Hacker News new | ask | show | jobs
by aymenim 3608 days ago
May be i am missing something, but how did you figure out the USB is infected, it would be very useful if you could share how to recognize that.
3 comments

Gustomaximus had it right.

I didn't know if the USB drive was infected, and I didn't have an adequate test environment to make a determination either way. I just didn't reconnect that USB again to my systems.

Basically what I recognized was the risk from the physical environment. The event was held at reception hall within the embassy intended to host events with industry and government officials. The student competition was just one type of event there, and almost certainly the least important type of event. The hall had backroom audio visual system with a Windows PC connected to a projection screen. From the foreign government perspective, the AV system great for infecting guest attendees’ USBs to be walked back into secured networks when they return home/work.

If I designed the AV system, the system would be completely isolated from the internal embassy network. From a US perspective, to gain entry to the internal embassy network I would insert spyware into this system with the hope that someone in the Chinese embassy would reuse a USB between the AV system and the their internal network.

Some people's threat model and risk analysis for USB sticks will include "was used on a computer that wasn't under my control".

Since USB sticks are cheap enough to be disposable that's not an unreasonable position to take.

He didn't confirm it was infected. Only there was enough of a chance they wouldn't re-use it and find out.