Plug it in, Plug it in - Secret Service plugs in unknown USB drive to own PC

[rcmaehl]

Source:
Mashable
 

Summary:
After capturing a woman trying to access Trump's private Florida club. The Secret Service plugged a confiscated USB drive into their computer.

 

Quotes/Excerpts:

Quote

A woman, Yujing Zhang, was arrested on March 30 attempting to bluff her way into Trump's private Florida club. In addition to two Chinese passports, she carried with her four cell phones, a hard drive, and a USB drive infected with malware. And, U.S. government officials straight up plugged that bad boy into a computer,  a bit of news that generated some serious double takes in the infosec community. "[Secret Service agent Samuel Ivanovich] stated that when another agent put Zhang’s thumb-drive into his computer, it immediately began to install files, a 'very out-of-the-ordinary' event that he had never seen happen before during this kind of analysis," It's widely understood that plugging in random USBs is never a great idea, as they have a non-zero chance of containing malware. Zhang's hotel room contained some other interesting items discovered in a search that suggest it's also decidedly not possible. Namely, nine additional USBs, five SIM cards, $8,000 in cash, and a radio-frequency device used to find hidden cameras. 

 

My Thoughts:
This is a bit of older news, however I did not see anyone else report on it. Congratulations Secret Service, you likely encountered a Rubber Ducky, a great tool that's been in use for over a decade. Something a cursory look of the USB without it's case would reveal. I'm frustrated that the device wasn't properly tested in a sandboxed machine. Hopefully a more experienced expert is able to investigate both the PC and the flash drive now.

[Bananasplit_00]

Personally i plug in the USB drives i find around into my friends computers, format them from there and then go on to use them myself

[YaBoiWill]

Who just plugs a random USB into a computer, and why do that for pretty much no reason for investigation (apart from racial profiling I assume) 

[paddy-stone]

Smort

 

[Arika]

54 minutes ago, rcmaehl said:

a 'very out-of-the-ordinary' event that he had never seen happen before during this kind of analysis,"

....... Best excuse ever. Way to downplay your colleague's stupidity 

[poochyena]

2 hours ago, rcmaehl said:

U.S. government officials straight up plugged that bad boy into a computer

Thats only a problem if its a computer used by someone. Was it? If it was some junk laptop, what does it matter?

[Ithanul]

8 hours ago, VegetableStu said:

I can hear the facepalms from the sysadmin mods now, LOL

 

also yeah always test catty device in kitty litter environment

:I

Yes, much faceplaming probably occured.

 

Though, there no mention if this was a gov/military networked computer or even the OS image on said computer.  So, I'm unsure how serious putting that USB into said computer is.  Most I find is the anaylst put the USB device into their computer.  There is no mention of classification network or if it was even hooked up to the network.

 

Edit:  I did find this though.

Quote

"No outside devices, hard drives, thumbdrives, et cetera would ever be plugged into, or could ever be plugged into, a secret service network," the official said. Instead, devices being analyzed are connected exclusively to forensic computers that are segregated from the agency network. - https://arstechnica.com/tech-policy/2019/04/chinese-woman-arrested-at-trump-resort-had-hidden-camera-detector-8000-in-cash/

 

[Tristerin]

IMHO they wouldn't have announced this if this wasn't something that potentially tunneled into the system.  There is literally zero point making this a story, unless it IS a story.  No one in the FBI "tells on themselves" unless they have to.  Something happened and they are mitigating it.

[mr moose]

To be honest I am having trouble believing the whole story, who would try to bluff their way into such a place carrying all of that?  A real spy or secret agent?   Last time I watched 007 they don't carry their passports with them.

[ZacoAttaco]

10 hours ago, rcmaehl said:

Zhang's hotel room contained some other interesting items discovered in a search that suggest it's also decidedly not possible. Namely, nine additional USBs, five SIM cards, $8,000 in cash, and a radio-frequency device used to find hidden cameras. 

This alone would make me hesitant to insert any USB into a live environment. Not only should you not anyway but the fact this woman was carrying so much other hardware is very suspicious to say the least. People are still so ignorant when it comes to cyber security.

[kuhnertdm]

Very bad and misleading headline. It was done specifically for analysis purposes, and though it doesn't explicitly state as such, we can assume that it was done on a sandboxed machine. That's a basic procedure, and without plugging it into any machine ever, you can't get the full picture for forensics. It's really sad how every tech news site right now is chomping at the bit to say "LOOK THEY DID THIS THING THAT'S BAD AT THE VERY MOST SURFACE LEVEL!!!" when in context it's business as usual.

[ZacoAttaco]

39 minutes ago, kuhnertdm said:

Very bad and misleading headline. It was done specifically for analysis purposes, and though it doesn't explicitly state as such, we can assume that it was done on a sandboxed machine. That's a basic procedure, and without plugging it into any machine ever, you can't get the full picture for forensics. It's really sad how every tech news site right now is chomping at the bit to say "LOOK THEY DID THIS THING THAT'S BAD AT THE VERY MOST SURFACE LEVEL!!!" when in context it's business as usual. 

The use of the term 'analysis' mentioned in the Mashable article does indicate an awareness that this device could be dangerous. It just didn't explicitly say in a 'sand boxed environment' or 'virtual environment'. The article is vague in these areas.

[kuhnertdm]

13 hours ago, ZacoAttaco said:

The use of the term 'analysis' mentioned in the Mashable article does indicate an awareness that this device could be dangerous. It just didn't explicitly say in a 'sand boxed environment' or 'virtual environment'. The article is vague in these areas.

Every article about this event doesn't mention whether it was sandboxed, because the correct assumption is that it is. Saying that the articles indicate a problem is basically just assuming that they fucked up, because they didn't explicitly state that they didn't. If you read a local news article about someone getting arrested, you're not going to just assume that the officer randomly shot a cat because the article didn't say "no cats were randomly shot, per protocol".

[BuckGup]

17 hours ago, Tristerin said:

IMHO they wouldn't have announced this if this wasn't something that potentially tunneled into the system.  There is literally zero point making this a story, unless it IS a story.  No one in the FBI "tells on themselves" unless they have to.  Something happened and they are mitigating it.

^^^^^

Most bad things come to surface from leaks or whistleblowers