Warning over the danger of infected USBs
Nov 18 2010 by John Hill, The Journal
IF you frequently find yourself needing to shift data from one computer to another, there's a good chance you've got a USB stick hanging from your keyring.
However, Newcastle information security services company Issertiv says that not enough people are on the lookout for viruses before plugging in.
Issertiv founder Raza Sharif was formerly head of professional services at international internet security company Symantec, which produces the Norton range of virus protection software.
He says hackers are getting more creative in disguising their “Trojan horses”, sometimes hiding them on USB sticks daubed with faked company branding.
A recent study from security firm Avast Software said 13.5% of the 700,000 malware attacks monitored by the firm in the last week of October came through USB devices. Around 60% of malware can now be spread via USB.
Sharif said: “People are now used to thinking about USB sticks as a medium for transporting data from one computer to another. Because of the way USBs are used, there’s no additional thinking that it’s a medium for transporting viruses.
“USB sticks are almost a social weapon now, which if plugged into a computer can give a hacker unfettered access to personal data. It’s much more prolific now .
“Now hackers put a virus on the USB so that when that’s put into any connected computer it opens up a tunnel between that computer and the hacker’s workstation anywhere in the world.
“As a result the hacker will have more control than you over your workstation. We’re finding when we’re doing the testing for organisations that this is an area which is high risk.
“First of all, it’s important that users do not stick in a USB that they do not know. They should always look to encrypt their highly sensitive information on their laptops. In terms of the USB itself, the user should have some thinking about what might be on it, and should make sure it’s not plugged into a computer with a network connection.”
Cruddas Park-based Issertiv was set up in 2006, and now employs five staff. It deals with clients both in the UK and abroad, and helps organisations to maintain and improve security through services such as vulnerability scanning, penetration testing, monitoring and training courses. It also has an office in Saudi Arabia, and aims to have 60% of the information and security market in the UK by 2013.
