Comment: USB Thumb Drives from Tech Events are a Massive Security Risk

USB Thumbs Drives are a massive hacking vector. At tech events it has become normal to be give a large number of these drives and you would be wise to simply throw them away.



To Ask Questions Email: Question@EliTheComputerGuy.com

Patreon Campaign for a Geekier world: http://www.patreon.com/elithecomputerguy

Signup for our email list at: http://www.elithecomputerguy.com/email-signup/
(#Microstopped... We will never forget)

For Classes, Class Notes and Blog Posts:
http://www.EliTheComputerGuy.com

Visit the Main YouTube Channel at:
http://www.YouTube.com/EliTheComputerGuy

Follow us on Twitter at:
http://www.Twitter.com/EliComputerGuy

---

Closed Caption:

so coming back from CES I want to talk
about one a hacking attack vector that a
lot of people don't think about that you
have to be very careful of and that you
just shouldn't let anywhere near your
computer so whenever you go to events
nowadays whether you go to CES whether
you to interoperate cisco live or any of
that kind of thing with the marketing
and PR folks have decided is that
instead of giving you pamphlets like
they used to in the old days with all
the information on it
what they decided to do is give you a
USB thumb drives the ideas like this a
four gig drive from Moodle tee box
whatever the hell that is
and the idea is ok we can give you this
this flash drive with all the
information that pictures and all that
kind of stuff and you can take this back
you can plug it in and then you can see
everything that we have to offer
now what I'm going to tell you though is
in the real world this is a horrible
thing so so i got for these from CES
more people offered them but I said no
these were kind of the ones that were
shoved into my hand so I had to take
them but the reality is these are going
to go into the trash directly into the
trash i'm not going to take them and
reformat them i'm not gonna take them
and see what's on there I'm not gonna do
anything basically these are coming out
of my little bag of paperwork and after
this video they're getting thrown away
and the reason is is because this is an
amazing attack vector for hackers i was
watching a video from 12 TEDx
conferences today and it was talking
about how stucks that got deployed
over-the-air Iranian nuclear facilities
so basically Stuxnet was a piece of
virus malware that specifically attacked
the centrifuges management system and
basically made all of the the
centrifuges within the Iranian nuclear
facility basically self-destruct now the
way that they are able to get the
Stuxnet virus into that Iranian facility
is intelligence agents actually littered
little USB drives all around the
facility and then some poor bastards
picked it up with ha look at that
there's a USB Drive I could use a USB
Drive
then took that USB Drive they plugged
into the computer system and then
everything got compromised and so that's
one of the things i want you guys to
think about when you go to these events
and you get things like USB drives or
any of these other things that you want
to plug into your computer servers
because isn't that an amazing attack
vector you go to interrupt you go to CES
you go to cisco live any of those kinds
of things you start giving out flash
drives with little viruses in them
many of the people that attend those
conferences are not simply marketing and
Human Resources people but these are the
actual administrator so imagine if an
administrator goes to a conference let's
say like Cisco life gets a couple of
these little flash drives as freebies
from vendors they then go back their
office and they're like oh yeah I need
to look at mind a piece of data recover
your data recovery platform they plug
the USB Drive into their computer now
not only did that a that USB Drive in
fact a computer but had infected the
computer of an administrator for your
systems and a domain level administrator
and all hell could break loose rather
quickly so one of the things this is
becoming more popular i mean i thought
this was pretty a stupid when we started
seeing this five or more years ago and I
kind of thought it would go away
USB drives are a little bit expensive to
give away and so I figured with the
spread of the internet you know more
people you know with high-speed internet
I figured USB drives are just one of
those things will be around for a couple
years and then disappear because frankly
if you need any information you can just
go to a website you can download a file
from a website you don't need things
like USB drives but in fact USB drives
are becoming more and more and more
prominent at these events and they are
just stupid for everybody involved from
a PR person standpoint again these are
kinda pricey little widgets and frankly
most of the time to get thrown in the
trash even if somebody isn't worried
about security and then from the the IT
person standpoint there's no way in hell
I would ever plug these into my computer
as you literally have no idea i say with
this this is simply an aide a drive that
they bought they put their information
on it and then they put their sticker on
the back so multibox right so you have
no idea
yeah whether the flash drive was
compromised before it went out of the
factory
you have no idea that some poor bastard
even if we're not talking about
espionage or any of that kind of stuff
you have no idea of some poor bastard
multibox they didn't get the the the
original flash drive infected then they
simply clone that original flash drive
and now a thousand people are gonna be
plugging these into their system is just
an overall bad bad bad bad day so on so
i would say if you get these USB flash
drives from any of these conferences
just simply thought they might want to
say no because you know hey why throw
away something you know why throw away
resource so if they offer them to you
just say no but if you are given they
are given to you just like just
completely and utterly toss them they
are not worth the risk because again you
know we start talking about things like
espionage remember you know major major
we talked about like nation-state
espionage and everybody was thinking
about the NSA you know everybody's all
worried about the NSA nobody ever thinks
about like the Chinese intelligence
agencies with Israeli intelligence
agencies are you know the Russian
intelligence agencies are any that kind
of stuff i mean how think about it if
you're in a company of 5,000 10,000
people that would be really nice for one
of those uh those countries or one of
those intelligence agencies to being
able to infect your system and see
everything that's going on right and
using little things like this you know
if you login to your computer with an
administrator level user account you
infected with whatever kind of malware
could be on this thing that is just
nastiness squared exponential
exponentially bad nastiness
so there we go that's the thing you get
these USB drives just throw them away
and if you are PR person please stop
giving these out again all these PR
people I guess think that's a really
good idea it's just not it's bad for
everybody too expensive for the PR
people and it's just the security there
so just say no to USB drives at
conferences it is a massive hacking
security vector just a bad bad bad idea