Removable Media: Another Cyber Attack Method You Need to Be Cautious Of

Cyber attacks are a challenge for every organisation, large or small. Being able to tackle cyber threats, great and small, is often of critical importance to cyber professionals. After all, a hack may not just cost time and money, but also the loss of sensitive customer data.

In recent times, we’ve seen a focus on online attacks – however, attack vectors can come from all sorts of directions. For keen-eyed cyber professionals, such as those who have completed a Graduate Diploma Cyber Security, understanding the many possible ways systems can be compromised is helpful when developing strategies to protect sensitive data

In this article, we’ll explore the peril presented by physical hacks, specifically, those conducted with removable media. How do bad actors leverage curiosity to access systems, and can anything be done to protect businesses?

The Eternal World of Cyber Threats

The digital world is constantly under threat, and in today’s society, the lure of valuable data has made computer systems a lucrative target for hackers and other bad actors. Ordinary Aussies generate gigabytes of personal information every year, so access to private systems represents a treasure trove that attackers want, and defenders need to protect against.

In recent years, a number of cyber attacks have demonstrated how data can be a boon for hackers and other bad actors. Attacks such as those against Medibank Private and Latitude Financial Services have shown how hacked information can be used for nefarious purposes, such as through the leaking of sensitive medical records for blackmail purposes or using personal data to commit fraud and other forms of identity theft.

What is Removable Media?

Removable media is a technology that often feels like second nature in our personal lives. Simply put, removable media includes any technology that provides storage that can be added or removed from a computer while running.

Why would having portable storage be beneficial? Of course, the answer lies in the wide and varied nature of our connected devices. For example, a portable hard drive may provide a convenient way to back up and save data, or an SD card may provide a quick storage boost for a digital camera.

Modern removable media has been a staple of computing for the past two and a half decades – with devices like USBs and SD cards providing remarkable flexibility for end users. They allow us to do things that were once considered time-consuming – such as saving and transferring large files between computers, without needing expensive cloud storage services or managing slow internet speeds.s.

The Challenge of Removable Media

It’s important to note, however, that while removable media can be incredibly beneficial for business, it also can be a vector for attack and infection. With removable media being famed for its ease of use and connectivity, it has emerged as an avenue for attack – with devices leveraging the connection between the device and the computer to execute all sorts of nefarious activities.

For example, some devices, such as Hak5’s USB Rubber Ducky, can masquerade as removable storage while executing a type of cyber attack known as a keystroke injection attack. A device like a Rubber Ducky can deliver malicious code such as malware and instructions directly to a computer by impersonating a keyboard when connecting to a computer, potentially allowing a bad actor to open up a connection to their computer, scrape and transmit confidential information, and more.

Because it can be difficult to tell the difference between a malicious USB and a safe one, many people often feel lulled into a false sense of security – assuming that people have just made a mistake and lost something rather than thinking that someone is intentionally trying to gain access to their device.

In a study presented at the IEEE Security and Privacy Symposium, researchers found that in a test of 300 USBs dropped on a university campus, nearly half were picked up and plugged into a computer system—some in less than ten minutes. This level of trust in unknown hardware represents a challenge for even the most seasoned security professionals – so what can we do to protect ourselves from removable media attacks?

How Can Businesses Protect Themselves?

Fortunately, there are a number of ways to protect businesses from the perils of malicious USBs. The first port of call, naturally, is education. By educating teams to be cyber aware, companies can help reduce the likelihood that suspicious removable media is connected to a company system due to curiosity.

There are several avenues that cybersecurity teams can also take to protect hardware, too. Programs that manage endpoint security can protect data from unauthorised access – potentially stopping malicious code from ever entering sensitive systems. Disabling default features such as USB AutoRun can also help stop the spread of USBs – and may be a critical line of defence against malicious actors.

Cyber attacks remain a constant threat for even the most watchful security teams. As removable media attacks become increasingly common, workers must know what to look out for – to protect themselves from the next big hack.

Author Profile

Adam Regan

Deputy Editor

Features and account management. 3 years media experience. Previously covered features for online and print editions.

Email Adam@MarkMeets.com