Physically plugging in removable USB storage devices into DoD machines isn't the only way these devices pose a problem. Helping to prove my point, Addonics has released a slick NAS Adapter that turns most any USB storage device into a network storage device. Are you thinking what I'm thinking?
Let's say the DoD has taken technical or physical measures to prevent the use of USB flash drives in its managed desktops and laptops. What's to say an attacker couldn't take that same flash drive, plug it into one of these network attached storage adapters, and then connect to it using one many network protocols (SMB, FTP, BitTorrent, UPnP) it supports to then transfer sensitive data?
Taking the attack scenario a step further, what's the likelihood that there's an easy way to hack the firmware of the NAS Adapter to run a custom version with pen-testing tools that has limitless storage via the USB interface? Weaponizing a NAS Adapter with man-in-the-middle (MitM) tools like Ettercap to capture sensitive data transfers, or UCSniff to record VoIP conversations, would be an awesome avenue of attack. And the size lends itself to so many creative ways of hiding it, like behind a network wall-plate, the back of a Cisco IP Phone, and those covered by Larry Pesce of PaulDotCom.
I think I'm going to have to get one of the new Addonics NAS Adapters just to see what I can do with it. Oh, and for you paranoid types out there, it might be worthwhile to find out what MAC addresses the company has registered and start monitoring for them on the network, too.
John H. Sawyer is a Senior Security Engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.