Brett's Ramblings
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was ‘issued’ a USB flashdrive to temporarily store our reports. In theory, we would be able to write reports in our patrol car laptops (MDCs/MDTs), store the reports on the flashdrive, and then plug into the network to upload the report. At the time, the patrol car laptops had no “Internet” connectivity, other than a data channel for running names and license plates.
In practice, those USB drives were forgotten in whichever computer that the officer plugged it into. Everywhere you looked, there would be a handful of these things either plugged into workstations or laying around desks. Some had names written on them, others were just plain ol’ USB flashdrives in every color of the rainbow.
At one point, the entire network was infected with a MS Word macro virus that was spread throughout the city. I blame those USB flashdrives.
Oh yeah. None were encrypted, but they should have been considering how many were probably lost throughout the city after inadvertently dropping them while on the street. When the real “Internet” was connected to the patrol MDCs, we could finally upload reports directly without those using those malware devices.
Personally, I still hate those things. I have lost USB flashdrives before, simply because they are small and easy to lose. Any USB flashdrive that I personally have is encrypted because I KNOW that I will lose one eventually. No, make that I will always lose all of them eventually. Thank goodness for cloud storage…but that’s another story.
Today's spy story
https://abcnews.go.com/Politics/chinese-woman-mar-lago-security-controversy-expected-court/story?id=62247972
I’m not getting into why I think this spy is incompetent, because maybe she isn’t. Looking at all angles, this could be a small part of a very well executed operation where this particular operative was designed to be caught from the beginning. Perhaps to probe security or maybe as a distraction to the primary operation. Basically, this spy got caught with typical spy stuff, including a malware infected USB flashdrive.
Here the rub: After seizing this suspicious USB flashdrive, the Secret Service plugged it into a computer. I don’t know anything about the process used or the computer that was used, but reading that the agent shutdown the computer because of seeing a “very out-of-the-ordinary” event of files being installed to the computer implies that it was not the correct process…at all.
USB flashdrives are evil.
To be honest, I love finding USB flashdrives because I am a curious person. I automatically assume that malware is on every one of them that I find, and that is what I look for. If I had no intention of uncovering malware on a found USB flashdrive, I would throw it away. Unless someone’s name was on it and it could be returned, I toss them. I recommend that everyone toss them. Most likely, you won’t find the owner unless you plug in the flashdrive and fish through the files. That means exposing your machine to potentially harmful malware. Additionally, I am certain that the owner would rather have the found property tossed in the trash than have a stranger go through their personal data.
The year is 2019 and we should all know better by now. You do not need to be a “cyber” person to know that plugging in ANY unknown device into a system causes a risk of compromise. Plugging an unknown USB flashdrive into your computer should be viewed as if you were taste-testing white powder that was mailed to you in a letter. You just don’t do it because you just don’t know.
To have the Secret Service plug a USB device into their system is disappointing, because the best forensic training that I have ever received was from the Secret Service. They know their stuff. You just don't start plugging devices into a government computer system...
The lesson
If you know that USB flashdrives are dangerous, be sure to tell others when the occasion arises. Teach your kids. Teach your friends. A found USB flashdrive is garbage. Don't fall for anything that makes it enticing to plug in, because that is the point of an intentionally malware infected USB flashdrive: to get you to plug it in.
If USB flashdrives were shaped like spiders, we would have ZERO instances of people plugging these things into their computer. https://t.co/oSMTSMAkio
— Brett Shavers 🙄 (@Brett_Shavers) April 8, 2019
As for me, I would have loved the opportunity to examine that USB flashdrive. I have a computer set aside just for that sort of thing 😊
About the author
Comments
By accepting you will be accessing a service provided by a third-party external to https://www.brettshavers.com/
Posts List
Tag Cloud
Search Blog
Most popular posts
DFIR Training
Be sure to check out my DFIR Training website for practically the best resources for all things Digital Forensics/Incident Response related.
Even better, support DFIR Training at Patreon and get access to multiple online courses in digital forensics with included ebooks!
More posts
-
COVID-19’s Investigative Impacts on Digital Forensics/Incident Response (DFIR). AKA: All burners are now burned.
The meat and potatoesA bit is still a bit and a byte is still a byte. COVID-19 cannot change that, which means that the technical…
Saturday April 25
14510 hits / 0 comments
-
Mini-WinFE 10 and WinFE 10 Updated
The short story on the newest Mini-WinFE 10 (aka, the download link):Mini-WinFE has been updated and upgraded. I update WinFE developments (including the downloads for…
Sunday April 05
8974 hits / 2 comments
-
Eat your broccoli first
Something good and something not-so-good on learning DFIRThe good thing about learning DFIR is that there are probably fewer barriers and obstacles to learn and…
Saturday January 18
30154 hits / 0 comments
-
The Second Decade of the 2000s is almost over!
We’ve come a long way in DFIR over the past 20 years, and even looking at just the past decade, the field has drastically grown!…
Thursday December 26
9816 hits / 0 comments
-
Public Records
I have an outstanding public records request. It is not "outstanding" in the manner that I wrote a great request, but "outstanding" in that I…
Thursday December 12
4689 hits / 0 comments
-
The Five Stages of the DFIR Career Grief Cycle
I have been a fan of Craig Ball ever since I met him in a forensic course years ago. I was so impressed with Craig,…
Tuesday September 10
34886 hits / 0 comments
-
Our World is Going to Turn Upside Down with DeepFakes
The short storyAny person and their voice, in practically any video (past, present, or future) can have their face and voice digitally replaced with any…
Sunday September 01
3038 hits / 0 comments
-
If you are comfortable in DFIR, you might be doing it wrong
I took a 3-day basic forensic course and embarrassingly enough, the instructor (in front of the class), said that I probably know everything in the…
Thursday August 29
3991 hits / 0 comments
-
Everything I Needed to Know about Working in DFIR, I Learned in Boot Camp
You don’t need to experience military life to learn the valuable lessons that are drilled into military recruits. In fact, you can probably enjoy the…
Saturday August 17
4933 hits / 0 comments
-
Personality of a computer
From a recent discussion that I had with Harlan Carvey about the registry, this topic is something that I touched on lightly in Placing the…
Wednesday July 31
3936 hits / 0 comments
-
Add a Dab of Balance in your DFIR World
Jessica Hyde’s post of Giving Back in DFIR from 2018 is a great write up on contributing to the DFIR community, and I see her…
Monday June 24
14606 hits / 0 comments
-
The Easy Way to Learn DFIR
SummaryThere is no easy way to learn DFIR. You can stop reading from here if you want.Longer versionOk. Since you are still reading, you probably…
Saturday June 08
13904 hits / 0 comments
-
Game of Thrones, DFIR Style
Short post and quick opinion. I came across some tweets today about how bad people are in the #infosec/#DFIR community and I dug a little…
Thursday April 25
31811 hits / 0 comments
-
Puking in DFIR
Admittedly, the title of this post is intentionally gross, because I am going to heave a few things at you, mainly about puking. As in,…
Wednesday April 17
5765 hits / 0 comments
-
The #1 Reason that DFIR practitioners don’t post opinions
Lesley Carhart tweeted today that a journalist used one of her tweets in an article that would have been rephrased in a less playful manner…
Tuesday April 09
5858 hits / 0 comments
-
If USB flash drives were shaped like spiders, we wouldn’t have these problems
I hate USB drives. My first experiences with the darn things was when I was a young patrol officer and the entire police department was…
Monday April 08
2306 hits / 0 comments
-
Working in DFIR is glamorous, but mostly only to those not working in DFIR...
Here is something about the DFIR career field: it is one of the most exciting, eventful, and jam-packed jobs that anyone can have. Running and…
Friday April 05
3844 hits / 0 comments
-
Overcommitted in DFIR
I have seen people be overcommitted, realize that they are overcommitted, yet continue forward in the most serious of situations. By overcommitted, I do not…
Friday March 22
19018 hits / 0 comments
-
'You're guilty unless you can prove it'
Swift on Security tweeted a great article. The article is not great as a well-written piece or containing earth shattering news piece, but more that…
Saturday March 09
21290 hits / 0 comments
-
“I've answered questions, responded to emails, and been on phone calls...when asked.” – Harlan Carvey
I feel obligated to respond to one of Harlan Carvey’s points in his recent blog post, Book Writing Misconceptions (https://windowsir.blogspot.com/2019/03/book-writing-misconceptions.html). I agree with everything he…
Tuesday March 05
3456 hits / 0 comments
© 2020 Brett Shavers