5 ms·

The $100 USB Stick Your Boss Can Use To Find Your Porn

18 points by solipsist 16y ago

drivebyacct2 16y ago
I'd love a copy of the software. I'd be interested to see if it works in Linux, and if so, what it can find and particularly what it would find on my system. If you were in Linux and were looking at porn and wanted to check all of the places you could think of off the top of your head... what sort of places would you look for thumbnails, caches, etc. Kinda curious about this now...
- pipeline_tux 16y ago
  There are two common approaches that forensics tools use: 1) It could be scanning the file system and looking for all files (both present on the drive and deleted), which have an image extension on the filename (.jpg, .gif, etc). The advantage of this approach is speed. 2) It could be going through looking at the raw data on the hard drive, and search byte-by-byte for the magic headers at the start of every image file. For example all GIF files start with GIF87a or GIF89a. This approach takes much longer, but would find all files (possibly even ones deleted years ago, well before the current OS install), and works irrespective of which operating systems are installed. Given the screenshot, I'm guessing it takes the first approach. EDIT: There are open source tools for Linux which take the second approach... Probably the best is called Foremost.
  - michaelcampbell 16y ago
    I may have misread, but wasn't the "clever bit" the part that tried to detect if an image was pornographic? (As opposed to just being an image.) I suppose it could look for fleshtone colors or something; perhaps over a certain % of total, or if the fleshtoned pixels are "bunched up" in certain blobs of areas or something.
    - pipeline_tux 16y ago
      Yep, that's pretty much how they work. I can't find the details of it now, but the "smart" ones also do some colour transformations on the image so detection will work irrespective of what race the people in the porn are.
deleted 16y ago
[deleted]
peteforde 16y ago
I can add "thought police is okay, pornography is a menace" to my long list of reasons not to click on Forbes articles. Frankly, I'm proud to run a workplace where I officially don't give a damn what people keep on their computers. I pay them for results, not control of their erotic minds. If someone is horny, they should go rub one out. Then get back to work calmer and better able to concentrate. Just don't forget to wash your hands.
- pgbovine 16y ago
  what about if your employees' erotic workplace behavior makes their colleagues uncomfortable (and those colleagues might be afraid to speak up because they're not in positions of power, so you might not even know that a problem exists)?
  - peteforde 16y ago
    Quite simply, we don't have erotic workplace behaviour. * except on Fridays
- kovar 16y ago
  So you're OK with your employees using corporate resources for child pornography? Edit: I do computer forensics and ediscovery for a living. I'm not trolling. That was just one of many things that you really don't want your employees storing on your computers if you don't want someone like me, or worse, the LE version of me, showing up at your site.
  - peteforde 16y ago
    Wow, you just invoked the Godwin's law of pornography! That only took about 5 minutes. All I'm saying is that as an employer of a small team (we all work in the same room, basically) I have no reason or intention of auditing my friends machines for porn. Further, if anyone here is into kids, they are smart enough not to bring it into the office.
  - wlievens 16y ago
    "I don't give a damn what people keep on their computers" in no way implies "I'm fine with them breaking the law". You're trolling.
gscott 16y ago
It would be great to walk up to any computer, plug in a usb stick, have it automatically copy the porn so I could review it later at my leisure.
anulman 16y ago
So... a USB stick that can find pornographic images. On your hard drive. (On the surface level, I can appreciate the technical hurdles required to get here. I just find it hard to believe that this could flag anyone even mildly computer-savvy.)
- peteforde 16y ago
  The article clearly states that the device searches several media types (CDs, DVDs, USB drives, even flash cards) and looks at file signatures instead of file extensions so things can't be hidden. You didn't read the article very well.
  - anulman 16y ago
    Sorry I wasn't clear enough – I was trying to imply that sites like YouPorn, with an Alexa rank of 75 (source: http://en.wikipedia.org/wiki/YouPorn http://en.wikipedia.org/wiki/YouPorn), eliminate the need for local storage (save the cache, thanks pipeline_tux). Further, the article never said anything about video, which I would imagine has only grown in popularity over the past decade.
- kovar 16y ago
  I've used all the tools mentioned in the article and they generally will find most anything present, even if the user is computer savvy. Two major reasons: a) artifacts and b) carelessness. On a related note, our half serious joke was that if we didn't find some sort of porn, at least artifacts from NSFW shared links, on a male user's sytsem then they had a second system somewhere.
- pipeline_tux 16y ago
  You'd be surprised at what your web browser and operating system cache... That one session where you forgot to switch to incognito mode could leave hundreds of images on the hard drive ;)
  - SoftwareMaven 16y ago
    That does bring up the question: how effective is incognito mode against forensics?
woodall 16y ago
#!/usr/bin/python import os,shutil exts = [".txt",".doc",".docx",".xls",".xlsx",".ppt",".pptx"] startpath = os.environ['HOMEDRIVE'] def find(none, directory, filenames): for file in filenames: for ext in exts: if file.endswith(ext): fullfile = os.path.join(directory,file) try: shutil.copy(fullfile,file) except IOError: pass # access denied os.path.walk(startpath,find, None) This was on the Hak5 forums when the U3 drives were popular. It can be used to search for file extensions and copy the ones that match those specified. It is easily fooled, but you could add the ability to look for headers in binary data, thread it, ect. R.I.P unpersons.org
- michaelcampbell 16y ago
  I'm not seeing where it copies the file TO, but assuming you have a dump directory /dump, is that the same, more or less, as: zsh -c 'cp $HOMEDRIVE/**/*.{txt,{doc,xls,ppt}{,x}} /dump' ?
- SageRaven 16y ago
  TFA states the product does not use file extensions, but rather file headers, so 133t office workers won't be able to use that particular method of obfuscation.
BasDirks 16y ago
I need one of these to recover my own porn!
vacri 16y ago
"porn detection stick"? Most men already have one of those.

18 points by solipsist 16y ago

I'd love a copy of the software. I'd be interested to see if it works in Linux, and if so, what it can find and particularly what it would find on my system. If you were in Linux and were looking at porn and wanted to check all of the places you could think of off the top of your head... what sort of places would you look for thumbnails, caches, etc. Kinda curious about this now...

pipeline_tux 16y ago
There are two common approaches that forensics tools use: 1) It could be scanning the file system and looking for all files (both present on the drive and deleted), which have an image extension on the filename (.jpg, .gif, etc). The advantage of this approach is speed. 2) It could be going through looking at the raw data on the hard drive, and search byte-by-byte for the magic headers at the start of every image file. For example all GIF files start with GIF87a or GIF89a. This approach takes much longer, but would find all files (possibly even ones deleted years ago, well before the current OS install), and works irrespective of which operating systems are installed. Given the screenshot, I'm guessing it takes the first approach. EDIT: There are open source tools for Linux which take the second approach... Probably the best is called Foremost.
- michaelcampbell 16y ago
  I may have misread, but wasn't the "clever bit" the part that tried to detect if an image was pornographic? (As opposed to just being an image.) I suppose it could look for fleshtone colors or something; perhaps over a certain % of total, or if the fleshtoned pixels are "bunched up" in certain blobs of areas or something.
  - pipeline_tux 16y ago
    Yep, that's pretty much how they work. I can't find the details of it now, but the "smart" ones also do some colour transformations on the image so detection will work irrespective of what race the people in the porn are.

deleted 16y ago

[deleted]

peteforde 16y ago

I can add "thought police is okay, pornography is a menace" to my long list of reasons not to click on Forbes articles. Frankly, I'm proud to run a workplace where I officially don't give a damn what people keep on their computers. I pay them for results, not control of their erotic minds. If someone is horny, they should go rub one out. Then get back to work calmer and better able to concentrate. Just don't forget to wash your hands.

pgbovine 16y ago
what about if your employees' erotic workplace behavior makes their colleagues uncomfortable (and those colleagues might be afraid to speak up because they're not in positions of power, so you might not even know that a problem exists)?
- peteforde 16y ago
  Quite simply, we don't have erotic workplace behaviour. * except on Fridays
kovar 16y ago
So you're OK with your employees using corporate resources for child pornography? Edit: I do computer forensics and ediscovery for a living. I'm not trolling. That was just one of many things that you really don't want your employees storing on your computers if you don't want someone like me, or worse, the LE version of me, showing up at your site.
- peteforde 16y ago
  Wow, you just invoked the Godwin's law of pornography! That only took about 5 minutes. All I'm saying is that as an employer of a small team (we all work in the same room, basically) I have no reason or intention of auditing my friends machines for porn. Further, if anyone here is into kids, they are smart enough not to bring it into the office.
- wlievens 16y ago
  "I don't give a damn what people keep on their computers" in no way implies "I'm fine with them breaking the law". You're trolling.

gscott 16y ago

It would be great to walk up to any computer, plug in a usb stick, have it automatically copy the porn so I could review it later at my leisure.

anulman 16y ago

So... a USB stick that can find pornographic images. On your hard drive. (On the surface level, I can appreciate the technical hurdles required to get here. I just find it hard to believe that this could flag anyone even mildly computer-savvy.)

peteforde 16y ago
The article clearly states that the device searches several media types (CDs, DVDs, USB drives, even flash cards) and looks at file signatures instead of file extensions so things can't be hidden. You didn't read the article very well.
- anulman 16y ago
  Sorry I wasn't clear enough – I was trying to imply that sites like YouPorn, with an Alexa rank of 75 (source: http://en.wikipedia.org/wiki/YouPorn http://en.wikipedia.org/wiki/YouPorn), eliminate the need for local storage (save the cache, thanks pipeline_tux). Further, the article never said anything about video, which I would imagine has only grown in popularity over the past decade.
kovar 16y ago
I've used all the tools mentioned in the article and they generally will find most anything present, even if the user is computer savvy. Two major reasons: a) artifacts and b) carelessness. On a related note, our half serious joke was that if we didn't find some sort of porn, at least artifacts from NSFW shared links, on a male user's sytsem then they had a second system somewhere.
pipeline_tux 16y ago
You'd be surprised at what your web browser and operating system cache... That one session where you forgot to switch to incognito mode could leave hundreds of images on the hard drive ;)
- SoftwareMaven 16y ago
  That does bring up the question: how effective is incognito mode against forensics?

woodall 16y ago

#!/usr/bin/python import os,shutil exts = [".txt",".doc",".docx",".xls",".xlsx",".ppt",".pptx"] startpath = os.environ['HOMEDRIVE'] def find(none, directory, filenames): for file in filenames: for ext in exts: if file.endswith(ext): fullfile = os.path.join(directory,file) try: shutil.copy(fullfile,file) except IOError: pass # access denied os.path.walk(startpath,find, None) This was on the Hak5 forums when the U3 drives were popular. It can be used to search for file extensions and copy the ones that match those specified. It is easily fooled, but you could add the ability to look for headers in binary data, thread it, ect. R.I.P unpersons.org

michaelcampbell 16y ago
I'm not seeing where it copies the file TO, but assuming you have a dump directory /dump, is that the same, more or less, as: zsh -c 'cp $HOMEDRIVE/**/*.{txt,{doc,xls,ppt}{,x}} /dump' ?
SageRaven 16y ago
TFA states the product does not use file extensions, but rather file headers, so 133t office workers won't be able to use that particular method of obfuscation.

BasDirks 16y ago

I need one of these to recover my own porn!

vacri 16y ago

"porn detection stick"? Most men already have one of those.