416

Tech workers - what did your IT Security team do that made your life hell and had no practical benefit? (lemmy.world)

submitted 1 year ago by Krudler@lemmy.world to c/asklemmy@lemmy.world

233 comments fedilink hide all child comments

One chestnut from my history in lottery game development:

While our security staff was incredibly tight and did a generally good job, oftentimes levels of paranoia were off the charts.

Once they went around hot gluing shut all of the "unnecessary" USB ports in our PCs under the premise of mitigating data theft via thumb drive, while ignoring that we were all Internet-connected and VPNs are a thing, also that every machine had a RW optical drive.

(page 3) 50 comments

sorted by: hot top controversial new old

[-] vivadanang@lemm.ee 9 points 1 year ago

I dunno, gluing usb's in a super sensitive environment like that is actually logical; on the disc drives - they could disable autoplay as well though removing or gluing them closed would be preferable. USB is just such an easy attack vector where the individual plugging it in may not have skills themselves - it might be easier to bribe cleaning folks for example - or inject a person into a cleaning team. Ideally they would attack multiple nodes of your target's network via as many avenues as possible; which makes the network and vpn thing just silly indeed; perhaps they were waiting for someone to try something with excellent infosec / firewalls / traffic shaping. yeeeeah lol.

[-] SendMePhotos@lemmy.world 9 points 1 year ago

So like.. Unplug the mouse and plug in the thumb drive... Bam!

[-] Hobo@lemmy.world 7 points 1 year ago

That's obvious when a mouse or keyboard doesn't work. OP, and clealy other people in here, don't really understand the actual attack vector in play. They aren't using the USB as data storage, they are using as a cellular connected RAT and/or a tool to deploy a RAT to a workstation.

I think gluing usbs is dumb in just about any environment (disable them on the BIOS is the right answer), but attackers aren't using it to drag and drop files and then physically take the usb with them. They are plugging them into a workstation, or just leaving them in the parking lot and letting other people plug them in, leveraging them to get initial access, and then essentially abandoning them.

For example see stuxnet: https://en.m.wikipedia.org/wiki/Stuxnet

load more comments (3 replies)

[-] tractus@lemmy.world 8 points 1 year ago

I'm sure there are more elegant ways they could have disabled the USB ports, but this might have been partially to avoid users being able to accidentally compromise their device by sticking a thumb drive they found in the parking lot in to see what was on it. For exfiltration and VPN usage over the network there are other controls they can/likely had put in place that you may just not have known about

load more comments (5 replies)

load more comments

this post was submitted on 23 Oct 2023

416 points (100.0% liked)

Ask Lemmy

26890 readers

1433 users here now

A Fediverse community for open-ended, thought provoking questions

Please don't post about US Politics. If you need to do this, try !politicaldiscussion@lemmy.world

Rules: (interactive)

1) Be nice and; have fun

Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them

2) All posts must end with a '?'

This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?

3) No spam

Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.

4) NSFW is okay, within reason

Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either !asklemmyafterdark@lemmy.world or !asklemmynsfw@lemmynsfw.com. NSFW comments should be restricted to posts tagged [NSFW].

5) This is not a support community.

It is not a place for 'how do I?', type questions. If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email info@lemmy.world. For other questions check our partnered communities list, or use the search function.

Reminder: The terms of service apply here too.