USB flash drives are very common and can be found in almost every computerized environment for storing and transferring data between computers. These USB devices make it really easy for potential attacker to exploit unprotected computers with malicious virus and Trojan software and provide a gateway to the network for manipulating sensitive data.
Detecting USB storage devices
There are some nice tools that can be found on the net that will notify about USB devices on local and remote windows platforms. But most of them are not free and will require an installation of an agent on the remote windows platforms. Using the preinstalled Windows Management Instrumentation (WMI) on windows platforms is free and will not require any remote agent. It will only require a simple script that can be run manually from a privileged user account or from another network monitoring software like Lan-Secure Security Center and Lan-Secure Switch Center Protector network security scanners.
WMI notification event script
The following USB notification event script will send an event message in response to any operation of USB device on local or remote windows platform. For simplicity, the script is using a temporary event subscription, which exists only as long as the script is running. Some modifications will be needed for a permanent event subscription that will not require a perpetually running script:
VBScript (should be copied and saved as .vbs file):
strComputer = "." '(Any computer name or address)
Set wmi = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'")
While True
Set usb = wmiEvent.NextEvent()
Select Case usb.Path_.Class
Case "__InstanceCreationEvent" WScript.Echo("USB device found")
Case "__InstanceDeletionEvent" WScript.Echo("USB device removed")
Case "__InstanceModificationEvent" WScript.Echo("USB device modified")
End Select
Wend
JScript (should be copied and saved as .js file):
strComputer = "."; //(Any computer name or address)
var wmi = GetObject("winmgmts:\\\\" + strComputer + "\\root\\cimv2");
var wmiEvent = wmi.ExecNotificationQuery("select * from __InstanceOperationEvent within 1 where TargetInstance ISA 'Win32_PnPEntity' and TargetInstance.Description='USB Mass Storage Device'");
while(true) {
var usb = wmiEvent.NextEvent();
switch (usb.Path_.Class) {
case "__InstanceCreationEvent": {WScript.Echo("USB device found"); break;}
case "__InstanceDeletionEvent": {WScript.Echo("USB device removed"); break;}
case "__InstanceModificationEvent": {WScript.Echo("USB device modified"); break;}}}
For more information on network security and management software solutions for real-time monitoring systems, please visit Lan-Secure.com.
We deliver articles like below right to your inbox for free:
PHP Post Nuke Is Considered the Complete Hosting Solutions----Why?
by Fat Jack
On your way to create a community driven website? Have the right amount of confidence and killer idea to strike it big in the cyber world? Only get bogged down when it comes to handling of several technical issues of website maintenance? Well, there is no need to stress your brain over this simple issue; just hire a top notch web hosting service provider who will host a PHP Post Nuke site for you. With that keep on concentrating on the contents; the rest will be taken care of by the...
Learn to Type
by Jill Shu
You know you need to learn to type to succeed in your life, for there are so many situations needed your fast typing, such as the normal communication, your work, your business, even your learning. Especially as a typist or a secretary, fast typing is particularly significant. But what you may not know is, you can avoid hours of tedious typing when learning to type. In fact, you need a typing tutor to help you learn to type. There is a view is that you can learn to type by yourself. That...
Full-System Recovery To Non-Identical Hardware Backup
by Lazy Url
System Backup Administrator (SBAdmin) is the flagship offering from Storix; a recovery and backup platform primarily targeted for Linux and AIX equipment. The SBAdmin platform differing primarily in scale and offered in multiple flavors; including the feature Desktop limited edition, for non single system, non-commercial users; the Workstation edition, to perform with multiple systems or single systems that do not share network resources; and lastly the Network Administrator version, which allow...
Internet Filter Software Review - Are Video Websites A Danger to Your Children
by Richard Seng
Online video websites, where a child can view free videos, is a major concern for parents that are interested in parental control on the internet. The very nature of these sites (large, anonymous, and accessible) makes it likely that unscrupulous people will use it to spread pornography or inappropriate videos for children. The large size of these websites makes it nearly impossible to block all undesirable content shown online. Some websites attempt to keep children from viewing...
Microsoft .NET is a technology that connects information, people, systems and devices.
by Dharmesh Acharya
Microsoft .NET Application Development About .NET Microsoft .NET is a technology that connects information, people, systems and devices. .NET connects a broad range of personal and business technologies, enabling the access and use of important information, whenever and wherever it is needed. Built on XML Web service standards, .NET enables both new and existing applications to connect with software and web application to the services across platforms, applications and programmin...
|