USB Canary Sends An SMS When Someone Tinkers With Your USB Ports (bleepingcomputer.com) 40
An anonymous reader quotes a report from BleepingComputer: A new tool released on GitHub last week can help paranoid sysadmins keep track of whenever someone plugs in or disconnects an USB-based device from high-value workstations. Called USB Canary, this tool is coded in Python and currently, works only on Linux (versions for Windows and Mac are in the works). The tool works by watching USB ports for any activity while the computer is locked, which generally means the owner has left his desk. If an USB device is plugged in or unplugged, USB Canary can perform one of two actions, or both. It can alert the owner by sending an SMS message via the Twilio API, or it can post a message in a Slack channel, which can be monitored by other co-workers. USB Canary can prove to be a very useful tool for large organizations that feature strict PC policies. For example, if you really want to enforce a "No USB drives" at work, this could be the tool for the job. Further, with modifications, it could be used for logging USB activity on air-gapped systems.
Re: (Score:2)
You know what works even better? Ripping out the USB ports.
Re: (Score:2)
Separate your internal networks. Staff data on one network, public blue sky research https://en.wikipedia.org/wiki/... [wikipedia.org] and charity work on another. Contact with customers is kept away from all other sections of the internet networks.
Emerging projects and work not yet public is kept away from most staff and all other networks.
The work laptop is not a take ho
USB fishing (Score:3)
I've heard stories about how businessmen staying in Chinese hotels leave their laptops in the room while going out, and the "maid" comes in, sticks in a USB drive, and downloads all the files.
I've often wondered if it's possible to make a spring-loaded trap that would clamp down on a USB device and prevent it from being removed. The USB connector has 2 square holes that square pegs might fit into.
It might be possible to "fish" for these foreign USB devices, and reverse engineer them to see what sorts of attack they use.
Linux has this (Score:2)
auditd
Re:USB fishing (Score:4, Insightful)
Better nail your laptop down too, then! If they're going to be rumbled anyway, they might as well just take the fucker.
Re: (Score:2)
How about making ports like the infamous "USB Kill Stick" but in reverse? Any unauthorized device connected to the port would get fried.
The attacker would probably not find out what happened until afterwards when they try to get the data from the attacking device.
But yeah, if we knew what kind of attack they used to gain access one could provide another set of files: a honey pot, or just innocuous data.
After which (Score:2)
That's nothing... (Score:2)
Re: (Score:2)
A Rubber ducky? Those look like keyboards to the machines...and run scripts.
You can hack up a 2gig USB drive into one. Certain models only.
Re: (Score:2)
A Rubber ducky?
I personally prefer to have a Hello, Kitty! 8GB USB stick. :P [amzn.to]
Re: (Score:3)
IT security guy...you know a 'rubber ducky' is a penetration tool? The ones with actual rubber duckys printed on them are sold to poseurs, real hackers just modify the right old thumb drive.
PCs with windows or Linux (with autorun disabled) are owned by plugging it in. The computer thinks it's a keyboard and trusts it. It runs scripts, which can be toxic.
Does IT get called when someone's keyboard gets disconnected then plugged back in or only for USB storage?
Re: (Score:2)
IT security guy...you know a 'rubber ducky' is a penetration tool?
I've heard about them, haven't seen them. My job in InfoSec is to fix problems. Scanning and penetration is a different department. I thought you meant this rubber ducky [amzn.to].
Does IT get called when someone's keyboard gets disconnected then plugged back in or only for USB storage?
I don't know. I work with workstations and not with users. The workstations are locked down tighter than a virgin nerd's ass. If you create a file and leave it on your desktop for too long (all data is supposed to be stored on the network), you will need administrator access to modify the file.
Re: (Score:2)
It's a shame when us low on the pole IT guys have higher regulation and oversight than the fucking government we serve.
I work in government IT.
You can't even create local files [...]
Local files can be created but they need to move to the network in a timely manner. If the local file is left on the desktop for too long (might be 30 days), admin access is required to move or modify. I can move my own files, but regular users need to call the help desk.
[...] yet government officials are setting up insecure servers, getting accounts compromised, and falling for phishing scams that my 12 year old son would laugh at.
Politicians and political appointees don't follow the same rules as government workers and civilians.
LOL (Score:2)
When I saw the headline, my first thought was "I could probably do this pretty quickly on a Linux machine in Python."
Then I read the summary.
Windows USB log tool (Score:2, Informative)
http://www.nirsoft.net/utils/usb_log_view.html
Race condition! (Score:2)
Which one wins the race? The USB kill stick as it does its powerful best to fry your MoBo, or the Python code trying to send out a network message before some critical component coughs up smoke? My money's on the kill stick.
Re: (Score:2)
Re: (Score:2)
I had a great joke (Score:1)
The joke should be pretty obvious though, just read the headline and replace a few words.
Sorry I just don't want to lose my job or get in any trouble :)