USB THREATS THAT CAN BE HARMFUL

One of the main threats to cybersecurity for a wide range of industrial process control networks is still represented by removable USB devices used for the spread of malware of all kinds. Here is an analysis of the USB-Borne Malware attacks

Removable USB devices, such as flash drives, used for the spread of malware of all kinds.  Even in the company. It is still a very important problem.

The threats affected a wide range of industrial sites, including refineries, chemical plants and pulp and pulp producers around the world, and varied in severity. In addition, 16% of the attacks were aimed at industrial control systems (ICS) and devices for the Internet of Things (IoT).

USB-Borne Malware: USB Drive as the Primary Vector for Destructive Threats

USB threats are real to industrial operators. What is surprising is the scale and severity of the threats, many of which can lead to serious and dangerous situations in sites that manage industrial processes”. Among the threats detected, in fact, samples of malicious code belonging to dangerous families of malware were found, including Triton, Mirai, Stuxnet and WannaCry, just to name the most famous.

Worrying results, therefore, which underline the need to never let your guard down when it comes to the IT security of industrial sites and the importance of always adopting advanced systems to detect this type of threat.

USB-Borne Malware Attacks: Expert Analysis

In the era of Industry 4.0 and IoT and Industrial IoT, it is quite impressive to know that one of the main threats to IT security for a wide range of industrial process control networks is still represented by USB devices.

Yet it is so. “USB peripherals actually represent an often underestimated corporate security problem. First of all, they pass the perimeter checks carried out by technicians to protect the network, allowing any malware to directly access individual PCs, on which sometimes the control can be less”.

Everything is facilitated by the fact that in companies one of the most widespread methods of sharing is precisely the pen drives: they are in fact used between colleagues to pass large files or by those who travel to carry data with them to be used on different platforms. Pen drive which, for the perception of users, are simple "vectors" to carry files and documents but which, in reality, have different potential for attacking the security protections implemented on the systems.

Technically, USB devices can not only contain malware - but it is now easy to produce USB sticks that, "pretending" to be keyboards or mice, can perform operations on the computer as if the user were to do them even managing to acquire administrator privileges, which a malware can do with greater difficulty. According to our consultant “this means that we can have the best antivirus or antimalware on the system but this will not be able to detect that some operations will not be done by us, but we can have a total security software that can protect you from such threats but by a device that simulates the operation of a keyboard. We can just see how with a few commands and a penny stick you can get control of a PC ".

With a consideration of the importance of the human factor, which in this type of attack plays a role of primary importance: "one of the elements most exploited by attackers is the fact that people are often unprepared to conceive the risks deriving from the insertion of a pen drive on one's PC, in particular if this pen drive comes from sources that are not certain or even unknown.

In this regard, the experiment conducted during the Black Hat conference is significant during which the researchers distributed about 300 pen drives in the most disparate places (universities, offices, parking lots and public parks, etc.) by inserting a "good" malware inside, whose sole task was to communicate to the researchers the inserting the sticks into the PCs of those who had found them. The result of the experiment is impressive: almost half of the pen drives were inserted, by those who collected them, into the PC to view the documents and open some of them. The "victims" were then immediately informed of what had happened, explaining that it was a totally harmless search that they could indeed have supported by returning the pen drive and communicating the reasons for which they had trusted to take the pen drives home or to the office and open the documents contained therein.