Threat Intelligence

USB Drives Remain Critical Cyberthreat

USB thumb drives may be used less frequently than before, but they are still commonly used as infection vectors for a wide variety of malware.

Small USB sticks can mean big security troubles, according to a new report out today. While USB thumb drives have been overtaken by cloud services as convenient ways to move files from one system to another, they are still commonly used as infection vectors for a wide variety of malware.

"USB threats from malware to miners," published on Kaspersky Labs' SecureList, looks specifically at the threats posed by the pocketable devices. According to the report, the Windows LNK malware family is the top threat, with over 22.7 million attempted WinLNK.Agent infections detected. They affected nearly 900,000 users in 2017 and, so far, just over 700,000 users in an estimated 23 million attacks in 2018.

"USB devices may be less effective at spreading infection than in the past, due to growing awareness of their security weakness and declining use as a business tool, but our research shows they remain a significant risk that users should not underestimate," said Denis Parinov, anti-malware researcher at Kaspersky Lab, said in a prepared statement. 

It's a risk that can actually grow with added security. In an interview at this week's Ignite 2018, Rob Lefferts, corporate vice president for Microsoft 365, security, and compliance at Microsoft, pointed out that security procedures that add too much "friction" to business processes are the source of shadow IT. "If you make things too difficult, slow things down too much, it drives users to put files on a USB drive or go to their own cloud service. They're going to get their work done," he said.

Because USB sticks continue to get the work of carrying malware done, they have been frequent infection vehicles for malware families dating back as far as five years, according to the report. They are not simply vehicles for malicious nostalgia, though; the report notes that the USB payload can include cryptominers (often piggybacking on Trojans known since at least 2014).

USB drives are a global problem, but they're especially prevalent in developing nations that may see more use of the small devices. The report notes that nations with less-developed communication infrastructures tend to see more local incidents of malware, such as root drive infections, while areas with better networking are more likely to be targeted by cryptominers and other revenue-generating issues.

The report concludes with advice for minimizing the chances of malware infection through a USB drive. That includes being careful with unknown USB devices, investing in encrypted USB drives when they are necessary for business use, and putting a plan in place for checking every USB device (and every file on them) for malware prior to the files being transferred to any production machine.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/27/2018 | 3:31:08 PM
Re: USB drives?
Dr.T - you have an interesting style, taking one or two sentences for reply and bumping up about 7 responses.  True tech is FAR more sophisticated now than when 3.5" floppy drives were the world.  True that virus and malware is that much more sophisticated too.  I remember the Anna Kournikovia virus well.  I loved ZORK and those old games that are now long gone.  Some days i actually yearn for DOS 6.22 which was rock solid compared to today.  But the basic idea of taking something out of a pocket and slipping it into a slot and infecting is the same same same.  Just ask Bradley Manning.  
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/27/2018 | 3:14:08 PM
Re: Authorized USB's
Just media changes and the threats are always out there. I agree. Also threats got way sophisticated on that media.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/27/2018 | 3:12:56 PM
Re: Authorized USB's
I remember 20 years ago when we were warned not to put that floppy disk from Uncle Ed into a system That is true, impact was not that big at that time it is huge now.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/27/2018 | 3:11:37 PM
Re: Authorized USB's
You can then take the hardware regex's and white list the auth USB through DLP software or Endpoint A/V software. Yes, that makes sense. Authenticated USB may still be harmful tough.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/27/2018 | 3:10:29 PM
Re: Authorized USB's
o take it one step further for best security practice, your company should have a policy around authorized USB's Or as simple as blocking USB ports so they are not being used.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/27/2018 | 3:09:31 PM
USB drives?
I think it is not only unknown USB drives but the known ones that employees use in their insecure home computer and then plugging it in the work computer. That is a major problem.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
9/27/2018 | 10:31:51 AM
Re: Authorized USB's
Nothing new here only changing tech.  I remember 20 years ago when we were warned not to put that floppy disk from Uncle Ed into a system and run a program too.  THAT was a danger.  Just media changes and the threats are always out there. 
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/26/2018 | 9:47:41 AM
Authorized USB's
The end of the article provides sound advice. To take it one step further for best security practice, your company should have a policy around authorized USB's. You can then take the hardware regex's and white list the auth USB through DLP software or Endpoint A/V software. This will limit the scope of what can be plugged in and executed, in this discussion malware, on your machine.
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.