In January, 2007 TJX  Companies Inc, reported an incident of major breach of CCN and NAA records.  Data Loss DB reported that more than 94 million records were stolen by extremely sophisticated hackers who were able to bypass the data security used by the company.

The detailed news is available on the following link

http://www.theregister.co.uk/2010/05/14/tjx_hacking_suspect_arrested/

Sergey along with 10 other men were charged in August, 2008 for hacking into TJX network and stealing millions of credit card records.

An example will be, opening the command prompt on windows and then flushing your DNS cache, within a flick of a second which will be absolutely difficult to notice. The dangerous part is that, it can also be used to format one of your drives in a flick of a second.

Since, we have mentioned about it on data loss blog, we could also give you an example of data loss though this new device. Consider, a modified version of rubber ducky, which also has a flash storage in it. It will take a simple command to copy all you documents on to this flash storage by emulating a keyboard and executing the copy command.

The most concerning thing about this device is, that , since the device has its own small processor, which makes itself a computer which then communicates to your computer through a usb port, it can actually work on different platforms other than windows, like Mac, Linux etc.

Here is how a USB rubber ducky looks like ?

So, be careful if see something like this next time in your office.

Gradually you end up opening ports one by one. Sometimes you remember to block it back once you purposed for opening it is solved, and sometimes you just forget about it. What happens when the number of machines in your computer network is huge, something like more than 5000 windows machines or may be 10,000. In case of defense organization it definitely will be more than 25,000.

With the introduction of next generation portable devices, security of data in a computer network is supposed to go even worse. Think about tablet PCs and all sorts of portable devices claimed to be small and a version representing a transition from laptops and PDAs to something between laptops and PDAs.

US defense issued a policy to block all kinds of portable media devices like USB drives, memory sticks, SD Cards, Portable hard drives, thumb drives etc. The ban was issued in November 2008 by the U.S. Strategic Command after a virus, a variation of the SillyFDC worm, was found to be spreading through military networks by copying itself from one removable drive to another.

read more about this story here

However, if you forget the administrator’s password for uninstalling the software, there is no way to uninstall the application. uHook USB Disk Security is not the only application which blocks uninstallation with password authentication, but, there are plenty of other softwares in the market as well. These kind of features are provided just for the sake of user’s own security.

So, next time when you install uHook USB Disk Security, please make it sure that, you remember all the passwords.

autorun.inf viruses uses the autorun feature of microsoft Windows to spread itself on computers wherever autorun.inf is enabled.The virus then, makes a copy of the autorun.inf file to the root or main directory of all the drives on your computer, internal and / or external disks including sd cards, pen drives, ipods etc, to make the virus runs every time the external disks like pendrives or USB drives are inserted or every time you double-click the drives through the windows explorer.

There are five different ways you can block usb drives from your pc:-

a. Using commercial softwares : There are several applications available on internet which can help you block your usb drives from unauthorized access. The cost ranges from 6 USDs up to around 90 USDs depending on the kind of flexibility and control you need. It is recommended that whenever you go for a commercial usb security application be careful to analyze all the features available with that application, otherwise you might end up paying more for lesses  features. Avoid using new products because sometime, it might also make your system unstable. If you going for an enterprise wise USB security application with a commercial product, test the trial version of the software either in a virtual machine or a test machine

b. Through windows registry tweaks : You can follow following steps in order to block usb storage devices from registry  provided, you have the administrator rights on the machine :- (warning : Please be careful while editing the registry because if you make a mistake accidently, your system might become unstable):-

1. Click on start and then click on run

2. Type regedit in the textbox that appear and click ok

3. A registry editor window will open up, where you have two panels each on the right and left

4. Click on HKEY_LOCAL_MACHINE on the left panel, a list will open up

5. Click on SYSTEM on the opened up list and then click on CurrentControlSet in the new branch of list that opens up (see the picture below), then again follow the same with services until you can see a usbstor in the list

 

blocking usb drives with registry

6. Click on usbstor, and then double click on start on the right pane, a pop will appear as shown in the picture below

blocking usb drives with registry

7. Change the value field to 4, select the radiobutton to hexadecimal(if it is not already selected) and press ok

8. Quit the registry editor and you are done.

c. By making changes in the bios : Nowadays, most of the computer manufacturers supports the feature of disabling USB ports from bios.

 Follow following steps to disable usb from bios:-

1. Boot your pc

2. Press F2 or whatever shortcut is there on your PC to access the bios

3. Go to advanced tab on the bios and look for USB Port

4. You should be able to find out an option for disabling usb ports

5. Save and the bios settings and reboot the machine 

User might go back to bios and re enable the usb ports, so, you should also set bios password in order to prevent that. But, then again, opening the chassis and placing the bios battery after removing it will reset the bios password. You might consider it to be an issue of physical security.

d. Using glues to block the USB ports 

Carefully fill all your usb ports with a thick epoxy adhesive . But, this technique might damage your system and you will not be able to use even the necessary usb functions such as printers which are connected to usb ports etc. This method is highly not recommended.  

e. Physically removing USB ports from your PC

Although a bit difficult, but you might also consider physically removing usb ports from your motherboard. If the usb  port is onboard, then, there is a very high risk that you end up damaging your motherboard because you will have to use a soldering machine to carefully take out the USB ports. This technique faces the same disadvantages as blocking the usb ports with glues because you will never be able to use your USB ports for necessary functions such as printing etc.

A great new Monday morning! Ben was busy updating himself about the status of the work when he realized that something was missing from his pockets. His purse?  No! His credit card?  No! A chill went through his spine with blazingly fast thoughts of impending consequences. Ben realized he had accidentally left his pen drive in the cab. The company employee payroll data with a collection of social security numbers in now free to be surfed upon by 1 billion people of this world on the internet. Ben once told that his favorite USB drive had made his life easy for sure but now he realized that the same USB drive might make his life highly miserable. Well there goes down one more fan of USB drive!

Even more surprisingly there is at least 1 Ben in every company in this world. And every Ben either had the same experience or will have the same experience in the future. The problem with most of us is that we think we are immune to these kinds of incidents until one great day the same thing happens to us.

It is not necessary that sensitive data will be always stolen from the company. In other cases, employees tend to misplace or lose data unknowingly which leads to the loss of the company itself.

Nowadays IT managers focus more on IT administration, IT maintenance and governance and Management Information Systems. But the most important fact is that even if IT infrastructure is there to store and process data but as long as the data is not safe, IT is useless no matter how fast it processes your data, automates business processes and accelerates your business. Protecting business is as important as making it grow.

As a matter of fact, each and every company should set aside a part of their annual budget exclusively for information security and Data Loss Prevention, be it through Physical end-points like USB drives, CD/DVD, printers or through Network paths like Emails or Instant Messengers.

In a preview interview with Dark Reading, Gartner security analyst Adam Hills said that security projects and functionality are gaining attention in the corporate boardroom and claiming a larger portion of the IT budget pie. “IT spending in 2009 is basically flat, with some companies making cuts, but we’re seeing security spending increase slightly,” Hills says.  “If both of those hold true throughout the year, then it’s clear that security spending will end up comprising a larger portion of the total IT budget [than in 2008].”According to Gartner, most importantly,  security is gaining attention at the highest levels of the organization.

IT Security spending is increasingly becoming a Board-Level Decision.

From the words of times of India:-

“On June 24, someone who goes by the name Praveen Rai walked out of two branch offices of State Bank of India in Mumbai, pocketing a cool Rs 90,000 that he had allegedly siphoned off the account of a Kolkata-based trader. The crime shook not only the businessman, but also the city’s police and e-fraud experts. For, the next target could be you. Or just about anyone doing e-banking. Police are desperately looking for Rai, who is believed to be in the early 30s. They also have a photograph of him (the one he submitted to open the SBI account), but more than a month after the crime, there is no trace of him. The victim, trader Akhilesh Bagla, is probably the first from the city to have had his account hacked. But it opens the risk of a racket operating in the web world. ”

Now, if we look into the incident closely, it turns out that at some point of time, the culprits had access to the bank account details of the victim including the internet banking id and password.

How did they get access to such information?

Either the victim himself gave them the information or the information came from somewhere else. It might be suspected that, an insider trading of confidential information happened. And a usb thumb drive could have been one of the tools used by the culprits to achieve their mission. The possibility of using an email could also not be ruled out. But, most of the businesses now a days use their own in-house emailing system along with monitoring all inbound and outbound emails.

Some of our so called IT security experts comment that “I think the bank account was hacked”.

But, there is a very simple logic to make you understand that any kind of hacking or network penetration was not attempted in this case. Why would a hacker take so much pain to gain access to the gateways of SBI, penetrate into the network and then, when he has access to all the bank accounts selects only one of them to steal some 2.6 Laks of money.

So, what we conclude now is that, there was loss of information somewhere which was only limited to a particular bank account which led to this incident. And , if we want to avoid such incidents to happen in future we need to fix all our security holes both at the network level and at the end points.

1. Why would an unknown person send me her photo on my email?

2. How did it came to my inbox after bypassing the anti spam?

Now, at this point i should tell you something which you might already know, that this is a typical kind of spam attack, which you might also be getting in your inbox. In this case, it was something more than a spam attack because, i was sent a yahoo page, not a website of viagra pills or free cosmetics etc. So, i decided to dig it further and opened that hyperlink in a virtual machine.

When the webpage appeared, it looked like a genuine yahoo login page with yahoo photos. I didn’t understand one thing, that if the sender wants me to see her, why didn’t she sent me her photo as attachment. Anyway , i entered my yahoo email account and a wrong password, suddenly a pop up add came on the screen. It was related to some low cost online software website. But, yahoo never gives popup on the login screen as far as i know. Till this point i never looked at the address bar. When i saw the address bar i could immediately figure out that it is a fake page and someone is trying to get hold of my password. So, what i concluded about this mail is that, it was a combination of two attacks, first one is obviously spamming and the second one , identify theft.

If i would have been unaware of IT security stuff, i might would have fallen prey to this spam . I am into software security and understand these stuffs related to phishing ,password hacking etc. But, had it been someone who don’t know about online thefts of passwords, privacy and data etc would have been a victim of this mail.

I was one of those billions of users who would have got this mail. Even if we assume just 10% of the users are fooled by these kind of spams, just imagine what a spammer will do if he has access to the passwords of millions of email accounts. Taking an average of 100 contacts in the address book, every attempt of this attack will keep on fetching the attacker huge number of email account, usernames and passwords.

With increasing usage of different kinds of USB storage devices and uncountable number of cases of data theft through USB drives, products like uHook USB Disk Security are definitely going to go a long way in solving these problems. Besides, apart from internet, the second major source of virus spread is USB storage.We are in a world where we can’t just live without USB storage, to name a few, IPOD, Flash Drives, SD Cards, Digital Cameras, Cell Phones, external Hard drives are some of them and many more, waiting to flood the market very soon.

Not only uHook helps its users block all malicious/unknown usb devices, monitors all activities of file copy operation and blocks virus and worms by blocking autorun.inf, but the solution also blocks malicious users from uninstalling it. Because, whenever a person tries to uninstall it, he should have the password which is assigned only to the actual user who installed the application.

Besides, the solution is designed in such a way that any tempering with the install files or the software will render all the USB storage device completely blocked on the system until the administrator runs a fresh installation. There are a lot of vendors selling USB security solution, but each one of those miss out one thing or the other to provide a complete and perfect solution. Besides, none of these applications provide real value for money as the cost of these solutions are far above an end user can afford. Paying above 50 USDs is too much to ask for a USB security solution.
With perfect pricing(21 USD), small download size(around 1 MB) and all the features an end user wants in a USB Security product, uHook USB Security seems to be the most promising solution in the online marketplace for windows.