Security Market Segment LS
Wednesday, 07 December 2011 13:38

Don't buy that used memory stick!


A recent 'purchasing raid' on Sydney's RailCorp lost property auction yielded 50 memory sticks, 66% of which contained malware.

Paul Ducklin, Sophos' Asia Pacific Head of Technology spoke today of a project whereby the company purchased a random set of 50 USB memory sticks from a recent RailCorp lost property auction.

Two immediate outcomes were clear.

Firstly, that two thirds of the sticks were afflicted with some kind of malware (the worst affected stick had six different infections).  This probably means that you would either be infected by simply inserting the stick in your computer (although less likely now that Microsoft has disabled AutoRun in a recent patch) or definitely infected by opening a malicious file.

You DO have up-to-date anti-virus running, don't you?

Of course the second outcome is that Sophos technicians gained access to an absolute plethora of information regarding a large number of 'innocent' people.

Ducklin reports that they discovered, "4443 directly accessible files on the 50 devices including 2882 images, 629 source code files, 197 web files, 145 documents, 128 programs and 23 videos."

In addition, the files included:


  • Lists of tax deductions.
  • Minutes of an activists' meeting.
  • School and University assignments.
  • AutoCAD drawings of work projects.
  • Photo albums of family and friends.
  • A CV and job application.
  • Software and web source code.

So, think about it - what if the person buying these memory sticks was not a security researcher, but an identity thief instead?

The brief list of contents makes it clear that at least one message stick (the one containing a CV and job application) would almost certainly contain enough information for an identity thief to be off and running.  There are almost certainly others.

However, this incident brings to mind a couple of even more nefarious thoughts.

A well-known security researcher with whom I'm acquainted (no names, no pack-drill!) has been known to scatter a few memory sticks on the ground outside of the offices a company for which they have been contracted to perform a penetration test. 

Of course these sticks contained some specially crafted malware for remote access.  Needless to say, a successful intrusion was had every time!

With this in mind, what if the identity thieves (and even less nice people) were becoming more proactive and deliberately leaving memory sticks such as these on trains etc. in the hope that someone would take them home (or to the office) and instantly get themselves pwned.

It would seem the main warning here is "don't even think about using that stray stick - it's simply not worth it!"

Oh and by the way, Ducklin reported that NONE of the 50 sticks had any kind of encryption or other protection (not even a password-secured zip file).




26-27 February 2020 | Hilton Brisbane

Connecting the region’s leading data analytics professionals to drive and inspire your future strategy

Leading the data analytics division has never been easy, but now the challenge is on to remain ahead of the competition and reap the massive rewards as a strategic executive.

Do you want to leverage data governance as an enabler?Are you working at driving AI/ML implementation?

Want to stay abreast of data privacy and AI ethics requirements? Are you working hard to push predictive analytics to the limits?

With so much to keep on top of in such a rapidly changing technology space, collaboration is key to success. You don't need to struggle alone, network and share your struggles as well as your tips for success at CDAO Brisbane.

Discover how your peers have tackled the very same issues you face daily. Network with over 140 of your peers and hear from the leading professionals in your industry. Leverage this community of data and analytics enthusiasts to advance your strategy to the next level.

Download the Agenda to find out more


David Heath

David Heath has had a long and varied career in the IT industry having worked as a Pre-sales Network Engineer (remember Novell NetWare?), General Manager of IT&T for the TV Shopping Network, as a Technical manager in the Biometrics industry, and as a Technical Trainer and Instructional Designer in the industrial control sector. In all aspects, security has been a driving focus. Throughout his career, David has sought to inform and educate people and has done that through his writings and in more formal educational environments.



Recent Comments