USB devices unveiled.

While several stories about the dangers of USB devices in the workplace are making the rounds in the last few weeks, this is nothing new, at least to hackers and penetration testing experts. Reports of this style of data theft and compromise are becoming more of a threat every day. In today's media driven and gadget using society, not many people give a second thought about seeing a co-worker or user plugging in these seemingly innocent devices into workplace computers. Is that a camera in your pocket or are you just happy to see me? Even that camera that you brought in to show your co-workers the wonderful pictures of your dog doing tricks can be used to not only steal data, but hide such things as trojans and rootkits. Just like the restricted use of phone calls from the workplace, why would you allow employees to waste further valuable company tame by bringing in an iPod or digital camera to work, so that they may be used to circumvent your security policies?

Once one of these devices are plugged in it becomes trivial to simply launch the malware in one click. As of late we have been talking about the threat of insiders threatening your security posture, and this is no exception. We expect to see portable device malware that will infect these devices to be then unleased at will on everything they are plugged into, especially in the case of the newest autorun USB devices.

Perhaps what will become even more of a threat than the workplace insider is that of public access computers that many people use.

The simplest way is to turn off USB support by default during deployment directly in the bios of these computers and password protect the bios setup menu. One of the best rules to follow is "deny everything unless explicitly needed" and should be extended to any public or corporate asset.