USB Archives - L2 Cyber Security Solutions Ltd.

NUI Galway Data Breach – Lessons learned?

Liam — Wed, 21 Nov 2018 10:16:35 +0000

The NUI Galway data breach that was revealed this week is concerning. Particularly the initial reports about the breach, which weren’t very clear. If you hadn’t already heard, a USB memory stick was mislaid. This memory stick may have had personal data on 5% of the student population. This 5% of an 18,000 student population gives us approximately 900 individuals being impacted by this breach. That personal data may have included exam results, as reported by the Irish Independent.

While the University is unclear on the contents of the portable device, it may have held a file containing names of approximately 5% of the student body, their student number and exam results.

It’s the uncertainty that is most worrying to me. Also their claim that they have strict policies in place relating to portable devices is a bit disingenuous. I’ve been through the policies and also looked at their data protection section and found some conflicting direction with regard to data handling and USB memory sticks.

The Data Handling Policy states the following about “NUI Galway Highly Restricted” data:

Storage of this data outside of the source system, for example on a laptop or memory stick; must be approved by the data owner. Where data is held outside the source system it must be encrypted.

That seems quite sensible, as approval would mean that somebody would know exactly what data is on there and it would then be encrypted. However their Encryption policy, has something else to say on USB memory sticks:

Portable storage capability such as DVD’s, CD’s and USB flash drives should not be utilised for classified data storage or transfer, even in an encrypted format.

So the handling policy says it’s fine, but the encryption policy says no. It’s obvious that the data handling policy wasn’t followed with this data breach.

I thought it interesting that they have plenty on their site for how to use USB memory sticks and the protections they have in place.

ISS have disabled Autorun on the all computers in the PC Suites as a precautionary measure to prevent the spread of viruses. When autorun is disabled, a USB memory stick or software on a CD or DVD will no longer automatically start when inserted.

So that’s great … lots of protection there … or maybe not. What if the USB device impersonated a keyboard? It could inject keystrokes that open up a command line, execute a command to download dodgy software and execute it. I’m not making this up. The USB stick could also fry the electronics on your computer. Again this is something that happens.

These USB memory sticks are such a problem from a data breach perspective that I always recommend companies and organisations to either block them completely or put in place a solution that automatically encrypts all data on them.

I did dedicate an entire commandment to USB memory sticks. So you can get my deeply held views in there.

The NUI Galway data breach was an embarrassment for the University. I don’t think the exam results could be classified as sensitive personal data (special category). But I’m sure students wouldn’t like these been released publicly. As long as the powers that be learn a lesson from this sorry situation and implement more rigorous technical solutions, then it will hopefully prevent future, larger and more sanction-worthy breaches.

Lets be careful out there.

#SecuritySimplified #GDPR #SimpleGDPR

The post NUI Galway Data Breach – Lessons learned? appeared first on L2 Cyber Security Solutions Ltd..

Heathrow’s dangerous data breach

Liam — Wed, 01 Nov 2017 15:29:54 +0000

You may not have heard about this, as it emerged on Sunday. There was a data breach relating to Heathrow Airport. A fully accessible USB memory stick was found on a London street. This memory stick had some 2.5 Gigabytes of data on it, in 174 documents. All of the documents were readable. Some were marked confidential.

The following was the type of data on the memory stick:

Routes through the airport and security measures for royalty and VIPs
Security patrol timing
Locations of CCTV cameras
Types of ID card required for different areas
Escape routes for the Heathrow Express railway line
Details of the ultrasound detection system that protects the perimeter fence

Just like the Swedish Government’s data breach (the third story in this post), this sort of information, falling into the wrong hands is incredibly dangerous and could have cost people their lives. I don’t say this to be hyperbolic. If a terrorist organisation got their hands on this data, they could have planned a highly effective attack on Heathrow.

It is plain madness that it was possible for the information to be placed onto the USB memory stick in the first place. For an organisation that has to consider likely terrorist threats, they should have the strictest information security measures in place. There are easily implemented technical solutions to prevent use of unauthorised USB devices. These solutions can also be set to automatically encrypt any information that is stored on authorised USB devices.

Heathrow Airport authorities are obviously investigating this incident. Perhaps they do have these type of solutions in place and that it might emerge that it was an external contractor what done it. Sometimes when external contractors are brought in to do specific pieces of work, their laptops might not have the same security measures applied as would be the case for an employee. In scenarios where you are dealing with the security of people’s lives, you need to have the strictest policies and procedures applied to all who work on it.

As a final comment, the person who found the USB memory stick on the street was wise enough to plug it into a computer in a library rather than their own home PC or Laptop. Maybe they had read Commandment 9 and didn’t want to risk potentially infecting their personal equipment. ?

The post Heathrow’s dangerous data breach appeared first on L2 Cyber Security Solutions Ltd..

What Ophelia taught me about power.

Liam — Thu, 19 Oct 2017 10:54:59 +0000

Hurricane Ophelia came to Ireland this week and caused quite a lot of damage across the country. Trees were blown down. Roofs were ripped off. The electrical power supply grid was widely disrupted. The area where my office is, had no power for over 48 hours. I was very impressed at getting the supply restored so quickly. When Storm Darwin hit on February 12 2014, there was no power supply for 6 days and after a few hours, it was gone again for another 2 days. So it’s a big thumbs up from me for ESB Networks getting me back operational so quickly.

Since we were warned so far in advance about Ophelia, I made sure to be as prepared as possible. I charged up my supply of rechargeable batteries for torches and the radio. I made backups to the cloud regularly throughout the morning of 16th October. I kept my phones on charge as well. When the power finally went out and I was running on Uninterruptible Power Supply (UPS), I made one last backup to an external disk. I then shut everything off and waited out the storm.

One of the problems of being in a rural area, is there are very few mobile network cells serving the area. A couple of hours after the power went out I lost coverage from Vodafone. I only had “Emergency calls only” showing for service, which mean’s some other provider was still operational. That didn’t last long and I had “No Service” by Monday evening. It was this that caused me a little problem. The battery on my phones seemed to drain a lot more quickly. I got a low battery warning on my personal Samsung Galaxy S4 (elderly, but dependable) by 9:00pm. It should have lasted until the following afternoon. Perhaps it was using up power trying to find a network to connect to.

I wasn’t concerned, as I knew I had one of these car cigarette lighter USB gizmos in the car. So I switched the phone to Flight Mode (to stop it looking for non existent networks), went out the car with my USB charging cable, opened the glove box and … nothing! There was only the car manual and a spare headlight bulb. Then I remembered. Last year, I’d given a loan of it to a friend who was going on a touring holiday in Europe. He had forgotten to give it back to me.

Fortunately I remembered that I happened to have one of these little USB power packs, which I had charged over the weekend. So that saved my Samsung. My business phone, a Google Nexus 6P, was in better shape battery wise when I switched it to Flight Mode. I was confident of it lasting until I got to my alternate location the following morning. However it raised a question in my mind. Would I be able to use that same USB power pack to charge my Nexus, if I needed to?

The answer is no. It’s not a power issue either. It’s to do with the type of cable. The Nexus charging port is a USB Type-C and both ends of it’s charging cable are just the same. So I have nothing, other than it’s three-pin adapter, that I could use to charge my Nexus with.

On Tuesday morning, as I was en-route to work in an alternate location I picked up a USB Type-A to USB Type-C cable to be able to use the battery pack or my laptop. I also got a 300 Watt inverter (below), that I could connect to my car’s battery and get a 3 pin plug socket, which I could connect an extension lead to and then have enough juice inside the house to run my laptop and charge both phones at the same time.

I’m very fortunate that I can run my business with just my laptop and mobile phone. I’m also pretty well prepared from a Business Continuity perspective. However the real life test that came with Hurricane Ophelia highlighted that I made an assumption that I could power my mobile phones from my car, when I could do no such thing.

The lessons learnt here are:

When you are preparing for a business disrupting event, check everything! Do not assume that something is where you left it.
Have alternate methods of charging mobile devices where possible, particularly if they have different types of cables.
Finally, if something forms part of your business recovery plan, don’t give it on loan to your friends

Be prepared.

The post What Ophelia taught me about power. appeared first on L2 Cyber Security Solutions Ltd..

Snail mail delivers USB keys … WTF?

Liam — Fri, 23 Sep 2016 00:09:08 +0000

I find I’m writing a second article about Evil USBs within a week. At least these ones don’t destroy your equipment, but they might infect you with nasty software that does things that you really wouldn’t want it doing.

In this case, in Victoria, Australia, Evil Doers were dropping USB drives into people’s mailboxes. The report from Victoria Police stated:

Upon inserting the USB drives into their computers victims have experienced fraudulent media streaming service offers, as well as other serious issues.

The USB drives are believed to be extremely harmful and members of the public are urged to avoid plugging them into their computers or other devices.

That reference to other serious issues, is quite likely a Ransomware incident, where all of the files and folders on the victim’s machine gets scrambled and they have to pay the bad guys good money to get their data back.

A 2015 study conducted by a group of researchers from the University of Illinois, the University of Michigan and Google revealed that nearly half of people would not only plug a USB drive they’ve found on the ground into their PCs, but would also open files and click on unfamiliar links.

Now in this study’s case, the USB sticks were dropped on the ground and people’s reasoning behind accessing the memory sticks was generally for the altruistic purpose of identifying it’s owner in order to return the device to them.

In this new case in Australia, the devices come wrapped in plastic, so would appear to be brand new devices, just left in by some generous benefactor.

Look folks, it really is simple. As I stated in my 9th Commandment – Thou shalt never insert nor allow to be inserted, a USB memory stick that thy hath never had complete control of since it was removed from its packaging.
Now in this case you could be forgiven for thinking they are still in their packaging. The packaging I refer to was coming from a retail or on-line store.
But really, somebody is just going to drop a USB memory stick in your mailbox because … what …

You’re a good customer? (of whom?)
You deserve it? (why?)
It was a mistake (it wasn’t!)

You don’t get stuff for free without a good reason. Just fu… fire this stuff in the bin and get on with your life.
And let’s be careful out there.

The post Snail mail delivers USB keys … WTF? appeared first on L2 Cyber Security Solutions Ltd..

A desktop/laptop killing USB device is on sale for €50.

Liam — Fri, 16 Sep 2016 10:50:28 +0000

As I’d mentioned in the detail section of a previous blog post there was a prototype USB memory stick that is designed to fry the electronics on a laptop or desktop, the instant it gets plugged into it.

Well it’s now something you can buy for as little as €50. The worrying thing is, as of today (16th September 2016) they are out of stock!

What purpose does this device serve?

According to their website “The USB Kill 2.0 is a testing device created to test USB ports against power surge attacks. The USB Kill 2.0 tests your device’s resistance against this attack.” Unfortunately in testing your device, this stick literally kills it!

They separately sell a “Tester Shield”, which you plug into your PC’s USB port, before inserting the killer device. This stops your machine from being fried. If, as they claim their reason behind releasing this device is to test your PC’s resistance to a surge attack, then why don’t they have a single combined shield/killer stick that does the test, but without killing the victim machine?

It’s simple – they know that nobody would buy such a combined unit, because I don’t expect many people would actually carry out such a test. However they may be very interested in being a malicious thug and go about killing people’s machines.

Interestingly Apple devices appear to be immune to this, as they have their USB ports wired differently to the way the rest of the world seems to have them wired. So if other manufacturers make the change to prevent such a device being effective, this will take several years to wash through, such that you end up with a desktop or laptop that is not vulnerable to this type of attack.

So as I mentioned in my original blog post, never insert a USB stick into your machine, unless you have had it in your control since the day you removed it from it’s packaging. Don’t let anybody else insert a USB stick into your machine – even your IT folk – especially your IT folk. You just never know where it’s been.

But keep a special lookout for this little beauty!

The post A desktop/laptop killing USB device is on sale for €50. appeared first on L2 Cyber Security Solutions Ltd..