Beware the iPod 'slurping' Employee 390
Zoner12 writes "CNet is reporting that Abe Usher has created an application that allows an iPod to scan corporate networks for files likely to contain sensitive
business data and download them, potentially stealing 100 megabytes in a few minutes. An insider threat would only need to plug the iPod into a computer's USB port."
Oops (Score:5, Funny)
Re:Oops (Score:2, Funny)
--
503 Sig Unavailable
Perhaps for this article you meant 404 or 410, or perhaps we need
416 Content 'slurped' by iPod
In other news... (Score:5, Insightful)
Re:In other news... (Score:3, Funny)
Re:Store analogy was terribly naive ... (Score:5, Funny)
Re:Store analogy was terribly naive ... (Score:3, Interesting)
Along the same lines, if you don't trust an employee having access to certain data, that employee should never have read access to that data. If you can't read it, you can't copy it to an iPod. If you can read it, you can steal it... via iPod, floppy disk, e-mail, or even by printing it. This software is just a tool, and the biggest lesson here is that corporate networks are often not secured proper
Re:Store analogy was terribly naive ... (Score:3, Funny)
I tried to copy all your money to Steve Jobs, but his bank refused to, "fiddle with small change". Bastards. :(
Oh! (Score:3, Funny)
I thought the story was about LARPing. That would have been much more terrifying.
Re:Oh! (Score:5, Funny)
"Johnson? That weirdo down in IT? I *knew* he was trouble when he brought that shiny, new iPod in here! What's he doing? Slurping our corporate data?!"
"Erm, no. He put on a cloak and wizard hat, and now he's chasing Shelley the intern around the server room yelling 'lightning bolt! lightning bolt!'"
"Sweet Jesus... this is worse than the time we found out we had a furry in accounting. Fetch my pith helmet and tranquilizer gun."
Business data? (Score:5, Insightful)
What I would consider much more useful is an application that can hunt
Re:Business data? (Score:4, Funny)
An application that does the opposite would probably be better: transparently offloading illegal
Re:Business data? (Score:4, Insightful)
Assuming you work in the US Windows-oriented world...
1) Where do you work that your IT guys gave you write access to administrative shares on the domain?
2) Do you realize that files have a concept of "owner", as well as a creation date, and that when you authenticate against the domain, a DC logs that?
Meaning that even if you could do it, which if you can your network admins need to "spend more time with their family", you'd leave tracks even an amateur could follow straight back to you.
Of course, similar ideas apply to the idea of an iPod sniffing around the network... Do most companies not limit "important" file access to people who actually have a reason to access those files?
Perhaps even more relevant - Would most people know what to do with something juicy? Unlike Hollywood's vision, you won't stumble across files named "fake_duplicate_set_of_books.xls" or "super_secret_corporate_takeover_plans.doc". "Real" juicy material takes a frickin' degree in accounting to make any use of... Just columns of account numbers, dates, and dollar amounts.
Re:Business data? (Score:3, Insightful)
And you've got kiddie porn on your ipod, why exactly?
Re:Business data? (Score:2)
Re:Business data? (Score:2)
One of my former coworkers added audio/video file types to the SMS inventory list on our network. It was a simple step from there for him to build a little web front end to a database query and *pow!* instant media library.
Re:Business data? (Score:3, Informative)
You can also have it inventory file types. What this guy did was inventory audio and video files; then you run a query against the information gathered. And as the grand-parent said, *pow!* instant media library.
Our org uses Altiris. There's a default check box to see how many times someone ran solitaire.exe, for instance.... Fun st
Re:Business data? (Score:3, Insightful)
I don't get it. (Score:4, Insightful)
Re:I don't get it. (Score:5, Insightful)
There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right? There's many people out there that don't have the interest in technology to really reach the conclusions that seem obvious here.
With something like this, I'd expect to see quite a bit more attention being given not only to mp3-players, but things like cameras and mobile phones as well. "Wake-up call" is a trite, overused term, but perfectly apt.
Re:I don't get it. (Score:3, Insightful)
There's plenty of places where running around with an external harddive would seem very suspicious (or an outright violation), but a music player is, well, just a music player, right?
In every secure area I've been in, any sort of external data-storing device is banned, unless you are given explicit permission to bring it in, or you have the proper credentials to be allowed to bring them in on your own (which subject you to a higher level of scrutiny). So, unless the security people and system admins are
Re:I don't get it. (Score:5, Insightful)
The iPod is just one of the many ways for data to walk out the door. PDAs are just as bad, and are probably the most commonly accepted data storage device let in the building short of cell phones.
All the technology does is make theft easier. It's just like the argument of guns.. it isn't the object that's dangerous, the object is only the enabler. It's the person using the object that makes it dangerous. ("guns don't kill people, people kill peope" -- "ipods don't steal company secrets, people steal company secrets")
In other words, if you are paranoid about your employees taking an iPod into work, why on earth did you hire them for a sensitive position? Them bringing that iPod in is, for the most part, completely beyond your control. (and the iPod is just one of many dozens of vectors to worry about) Whether or not you hire them (and let them, with or without their iPod, in the door) is totally within your control. Pick your battles wisely.
Re:I don't get it. (Score:3, Interesting)
Ok so what if I work for the cleaning service and watch one of your late-night employees get up and go to the bathroom. I simply get to his/her machine before the screensaver timeout and plug in. Boom in 2 minutes I have 60Gig of goodies that my employer hired me to gather from the competition.
It certianly looks like you do not think like a security specalist as that was the first thogh on my mind. Hell a good corperate harvester could easily talk the target into letting them plug in by asking in bro
Depends on the environment (Score:3, Insightful)
Re:Send it out as a ternary attachment (Score:5, Insightful)
Of course there is. Or you can hide an mp3 player in a bodily orifice. Or a concealed keylogger to grab your coworkers' passwords. Or break in from the roof, lowering yourself down a ventilation shaft, subduing the guarddogs with sleeping darts and finding the laser beams with cigar smoke.
But once you do any of these things, you are willingly and deliberately breaking your company's security policies. And a malicious employee is a different kettle of fish from someone not excercizing their judgement in what data to bring home for overtime work, or not thinking through that while their uncle sure would get a chuckle out of the boneheaded design of next years' model, perhaps taking the data out of the building to show him isn't a good idea.
A wordy, fuzzy data security policy can be misunderstood, its main points forgotten and its admonishments mentally filed under "it doesn't really apply to this case". A clear, unambigious, 'All devices need preapproval' and 'No attachements. No, not even of your newborn. No, no even if he really is the cutest thing anybody in the building has ever seen.' is clearer and easier to follow.
It's all a matter of what kind of thing you want to stop. A locked screendoor will not stop a burglar - but it will stop your nosy neighbour just walking into your kitchen or your children to walk outside. And chances are, you usually have far more problems with the latter kinds than the former.
Re:Send it out as a ternary attachment (Score:3, Funny)
Gosh no..heaven forbid!! Your neighbour could actually come in and say 'Hi!' to your kids! Your kids could actually go outside and see for themselves what Nature really looks like instead of watching Cartoon Channel. The horror!
People, if some of you really get off on living in a 'war zone' 24/7 where you can trust nobody, please do, but I'm outta here.
Re:Send it out as a ternary attachment (Score:3, Insightful)
In my neighbourhood, "Nature" is standing on the corner having a private chat with some guy who just pulled up in a Lexus. There is a broken beer bottle on the sidewalk, something which could be a needle lying next to it, and two of the local dealers are having a shouting match right across the street.
If you _really_ think it is a good idea for your three year old to
Less-than-competent physical security (Score:3, Informative)
There's nothing you could do with the iPod that you couldn't do with your normal computer and any random external hard drive [...] What's the big deal that an iPod can do it?
Because an iPod is a hard drive disguised as a music player, which may help you get past less-than-competent physical security in ways that you couldn't with a pure hard drive.
Re:Less-than-competent physical security (Score:2)
Re:I don't get it. (Score:2)
Re:I don't get it. (Score:4, Insightful)
The point is that any device that plugs into the USB port is a real threat, and this needs to be dealt with in corporate networks by assuming that any mounted USB drive of any sort is presumed to contain malicious code.
Re:I don't get it. (Score:2)
Didn't you know? iPods are magical!
Seriously though - there's nothing special about it - the same thing could be done with a flash drive or a CD burner.
The only thing special about it that I can see is maybe the app runs on the iPod and does it automatically for you. But I don't see how that's much different from running a simple VB app that does the same thing. . . I think one of the /. editors is just trying to conjure up some hatred of Apple.
Re:I don't get it. (Score:3, Informative)
In other words it's nothing very exciting (although this is a "limited" version of the program, there's no mention of what more the complete version does). The main point is that the iPod looks more innocuous than a plain external disk as everyone has pointed out.
Maybe if some kind of "autorun" file
Potential threat through USB/Firewire (Score:5, Insightful)
1. Can be attached to a computer without being suspect
2. Can run Linux with programs of your choice
3. Has a built-in mass storage system
Any open USB/Firewire port is a potentially huge threat to your whole system's security. If you look here: http://www.cansecwest.com/resources.html [cansecwest.com], you'll find a pretty detailed presentation on using iPodLinux to hack a computer (kill an X Window screensaver, here) through firewire, and another less detailed one on other DMA-attack vectors (PCMCIA and USB, mostly, iirc). So while it looks like this attack only uses characteristics 1 and 3 of the iPod, the second one is where the money's at (and requires a much larger investment).
Fill those ports with cement!
Re:Potential threat through USB/Firewire (Score:3, Informative)
I'm pretty sure the functionality you describe is only available to Firewire devices, not USB devices, because only Firewire devices can initiate peer-to-peer DMA transfers.
I am, however, waiting for auto-0wning Firewire dongles to turn up on the underground/import market...
Re:I don't get it. (Score:2)
Re:I don't get it. (Score:2)
I imagine if some thought was put into it it wouldn't be that hard to set up some logging rules that would flag behavior that looked like scanni
In other news... (Score:4, Insightful)
Naive to think treating people well protects ... (Score:3, Insightful)
The problem is that given the iPod's popularity it does not draw any attention. Even if someone notices that it is plugged in the thief may be able to dodge suspicion with a simple "I need to charge it".
Treat your employees well and they won't feel the need to screw you.
That is naive. Industrial / Commercial espionage happens. Greedy, self-centered, immoral
Thanks Abe (Score:5, Funny)
My iPod Christmas miracle (Score:5, Funny)
A few weeks later, after the Christmas holiday, I saw the president and asked if his son liked his iPod. He said "I decided to return it and got him something else." At first I felt like a heel because I probably caused him to go home and dig through his children's CD collections, confiscate those not meeting his approval and give them a stern lecture. But then it occurred to me that his kids are rich brats and I might have caused them some grief! Buwah hahaha! I felt so happy when I chose to Think Different.
Thanks Apple, your iPod filled me with holiday cheer.
heh (Score:2, Funny)
Re:heh (Score:2)
a "program" isn't needed (Score:5, Insightful)
Re:a "program" isn't needed (Score:2)
Actually you don't even need an iPod at all - ANY storage device would do just fine -- flash drive, portable hard drive, camera, cellphone (I think SOME cellphones have some sort of storage functionality through bluetooth so if the PC has bluetooth you might be able to transfer the data to your phone), non-iPod MP3 players. . .
Hell, if the files are small enough you could just e-mail them - many Web e-mail services allow up to 10MB or
Re:a "program" isn't needed (Score:2)
Just plug it in? (Score:3, Insightful)
Isn't this just:
1. Search for files containing "Confidential" or "sensitive" or "budget" or "payroll"
2. Copy to iPod
? Because I can do that pretty easily and more accurately than software.
Also, why the hell does everything have to have "pod" in the name? Now it's cool? Why can't people coin cool terms anymore??
Re:Just plug it in? (Score:5, Funny)
Why not block the USB port? (Score:2)
I'm not saying none do... but I work in a b2b company and we don't need it.
Re:Why not block the USB port? (Score:2, Informative)
More significantly though, this kind of thing really makes a case for Microsoft's Rights Management Services technology... even if you were able to copy the physical documents onto an iPod, they'd be completely useless to you outside the organization because they're encrypted, and only by talking to the RM
Re:Why not block the USB port? (Score:2)
Let me know when someone has come up with a way to protect C/C++ code (reference the windows source leak, the HL2 source leak etc) with this kind of technology...
Re:Why not block the USB port? (Score:4, Interesting)
Unofficially called... (Score:5, Funny)
Thank you, I'll be here all week!
Jds
Quick... (Score:3, Funny)
Locked Down USB Ports! (Score:5, Informative)
That means that USB keys, iPods, plug-in hard drives and so on not only fail to work here, but they generate a little message to the IT department.
Some users, like our media guys, need this access for their work (in this case, digital camera images), and they have an exemption.
This lockdown removes the possibility for portable storage device-based data copying.
Of course, I can always stay late, take the PC apart, remove the hard drive, take it home and copy it, come in early the next day and re-install it. But that's just naughty.
My point is that IT security policies can easily stop this sort of issue, and most large companies are already doing this.
Intrusion notifications in PCs (Score:2)
Email/http/ftp/ssh/vpn are also options, but that's rather easy to monitor for abnormally large amounts of data.
Re:Locked Down USB Ports! (Score:3, Funny)
Hey, information wants to be free. I mail things to the competition.
Now, I only use the computers of cow-orkers I dislike, but it's the thought that counts.
How to do it (nothing new) (Score:3, Funny)
Back in high school, I used a floppy and a couple batch files to grab
Man, I wish I knew it was called "pod-slurping" back then, I would have been WAYYYY cooler.
Re:How to do it (nothing new) (Score:2)
Heh. that's like learning Karate to kick a blind 98-year old cripple.
Yay sensationalist headlines on non-issues! (Score:5, Insightful)
CNET: "Abe Usher, a 10-year veteran of the security industry, created an application that runs on an iPod and can search corporate networks for files likely to contain business-critical data."
Actual article: "I've created an application (slurp.exe) that demonstrates this concept. When the program is run from an iPod, it can very quickly copy data files off of a PC and on to an iPod."
Am I reading it correctly that CNet doesn't understand the difference between launching an executeable stored on an external media device, and somehow running it "on" the media device? Am I the only one who thinks Mr. Usher could have been clearer, but intentionally wasn't? Or that both are playing it as "plug an ipod in, instantly hack a machine", like in the movies where magical devices "hack" systems?
It's sensationalist bullshit- all admins would need to do is set up windows to not permit mounting removeable media drives/USB mass storage devices. Or control what executables are permitted to be launched. I'm sure an expert Windows sysadmin could name half a dozen MORE system/domain level ways to stop this dead in its tracks. It strikes me as a distinct non-issue for any company with a properly managed/secured windows network. But hey, that doesn't stop CNet from crying "the sky is falling, the sky is falling!"
"Security consultant releases overblown vulnerability with a confusing and/or misleading description to generate hits to his website, more at 11"...
Re:Yay sensationalist headlines on non-issues! (Score:5, Insightful)
Re:Yay sensationalist headlines on non-issues! (Score:2)
I wouldn't bet on that. Hardware really can magically and (near) instantly hack a host: Don't trust yo [hackaday.com]
Why always the iPod? (Score:2)
The REAL story here is that... (Score:3, Interesting)
Maybe he went into Apple and "slurped" the SDKs using his application.... oh wait.
Re:The REAL story here is that you can run Linux (Score:2)
Re:The REAL story here is that... (Score:2, Interesting)
Even if you were able to create a program that actually ran on the iPod's operating system, which by all indications, you can't, that program certainly wouldn't have access to the files of a computer it was connecte
Re:The REAL story here is that... (Score:2)
That's true, but Sony and the other record companies wouldn't like that, because then their root k, oops, DRM software wouldn't work anymore.
Re:The REAL story here is that... (Score:2)
For example, you can make an autorun.inf on a USB device that points to an icon buried inside folders when the device is mounted. (XP will see the autorun and run the (apparently non-destructive) "icon=" line.
Re:The REAL story here is that... (Score:2)
Physical access (Score:5, Interesting)
Then a friend went to his local bank branch to get a personal loan. His salary records were all on his USB memory device (he works for an ISP who really try to avoid paper if they can)and he was allowed to plug his mempory card in to the loan officer's PC and run Acrobat to show her the documents.
Yep, on a bank PC, inside the firewall, with a USB stick of completely unkown provenance.
I bet their IT security guys would've had a fit, if they'd known!
Re:Physical access (Score:5, Interesting)
Fact 1: for the system to work, people have have to have access to the core financial applications.
Fact 2: people are stupid.
Fact 3: much (most?) hacking involves social hacking as opposed to trying to "break in" to a financial institution.
Connect the dots.
'Course, there is no way you could get anywhere trying to break into our organization through the front door, but sadly, a low-tech backdoor approach like this would probably work great.
Re:Physical access (Score:2)
I would argue that their IT "security" guys should probably have been fired then, for not disabling the USB port from within Windows. It's a simple Windows permission and can be done on a standalone workstation or through the entire network in Active Directory.
Depends on how their system works (Score:3, Interesting)
Re:Physical access (Score:2)
Eyeballs and a brain... (Score:4, Insightful)
Sooner you're going to have to trust your employees with your sensitive or confidential information, otherwise they're not going to be able to do their jobs. So maybe employers should...oh I don't know...hire employees that are trustworthy? Oh and quit treating them like felons...that way they won't be tempted to live up to your expectations!
I worry more about users losing their damn USB drives than using them to steal.
Re:Eyeballs and a brain... (Score:2, Insightful)
Re:Eyeballs and a brain... (Score:3, Insightful)
True. But no matter WHAT you do, there will always be that one assclown whom you cannot please. And who may walk out with your stuff.
Where do I get a 100mb Ipod? (Score:3, Funny)
I can use more disk space so I can watch Ashlee Simpson videos while I slurp data off the corporate network.
Ipod Alternatives (Score:2)
Brilliant! (Score:2)
CNET and Abe conspire to keep my iPod away..... (Score:3, Funny)
Stealing again? (Score:2)
It's not stealing because when you copy someone else's data, you do not take that data away from them. They still have the data after you have copied it.
Anyone suprised? (Score:5, Insightful)
Any company with a decent security model will be able to recognise a user who's file browsing habits are irregular, and classified documents shouldn't be kept in a public repository on a LAN anyway.
Arg!. then Arg! again. (Score:2)
Who gives a fuck? Oh wait... I know this one... people who dont know crap about security.
If your network services are secure, then its secure. If its not, then deal with !that!.
If your worried about peop
let them (Score:2, Insightful)
His server's almost dead (Score:3, Informative)
^- The Coralized version of the software.
nothing special about using an iPod... (Score:3, Insightful)
Or a thieving employee could burn a CD or DVD.
Or use a cellphone to store sensitive info, transferred from a PC via the Bluetooth connection used to support a wireless mouse.
The only real defense against employee theft is restricting access to sensitive data and minimizing the number of untrustworthy employees. That's the best that can be done.
Confused? (Score:2)
Both the article and the summary are poorly written in any event.
Are You Kissing Hollywood's Ass? (Score:2)
"Abe Usher has created an application that allows an iPod to scan corporate networks for files likely to contain sensitive business data and download them,"
I couldn't be bother to see such a movie. Harrison Ford playing the righteous man who just isn't going to take anymore and singlehan
This is not news (Score:2)
but...?! (Score:2)
Seriously though, in a corporate environment, USB ports, autoconfiguration, etc *should* be disabled (yes yes, we live in reality, not fairyland where that would be feasible).
Another case for DRM? If the ipod owner doesn't have the PC's (secure, in-built) private key, he can't read the company data... he'd have to steal the entire PC.
Alternatively encryption such as that included with Win2k (tied to the user
Total Bunk (Score:2)
TFA on CNET must be poorly worded.
Could somebody please explain to me how a program running on the iPod is suddenly going to become a USB host and then communicate with the (previously) host computer (which could be a Mac, PC clone, or anything with a USB port) to search for files even locally, let alone figure out which network protocols are installed so it can enumerate file servers on the network and the files which they contain.
Most likely this "program" is just an .exe or its equivalent living on t
easier than that... (Score:2)
with a hop, skip and a jump... at home I have Palm VNC over TCP/IP over Bluetooth to the Windows box, network connection shared to the Linux box, which is running DVArchive (a ReplayTV emulator) in a Java VM, which uses HTTP/UPnP to connect to my ReplayTV DVR, and I can change TV channel
Non-Story (Score:2)
brilliant (Score:3, Insightful)
What a dumbass. (Score:4, Interesting)
I'm all for the freedom to write software like this but shit, you have to be smart about it.
This *should* be a non-issue.... (Score:3, Insightful)
The *real* question is, why would employees have access to file shares on servers containing important documents they weren't supposed to have? If your business throws everything on shares that all users have read (or read/write) access to, they deserve what they get for not implementing some sort of security policy for the shares.
If you're an I.T. person who has full access anyway due to the nature of your job, again - so what? You're already able to burn the stuff off to DVDs at night and sneak them home or download them remotely over your corporate VPN or ??? The point is, companies have to place trust in their people to various extents. If they hired you as a sysadmin, they should have already done the background checking and everything else before hiring you - and believe you can be trusted. If you violate that trust - you screwed them, plain and simple. Implementing some sort of "no Ipod allowed!" policy won't prevent that.
Re:So what's the difference... (Score:5, Interesting)
One video game company that I worked for banned all portable storage devices since they didn't want any files appearing on the internet. The smallest file was 4MB for Gameboy Advance titles and the largest was 4.5GB PS2/XBox titles. I had to get special permission for my 32MB flash card since I was using that to store homework files for the programming classes I was taking at the time. Since half of the projects that I did was for the Gameboy Advance, I was always under suspicion that I might steal a file.
Re:So what's the difference... (Score:2, Interesting)
That's what your IT guys are paid to monitor. If someone is sucking down 60 GB of files at a time, that should ring some sort of alarm bell. Most sites I've worked at would raise eyebrows at a 500MB download.
Re:Thanks Abe (Score:2)
iPod, what's it all about? (Score:2)