they would be outraged, and no, they at no point ever said anything that would lead anybody to believe that this was possible and hilariously easy. So, it hardly matters that maybe they or anybody else (say the FBI) can not provide a high level of security, what matters is that they committed material fraud in egregiously misrepresenting their product security to their users and stockholders.
- ISL 6y ago
  One underestimates the capability of determined teenagers at one's peril.
  - TheSpiceIsLife 6y ago
    And many of them live in what amounts to a serviced apartment above a restaurant. Idle hands.
- davinic 6y ago
  Exactly. At least one of these kids used their personal gmail account on the hacking forum. These are not advanced hackers.
  - ta17711771 6y ago
    They've done more than you, and majority of others, though.
    - 6y ago
cosmodisk 6y ago
Someone successfully gained access to colleague's email account using a phishing technique. I Inform the senior management team not to open any emails just to get a message 2 min later that one of them entered email credentials after opening a link...
hguant 6y ago
I wonder what sort of machine those folks were plugging it into? If it's their general purpose work issued machine, shame on them, but I can't believe the FBI doesn't have a high and low side networks. How many plugged into the high side? How many plugged into the "this is my email and timecard" computer? I have a Chromebook running arch[0] that has a borked network adapter than I use to plug weird things into/use as an airgapped box I can reset in about 5 minutes. I'd have no qualms about plugging anything into that [0] BTW I run Arch
- theelous3 6y ago
  Nice I run arch too. I like the way it is, and isn't. As an aside to that important point, it seems like the solution here is to just remove all random device access points and drives before giving a system to some luddite with no security awareness.
varenc 6y ago
An acquaintance of mine worked at the NSA and they also deal with this. He said during his first week he made the mistake of putting a CD-ROM with some official training materials into his work system. Within 10 minute two people showed up to stop him and investigate what was going on with his computer. It was fine in the end but he was seriously reprimanded by his boss. When you can’t trust users, the answer isn’t just to give up! It’s to acknowledge their fallibility and create a system that doesn’t rely on 100% compliance. In this case that means having software that instantly reports when any external media is connected.
- i1856511 6y ago
  This seems silly. Network admins can determine he inserted a CD and respond immediately in person - but nonetheless issue PCs with CD-ROMs and the ability to interact with removable media?
  - stqism 6y ago
    If it’s anything like the DoD does, the reason USB ports and CD drives aren’t physically disabled is because sometimes using authorized devices and media is required to perform your official duties.
- solipsism 6y ago
  And the same acquaintance described those NSA security protocols to you, who are now talking about them in a public forum. If your acquaintance actually did work for the NSA (God help us), he probably shouldn't have.
hindsightbias 6y ago
A criminal mastermind would leave a stick behind to infect those investigating.
sashwatp 6y ago
This reminds me of Mr.Robot. :)
devin 6y ago
1. When was this study conducted? I remember a story like this from somewhere around 2008. A lot has changed since then. In fact, I recall that during my onboarding at a medium size tech company, it was an explicit part of the company's security training curriculum. 2. I think you may actually have it backwards. I would imagine the engineering group at Twitter (the people who have important credentials) is in some ways more paranoid, or at least more technically savvy and therefore more aware than many of the people at the FBI.
- ketzu 6y ago
  Comparatively, Cern does a phishing study from time to time [1] and the campaigns are in line with current expectations: People fall for phising, and security training has only a short term effect on phising. Unfortunately I can't find the real results right now. We once had a bachelors thesis comparing the results over multiple years, and the results were mostly stable. (Years are mid 2010s). [1] https://home.cern/news/news/computing/computer-security-cern-has-been-phished-again https://home.cern/news/news/computing/computer-security-cern...
agumonkey 6y ago
Anecdote: working at a court room I was bemused by the security talks about usb keys, yet the OS setup still allows usb driver installs automatically (granted their local presence). I know because I brought a keyboard to replace the busted one they had in-house and windows gladly set up everything plug`n`play. I wonder if OSes have actual rules for this, and if there are secure corporate usb keys
- ozim 6y ago
  You know you can create USB device filters in Windows so it will not allow unknown device to be installed. But sysadmin has to know about it. https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune https://docs.microsoft.com/en-us/windows/security/threat-pro...
  - agumonkey 6y ago
    Apparently these were not since I could also see my smartphone being registered as a new MTP endpoint (and could exchange files). thanks for the tip
pfranz 6y ago
Why are random users allowed to attach USB drives? Is that normal? I would think any data going in or out should go through some centralized process? Sure, the Internet can be a loophole, but locking down physical access seems like an easy and obvious win.
addicted 6y ago
Did anyone in the FBI get fired for plugging in a USB drive into their computers? If they did I bet those numbers would change pretty quickly. Similarly, if Equifax had been shut down under the mountain of lawsuits they should have had for losing people’s data, I bet security would become a much bigger concern for everybody. The FBI study basically shows that consequences are important.
JetSpiegel 6y ago
> half of their employees would plug in a USB drive that they found on the ground in the parking lot If that didn't work, StuxNet wouldn't have gone anywhere either. Sometimes the right hand requires the left hand to fuck up.

by nickff 6y ago

qppo 6y ago

Isn't that how they got Stuxnet into the Iranian nuclear facilities?

boogies 6y ago
Something like that (USB exploit of Windows zero days, breaching an airgap). (Edit: though not by leaving flash drives outside of the facilities, by infecting some with a virus that spread from Windows PC to Windows PC around the world.)

Swizec 6y ago

I remember an article a few years ago saying that large % of office employees would trade their password for chocolate. Ah yes here we go, large scale study, 43% of participants gave away their password when bribed with a chocolate bar. People just don't realize how valuable passwords are. https://www.sciencedaily.com/releases/2016/05/160512085123.htm https://www.sciencedaily.com/releases/2016/05/160512085123.h...

davinic 6y ago
> If the chocolate was only given out afterwards, 29.8 per cent of participants revealed their passwords. Nearly 30% of people just gave out their password and didn't even know they were getting chocolate! They gave it away for literally nothing.
manquer 6y ago
the study says 29% gave the password without chocolate as well . Some where given chocolate before and after , nowhere it says chocolate was offered as payment for sharing the password. Small gifts could have been inducement to establish relationship and trust not the same as a bribe as you characterises it I find it hard to believe 25 /40 % plus people readily share their password to total strangers , without knowing more details it seems unrealistic Social engineering is still a problem but am not sure bribes are the real concern . And to insinuate the cost of bribing is as low as candy for significant chunk of the population is just wrong
- transitionnel 6y ago
  What kind of mindset would lead to this behavior?? Maybe it doesn't matter. It feels -to me- like simply being exposed to people who say things like: "What?-- no, that's not good" while remaining professional, respectful, and humorous, is a vaccine against not wanting to seem jerky, yet staying secure.
  - manquer 6y ago
    Perhaps it did not come out as I hoped, if it was offensive I appolgize The premise that integrity of most people is bribed by few bars of candy was offensive to me I hope it is to you as well. The sensationalist headline basically claimed that, the abstract was a very different statement. I am tired of studies that are constantly being cited these days: readers, journalists and even the principals invariably sensationalize the headlines. It is a losing battle to get anyone to critically analyse information presented to them, sooner or later you are going to snap. Whether it is alternate medicine, creationism, or conspiracy theories there is a real damage out there everyday , few people ( Jon Stewart? ) are articulate despite being frustrated and are able to civil engage in discussion. Even if the study actually claimed what the headline said, the bar to peer reviewed respected research in much of psychology and social sciences seems so low that just getting some correlation between two parameters is good enough. Raw data is rarely shared, and statistical methods used are superficially understood and discussed, half the analysis's are just putting data into a tool like SPSS with the whatever defaults IBM puts in these days. There is not much scope for replication of a finding, a core principle of the scientific method.

slg 6y ago

Then you need processes in place to make sure a single person being careless cant do this much damage. There are low tech solutions that would greatly improve security[1], however the overhead this introduces is hard to justify in a world in which these breaches aren't that damaging to a company. We need to change incentives for companies by either mandating these security practices or implementing harmful repercussions for choosing a less secure approach. [1] - https://en.wikipedia.org/wiki/Two-man_rule https://en.wikipedia.org/wiki/Two-man_rule

nickff 6y ago
I agree that better security practices are advisable, but you're victim-blaming. Twitter wasn't 'asking for it', and neither were the individuals who lost bitcoins; the 'hackers' intentionally perpetrated deceptions, misrepresentations, and fraud against both Twitter and the general public. If you compare what these three did to a white-collar crime, the dollar amount was small, but the behavior was egregious.
- rschneid 6y ago
  Twitter is a platform used widely by some of the most powerful people in the world and in the US government. As a result, there is plenty of justification and precedent for said gov't to regulate their security practices and procedures. To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http. Now, I don't think the government is prepared to do this proactively and effectively, but the idea of a telco that advertises resilience to hacks (whether through social engineering or technical incompetence) sounds like it would be quite appealing to a growing segment of the connected world and whatever such promises that find success in the marketplace might be used to inform legislation or regulation, eventually...
  - saghm 6y ago
    > To illustrate this point, I doubt you'd have any sympathy for Twitter if they had been sending their passwords over http This is probably off-topic, but companies shouldn't even be sending the passwords over HTTPS; passwords should be hashed client-side and then the hash should be sent to the server (preferably over HTTPS).

enraged_camel 6y ago

>>If a security-focused government police agency is so vulnerable I think calling FBI "security-focused" is a bit too generous. They are essentially glorified police detectives, with greater authority and jurisdiction. I don't believe the average FBI agent is particularly competent, in terms of technical (i.e. computer) skill or knowledge.

nickff 6y ago
The FBI literally performs the background checks for security clearances. Like any other organization it has less security focused divisions, but insofar as any organization is security focused, the FBI is.
- enraged_camel 6y ago
  Like I said, none of this translates to computer literacy.

LeifCarrotson 6y ago

I would be surprised if the average FBI agent was less likely to plug in an unknown USB drive than the average Twitter engineer.

Nuzzerino 6y ago
What makes you say that?
- theelous3 6y ago
  Software engineers are much more aware and focused on the problem of technical attacks. An fbi agent has no innate reason to distrust usb sticks. After all, they're just for "moving files" or whatever other basic tasks they use them for.
  - TheSpiceIsLife 6y ago
    > Software engineers are much more aware and focused on the problem of technical attacks. We’re constantly presented with evidence to the contrary.
    - mewpmewp2 6y ago
      The point was "less likely", not that all engineers would not do that.
  - mejtro 6y ago
    With a corrupted USB drive, the FBI Agent may as well be drawring bleedn ded

gav 6y ago

Security training improves security but it doesn't get close to stopping 100% of attacks. I know it's obvious, but it feels like it's only obvious to those that think about security. It's the same reason that putting your developers through a yearly OWASP Top 10 secure coding course isn't going to get you to 100% secure code. Locking down systems seems draconian, but it's the only way: - Disabling USB storage - Moving away from passwords to hardware authentication - Strong controls on internet access - Stop incoming calls from reaching most employees. Better: take away phones altogether And so on.

manquer 6y ago
in a remote only or remote first working environment, many of these policies are not feasible , ultimately employees have to be able work somewhat productively . Such clean room requirements could perhaps work when the threat model include nation state actors or your are handling sensitive financial applications. Most companies are not defence contractors or banks the security levels you propose won’t be worth the cost to a typical internet tech company .
lobster45 6y ago
Anytime there are humans involved, there is no way to 100% secure it

Veserv 6y ago

Except this is not expecting perfection, it is expecting a level of security that can prevent children, literal children, from walking right through it. Which would not even be a problem except for the fact that this is far, far less than what Twitter has led their average user and stockholder to believe. To illustrate my point, if Twitter told the truth in big bold print at the top of every page so every user knows: "Determined teenagers can take over your account at any time." do you think this might outrage their users or harm their stock price? Did Twitter at any point say anything that might indicate that this is the truth of the matter and that would not be easily misconstrued by users? The evidence indicates yes, they would be outraged, and no, they at no point ever said anything that would lead anybody to believe that this was possible and hilariously easy. So, it hardly matters that maybe they or anybody else (say the FBI) can not provide a high level of security, what matters is that they committed material fraud in egregiously misrepresenting their product security to their users and stockholders.

ISL 6y ago
One underestimates the capability of determined teenagers at one's peril.
- TheSpiceIsLife 6y ago
  And many of them live in what amounts to a serviced apartment above a restaurant. Idle hands.
davinic 6y ago
Exactly. At least one of these kids used their personal gmail account on the hacking forum. These are not advanced hackers.
- ta17711771 6y ago
  They've done more than you, and majority of others, though.
  - 6y ago

cosmodisk 6y ago

Someone successfully gained access to colleague's email account using a phishing technique. I Inform the senior management team not to open any emails just to get a message 2 min later that one of them entered email credentials after opening a link...

hguant 6y ago

I wonder what sort of machine those folks were plugging it into? If it's their general purpose work issued machine, shame on them, but I can't believe the FBI doesn't have a high and low side networks. How many plugged into the high side? How many plugged into the "this is my email and timecard" computer? I have a Chromebook running arch[0] that has a borked network adapter than I use to plug weird things into/use as an airgapped box I can reset in about 5 minutes. I'd have no qualms about plugging anything into that [0] BTW I run Arch

theelous3 6y ago
Nice I run arch too. I like the way it is, and isn't. As an aside to that important point, it seems like the solution here is to just remove all random device access points and drives before giving a system to some luddite with no security awareness.

varenc 6y ago

An acquaintance of mine worked at the NSA and they also deal with this. He said during his first week he made the mistake of putting a CD-ROM with some official training materials into his work system. Within 10 minute two people showed up to stop him and investigate what was going on with his computer. It was fine in the end but he was seriously reprimanded by his boss. When you can’t trust users, the answer isn’t just to give up! It’s to acknowledge their fallibility and create a system that doesn’t rely on 100% compliance. In this case that means having software that instantly reports when any external media is connected.

i1856511 6y ago
This seems silly. Network admins can determine he inserted a CD and respond immediately in person - but nonetheless issue PCs with CD-ROMs and the ability to interact with removable media?
- stqism 6y ago
  If it’s anything like the DoD does, the reason USB ports and CD drives aren’t physically disabled is because sometimes using authorized devices and media is required to perform your official duties.
solipsism 6y ago
And the same acquaintance described those NSA security protocols to you, who are now talking about them in a public forum. If your acquaintance actually did work for the NSA (God help us), he probably shouldn't have.

hindsightbias 6y ago

A criminal mastermind would leave a stick behind to infect those investigating.

sashwatp 6y ago

This reminds me of Mr.Robot. :)

devin 6y ago

1. When was this study conducted? I remember a story like this from somewhere around 2008. A lot has changed since then. In fact, I recall that during my onboarding at a medium size tech company, it was an explicit part of the company's security training curriculum. 2. I think you may actually have it backwards. I would imagine the engineering group at Twitter (the people who have important credentials) is in some ways more paranoid, or at least more technically savvy and therefore more aware than many of the people at the FBI.

ketzu 6y ago
Comparatively, Cern does a phishing study from time to time [1] and the campaigns are in line with current expectations: People fall for phising, and security training has only a short term effect on phising. Unfortunately I can't find the real results right now. We once had a bachelors thesis comparing the results over multiple years, and the results were mostly stable. (Years are mid 2010s). [1] https://home.cern/news/news/computing/computer-security-cern-has-been-phished-again https://home.cern/news/news/computing/computer-security-cern...

agumonkey 6y ago

Anecdote: working at a court room I was bemused by the security talks about usb keys, yet the OS setup still allows usb driver installs automatically (granted their local presence). I know because I brought a keyboard to replace the busted one they had in-house and windows gladly set up everything plug`n`play. I wonder if OSes have actual rules for this, and if there are secure corporate usb keys

ozim 6y ago
You know you can create USB device filters in Windows so it will not allow unknown device to be installed. But sysadmin has to know about it. https://docs.microsoft.com/en-us/windows/security/threat-protection/device-control/control-usb-devices-using-intune https://docs.microsoft.com/en-us/windows/security/threat-pro...
- agumonkey 6y ago
  Apparently these were not since I could also see my smartphone being registered as a new MTP endpoint (and could exchange files). thanks for the tip

pfranz 6y ago

Why are random users allowed to attach USB drives? Is that normal? I would think any data going in or out should go through some centralized process? Sure, the Internet can be a loophole, but locking down physical access seems like an easy and obvious win.

addicted 6y ago

Did anyone in the FBI get fired for plugging in a USB drive into their computers? If they did I bet those numbers would change pretty quickly. Similarly, if Equifax had been shut down under the mountain of lawsuits they should have had for losing people’s data, I bet security would become a much bigger concern for everybody. The FBI study basically shows that consequences are important.

JetSpiegel 6y ago

> half of their employees would plug in a USB drive that they found on the ground in the parking lot If that didn't work, StuxNet wouldn't have gone anywhere either. Sometimes the right hand requires the left hand to fuck up.