Paul Ducklin, Sophos' Asia Pacific Head of Technology spoke today of a project whereby the company purchased a random set of 50 USB memory sticks from a recent RailCorp lost property auction.

Two immediate outcomes were clear.

Firstly, that two thirds of the sticks were afflicted with some kind of malware (the worst affected stick had six different infections).  This probably means that you would either be infected by simply inserting the stick in your computer (although less likely now that Microsoft has disabled AutoRun in a recent patch) or definitely infected by opening a malicious file.

You DO have up-to-date anti-virus running, don't you?

Of course the second outcome is that Sophos technicians gained access to an absolute plethora of information regarding a large number of 'innocent' people.

Ducklin reports that they discovered, "4443 directly accessible files on the 50 devices including 2882 images, 629 source code files, 197 web files, 145 documents, 128 programs and 23 videos."

In addition, the files included:

 

• Lists of tax deductions.
• Minutes of an activists' meeting.
• School and University assignments.
• AutoCAD drawings of work projects.
• Photo albums of family and friends.
• A CV and job application.
• Software and web source code.

So, think about it - what if the person buying these memory sticks was not a security researcher, but an identity thief instead?

---

The brief list of contents makes it clear that at least one message stick (the one containing a CV and job application) would almost certainly contain enough information for an identity thief to be off and running.  There are almost certainly others.

However, this incident brings to mind a couple of even more nefarious thoughts.

A well-known security researcher with whom I'm acquainted (no names, no pack-drill!) has been known to scatter a few memory sticks on the ground outside of the offices a company for which they have been contracted to perform a penetration test. 

Of course these sticks contained some specially crafted malware for remote access.  Needless to say, a successful intrusion was had every time!

With this in mind, what if the identity thieves (and even less nice people) were becoming more proactive and deliberately leaving memory sticks such as these on trains etc. in the hope that someone would take them home (or to the office) and instantly get themselves pwned.

It would seem the main warning here is "don't even think about using that stray stick - it's simply not worth it!"

Oh and by the way, Ducklin reported that NONE of the 50 sticks had any kind of encryption or other protection (not even a password-secured zip file).