Can somebody have stolen files and data from my desktop PC just by inserting a USB Flash drive in my computer, without dragging files over to the Flash drive?
3
-
You missed my point, perhaps I should clarify: said party brought a USB Flash drive with him, I put it into my USB slot, believing that it was merely for me to access a few image files he'd brought to me. I DID access 2 image files on his Flash (after my Windows 8 running PC recognized "new device" and I moused it, clicked and opened it). The point: my question, again, is COULD this USB Flash drive have been "slurping" data down from my PC, unbeknownst to me, WHILE I was viewing, and installing, the 2 images on the Flash Drive? It was 'inserted' for about 5 mins or less, in full view.– JackJan 25, 2014 at 14:55
-
1If it was a USB based flash drive: No. If it merely looked like one: Yes. E.g. see Hak5's rubber duck, which is designed to do these kinds of things. It just looks like a regular USB pen drive.– HennesJan 25, 2014 at 15:03
-
Hennes: I appreciate your engaging this discussion, but your response isn't clear to me. I'm watching a 'rubber duck' video now, but it's 15 minutes (I didn't use your link). Could we cut to the chase? Could this printshop employee, ostensibly helping me with image/text files for my manuscript, have been actually slurping down data onto his USB, EVEN THOUGH HIS HANDS NEVER TOUCHED MY KEYBOARD, and my Windows 8 system never had a pop-up box asking for authorization to Install anything? A local Techno-geek assured me that I was SAFE because these things never happened. I appreciate your time.– JackJan 25, 2014 at 15:33
Add a comment
|
2 Answers
Yes, easily. Removable devices (such as USB, or CD-ROM disks) have "AutoPlay" support on Windows. This is designed to auto-run installation CD-ROMs; just insert the CD and the installer starts.
It works like this: if in the root of the newly inserted device an "AUTORUN.INF" file is found, then its instructions are executed; they may tell the system to display a special, cooler icon for the device, but also to execute a program from the device. Both the autorun file and the program may be hidden so that you don't see them on the device, and it appears empty.
This executable could then do anything the logged-in user can do: it could run a search on the hard disk, and copy matching files on a hidden folder in the USB key. Or install a virus (that's how USB viruses such as Conficker propagate) that could then trasmit files at leisure through the Internet, if the computer was online.
It is easy to write such an autorun INF file using Notepad, and the executable can be built with any of several tools such as AutoIt, or it could even be a .CMD or .BAT file, which too can be created with just Notepad.
There are even "ready made" tools out there, such as, if memory serves, Slurper:
- install the program
- insert the USB key
- choose the file search parameters (e.g. "Files newer than one week")
- click "OK"
- and the utility saves on the USB key an autorun file and executable that...
...
- ...when you insert the USB key in a computer, will search matching files and "slurp" them on the USB key, optionally even deleting them.
UPDATE: There also happens to be a howto on Superuser.
Workarounds: on Windows XP, keep the "SHIFT" key pressed while inserting the flash drive. This disables autorun execution. Also works on Seven, haven't tried on Windows 8.
And of course, you can disable the autoplay functionality (also here), which is always a good idea. You never know where those USB keys have been, after all.
(IPQ sells a write-protectable USB key that allows you to let someone copy a file on his untrusted-by-you computer, without said computer being able to infect the USB key with malware. Other WP keys are available e.g. on Amazon).
Could this print shop employee, ostensibly helping me with image/text files for my manuscript, have been actually slurping down data onto his USB, EVEN THOUGH HIS HANDS NEVER TOUCHED MY KEYBOARD,
Yes, it could.
The print shop employee would need to use a specially crafted device which looks like a USB pen drive, and which acts like a regular USB based pendrive for a while.
After that it can suddenly change its appearance and to your computer it now looks as if the pen drive got replaced by a USB keyboard. Since these are common devices no extra drivers are needed and to you (and your computer) it would seem as if someone suddenly started typing commands.
Those commands could be Control+Esc (aka open the start menu) Cursor Up (to get to [run]), then "copy ..."
and my Windows 8 system never had a pop-up box asking for authorization to Install anything?
Windows helpfully does not bother you with such questions when you insert a seemingly common device, such as an USB mouse or and USB keyboard. The device would merely have to mimic one of these.
A local Techno-geek assured me that I was SAFE because these things never happened.
Almost never. But technically possible. Thus I am answering the "is it possible?" with a yes.
It is unlikely though. These things are as common as 007 cars with ejector seats. Just because it is possible to build such a device does not mean that you will run into them. It is much more likely that something else happened, such as an open share on your harddrive and a curious person just browsing around.
-
I like your use of the word "UNLIKELY", and "common as 007..." That simile was used by another techie I spoke with. Thanks for all the info. NO MORE FLASH DRIVES. Thanks for your time.– JackJan 25, 2014 at 16:28