The actions of the launched programs were only limited by the creativity of the attacker. One example could be an application that downloads predefined data (files) onto its storage device. All it takes is for the user — the victim — to allow access to their USB port. Depending on the USB port’s transfer speed, data from the computer can be transferred to the PenDrive (USB). Such a manipulated device was affectionately called a “leech” by specialists.

Today, such capabilities are typically blocked by default, and only deliberate action by the user — the administrator — can unlock this function, thus exposing the system to the aforementioned risks of consciously (in this case) allowing the leakage of their own data.

In a time when USB ports are used not only by flash drives but also by other peripherals, such as network cards, one could imagine a device that is specially prepared with an internal network card and its own driver. A “clean” PenDrive inserted into a secured computer, where autorun.inf is blocked by default, may still appear “clean” but could silently switch to another network and, in extreme cases, transfer control over the entire computer or the entire IT system of an organization. It is also worth noting that no antivirus system will detect such a combination, as antivirus systems are not sensitive to hardware changes or replacements. From an electronics perspective, creating such a device and linking its functions is not difficult.

The matter seems quite simple. In the age of widely used cloud solutions, data centers, servers, etc., we need to ask ourselves: is there still a need for devices like PenDrives? Probably not.

From a technical perspective, by using cloud solutions, we achieve the same effect as with PenDrives, but the security of our data, including its availability, becomes much more efficient.

Cezary Maślankiewicz
Cybersecurity Consultant at PBSG