3 ms·

you could probably frame most people by sending them an unlabeled usb stick in the mail with a simple script that copies a file to their hard drive - curiosity

you could probably frame most people by sending them an unlabeled usb stick in the mail with a simple script that copies a file to their hard drive - curiosity often gets the best of us

robswc 4y ago
I could maybe see this working if you have a year or so to do it. Make it look like a game or something but copy incriminating stuff in the background. Then "tip" the authorities a year later, the person would probably forget all about it. If it's too soon they might still have the USB stick. No idea if that would pose an issue tho. I dunno tho. Not a cyber security guy or lawyer, but interesting "problem" to think about, haha.
- GekkePrutser 4y ago
  > If it's too soon they might still have the USB stick. No idea if that would pose an issue tho. Not really, if you manage to autorun arbitrary code from it (which is more difficult on the latest OSes), you can also make it wipe itself or something. It's hard to completely wipe USB sticks because of write leveling but a few rewrites should do it. Cheap sticks don't have much spare capacity. In fact if you're really good you can even trick the controller to hide or wipe it somehow. After all you're supplying the hardware so you're in full control of everything.
  - robswc 4y ago
    I guess I'm thinking more on the "how will it be handled by detectives/lawyers/whoever is involved." I mean, say they found corporate secrets on your computer. You say "no idea how they got here but look at this weird USB." Would they be able to see that a small USB sized package was delivered on the day the victim claimed? Would they even look that far, etc, etc. Thanks for providing some answers on the technical side though. That's def a thought too. I mean, seems you could be screwed if you're dealing with someone smart if you're being careless.
GekkePrutser 4y ago
Does that USB stick trick still actually work?? It's pretty old by now and every corporate security training warns about it.
- micromacrofoot 4y ago
  Yes. An old co-worker in security used to leave them on the floor in the lobby and had to stop when a C-level got mad about falling for it. It rarely didn’t work. The company has mandatory annual security training.

you could probably frame most people by sending them an unlabeled usb stick in the mail with a simple script that copies a file to their hard drive - curiosity often gets the best of us

robswc 4y ago

I could maybe see this working if you have a year or so to do it. Make it look like a game or something but copy incriminating stuff in the background. Then "tip" the authorities a year later, the person would probably forget all about it. If it's too soon they might still have the USB stick. No idea if that would pose an issue tho. I dunno tho. Not a cyber security guy or lawyer, but interesting "problem" to think about, haha.

GekkePrutser 4y ago
> If it's too soon they might still have the USB stick. No idea if that would pose an issue tho. Not really, if you manage to autorun arbitrary code from it (which is more difficult on the latest OSes), you can also make it wipe itself or something. It's hard to completely wipe USB sticks because of write leveling but a few rewrites should do it. Cheap sticks don't have much spare capacity. In fact if you're really good you can even trick the controller to hide or wipe it somehow. After all you're supplying the hardware so you're in full control of everything.
- robswc 4y ago
  I guess I'm thinking more on the "how will it be handled by detectives/lawyers/whoever is involved." I mean, say they found corporate secrets on your computer. You say "no idea how they got here but look at this weird USB." Would they be able to see that a small USB sized package was delivered on the day the victim claimed? Would they even look that far, etc, etc. Thanks for providing some answers on the technical side though. That's def a thought too. I mean, seems you could be screwed if you're dealing with someone smart if you're being careless.

GekkePrutser 4y ago

Does that USB stick trick still actually work?? It's pretty old by now and every corporate security training warns about it.

micromacrofoot 4y ago
Yes. An old co-worker in security used to leave them on the floor in the lobby and had to stop when a C-level got mad about falling for it. It rarely didn’t work. The company has mandatory annual security training.