Are You Prepared to Defend Against a USB Attack?

The FBI recently warned of advanced USB-based attacks by a group called FIN7. The campaign, believed to have started last August, targets American companies, including those in key critical infrastructure industries such as transportation, insurance, and defense. The attackers targeted victims by sending them packages that contain advanced attack tools on the USB devices. These "BadUSBs" pose a significant threat. Here's what you need to know — and do — about them.

The Attack Technique and Tools
It is believed there are two variations of the packages, each of which is designed to trick users into using the USB devices. The first references COVID-19 guidelines, while the second claims to be a gift in decorative packaging with a fake gift card and thank-you letter.

These BadUSBs are actually penetration testing tools. A BadUSB looks like a normal USB, but it presents itself to the operating system of a computer as another device, one that is more naturally trusted by a computer, such as a keyboard. Once inserted into the computer, the device invokes the Windows command line and executes a script that downloads an exploit. This causes an infection on the endpoint that enables attackers to initiate an attack sequence on the organization — in the case of the FIN7 attacks, ransomware.

Sadly, this was not a one-off event or attack technique. There are about 30 clearly defined USB attack tools with new variations appearing on a regular basis. And long gone are the days when all we had to worry about was what malicious files were on a USB. Today, we must think about not only the files on the device, but also the device itself. This should be the standard philosophy for any devices we bring into a secure and trusted environment. Other considerations for keeping organizations safe from device-based threats include:

These best practices can help form the foundation of a removable media security policy, but it's also important to remember that any such policy should be reviewed and assessed on an ongoing basis. For example, would your removable security policy have prevented the recent FIN7 attack? If not, how should it be updated? Organizations should be asking themselves these and other questions about security policy on a regular basis to ensure that they are doing everything possible to keep facilities safe from bad actors.