Jump to content

Recommended Posts

Posted
Posted

No body would suspect a thing. Very clever idea.

Posted

Who would use a mouse they randomly got in the mail without ordering it? Why would a company allow an employee to receive packages at work?

Posted

Who would use a mouse they randomly got in the mail without ordering it? Why would a company allow an employee to receive packages at work?

I think it was sent as a marketing ploy, possibly packaged as promotional material, and sent to a specific targeted person. Either way, you have to remember that employees in general, who do not work in IT, and are not security savvy, would not be the wiser. I would gather many in IT would also fall for this. Especially if they could implement it in a manner that looked like all their existing mice, if they could get it into the mix somehow, say on a deployment, where they were setting up new workstations, etc, no one would know the difference until it was too late. Its all in how they executed the attack.

If you went to a trade show, and they had some new gaming mice on display, and they were giving some away as promotional items, would you think twice before taking it home and trying it? Most people would probably be waiting in line for one. Add a raffle to that, to make the attack look more legit, where only people with winning raffle numbers get to have one, and you make people even more vulnerable, since only people who would want one, would ask for a raffle, and there in you have your victims come to you. Easy peasy lemon squeezy.

Posted

I work for local government and we're allowed to receive personal packages all the time. :)

But should you be aloud is a better question. Especially with the issues with leaks and breaches, you would think something like the ducky and phukd devices are only the tip of the iceberg. If Darren and Iron Geek thought of these devices, do you not think there are other tricks out there already in deployment.

I recall my Cisco teacher telling us how they received some network equipment from France, and all of it had to be destroyed, because they found back doors built into the hardware. He worked at an aerospace agency where they use in house encryption they created themselves, but apparently the hardware was able to bypass it somehow at the physical level, and it was a big mess. All of the hardware had to be destroyed.

Cisco devices have been known to be shipped with forgeries and built in sniffers, passed off and sold as legit Cisco equipment, so I'm sure theres a number of spy agencies with ties to all sorts of stuff we'll never hear about publicly.

Posted

I recall my Cisco teacher telling us how they received some network equipment from France, and all of it had to be destroyed, because they found back doors built into the hardware. He worked at an aerospace agency where they use in house encryption they created themselves, but apparently the hardware was able to bypass it somehow at the physical level, and it was a big mess. All of the hardware had to be destroyed.

What a coincident the other day I watched a documentary on BBC about Cyber War threats. The US Department of Defense in particular have personnel staffs trained to spot backdoor software built into their hardware that comes pre-assembled from China.

And amazingly enough, they have found quite a few of their hardware bugged. Now here is something that organisations could do and train their IT staffs for. It may not be of a concert for some but its a prof of concept that should not be disregarded.

Posted

More on the whole rogue device issues: http://t.co/wWX8VBx

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...