As Clear as a Broken Window
The essence of a malicious “hack” is to take advantage of an inherent trust. If a thief breaks a window, they violated the trust that people would use doors to enter. This same logic is used time and again by industrious people to overcome, negate, or simply bypass all manner of security devices.
In the last 10 years, there has been an increase in attention on IoT devices and widely available, inexpensive single board computers and microcontrollers. Along with all these new devices came a renewed interest in using small devices to gain access, steal sensitive data, and introduce rogue software and processes into target systems.
So, what can be done about it?
The best defense against most attacks is to train your users to look for and question odd or out of place devices in and around the office. One of the most well publicized devices capable of this kind of attack is the Rubber Ducky USB drive used as a prop in the show Mr. Robot. It is one example of a common attack called keyboard emulation or keystroke injection.
In its most common form, the attacker scatters a few (or a few dozen) USB flash drives near the target in hopes that one or more users might pick one up and plug it into a computer to see what is on it and possibly how to return it to the person who lost it.
You may be thinking you would never plug in such a drive. But what if it had your company’s logo on it? What if it was the same size and color as the one you always see your boss use? Or even if you found a spare keyboard sitting in a cube near yours which is used as hotel space? What about a really nice presentation clicker left in a conference room right before your quarterly meeting?
Best Practices for Duck Hunting
In honor of the Rubber Ducky, we’ll refer to the practice of scouting out potential hardware attacks as, “duck hunting.” For users without the technical expertise to verify “found” hardware such as a USB rubber duck, the best strategy is to assume it is not safe and reach out to the technical resources at your organization.
For those looking for some quick tells hardware may have been altered, here are a few flags to look for:
The best way to secure your network and your information, is to create a culture of awareness within your organization. We recommend training your staff up to become a team of “duck hunters” savvy enough to recognize the clues that a duck is swimming in your office and quick enough to notify the experts in IT.