What are these things I keep finding near the Google building? MFA keys?

[goodtofufriday]

I have found two of them now years apart. 

 

Think ltt or gamersnexus would find them interesting?

[Needfuldoer]

Left QR code: TCPFLM2022003608

Right QR code: TCPFLM2016048207

 

They could be multi-factor authentication keys, they could be serialized flash drives. They might have been dropped by employees, or they could be fakes waiting for an unsuspecting employee to pick them up and plug them into internal systems.

 

Unless they're mass storage, they're probably not of any use to anyone outside of Google.

[Holmes108]

32 minutes ago, Needfuldoer said:

or they could be fakes waiting for an unsuspecting employee to pick them up and plug them into internal systems.

 

 

Oh damn, that's a good one. Sinister.

[NobleGamer]

34 minutes ago, Needfuldoer said:

or they could be fakes waiting for an unsuspecting employee to pick them up and plug them into internal systems.

Or they could be fakes waiting for non-employees to pick them and plug them into external systems.

 

Then they know the location of who else like OP is loitering around their building

[Dedayog]

47 minutes ago, goodtofufriday said:

I have found two of them now years apart. 

 

Think ltt or gamersnexus would find them interesting?

So you're stalking Google and picking up their trash?

[FloRolf]

Whatever you do, don't plug unknown thumb drives into your personal system. 

[Eigenvektor]

As a rule of thumb: do not plug USB drives or anything else you found on the street into any computer. It is a known attack vector.

[goodtofufriday]

4 minutes ago, Dedayog said:

So you're stalking Google and picking up their trash?

You don't pick up things you find interesting when just walking around? And you don't have areas you find yourself frequently around? 

Never been outside?

[Thaldor]

They look very similar to YubiKeys, that metallic middle part and the hole and that Yubico and Google have been partners for a long time could easily give Google custom keys. But I would also give the 50/50 chance for something malicious.

[Dedayog]

54 minutes ago, goodtofufriday said:

You don't pick up things you find interesting when just walking around? And you don't have areas you find yourself frequently around? 

Never been outside?

Nicely twisted

 

[goodtofufriday]

6 minutes ago, Dedayog said:

Nicely twisted

 

Just twisting the twister.

Don't take a swing if you don't wanna get hit.

[Lingwendil]

These are security keys used for multi-factor authentication at sign-on to corporate devices. They do not store data, but can be used with either USB or NFC. Older ones were Yubico branded, not sure who the OEM for the type C ones is.

 

(Source- I'm a Security vendor that works with Google and some of its child companies, I've carried one of these in some form along with my building access badge since 2015.)

[Eigenvektor]

Just now, Lingwendil said:

These are security keys used for multi-factor authentication at sign-on to corporate devices. They do not store data, but can be used with either USB or NFC.

And you know for a fact that this is a legit security key and hasn't been tampered with? Could have been planted on purpose, to test employees. Pick up the key, plug it into a machine, get a stern talking to from corporate security. Or it was dropped by a bad actor and you get yourself infected with malware.

[Lingwendil]

I mean, I can't tell that it hasn't been tampered with at a glance, but why would one care? It's e-waste at this point unless you had a curiosity to investigate what's on it as far as credentials, and something like this is so cheap to buy new it's not worth the risk to try and re-use it. Anything you find on it would be encrypted and of limited usefulness unless you knew the profile it was set up with.

 

They're pretty benign and I don't know it would be worth the trouble to fake them and plant them at a place like Alphabet- where cyber security is taken pretty seriously. Nobody with any sense on campus would stick an unidentified key in their system just to "see whats on it" for fear of malicious intent or physical damage.

[Lingwendil]

[Dedayog]

22 minutes ago, goodtofufriday said:

Just twisting the twister.

Don't take a swing if you don't wanna get hit.

Not sure how I got hit but if you think you did, more power to you.

 

Do you live/work by Google?  I walk around downtown Atlanta often, never once have I picked up a USB drive, let alone two similar ones.

 

People who pick up others trash or dumpster dive are fairly common, but still weird.

[goodtofufriday]

14 minutes ago, Dedayog said:

Not sure how I got hit but if you think you did, more power to you.

 

Do you live/work by Google?  I walk around downtown Atlanta often, never once have I picked up a USB drive, let alone two similar ones.

 

People who pick up others trash or dumpster dive are fairly common, but still weird.

Yes and yes. Mahattan new york where the headquaters are.

 

Nothing weird about picking up something that looks interesting. Sorry that you cant find value in anything thats not brand spanking new. 

[djksm]

34 minutes ago, Lingwendil said:

problem solved

[goodtofufriday]

44 minutes ago, Lingwendil said:

Well damn look at that. 

[Uttamattamakin]

8 hours ago, Lingwendil said:

I mean, I can't tell that it hasn't been tampered with at a glance, but why would one care? It's e-waste at this point unless you had a curiosity to investigate what's on it as far as credentials, and something like this is so cheap to buy new it's not worth the risk to try and re-use it. Anything you find on it would be encrypted and of limited usefulness unless you knew the profile it was set up with.

 

They're pretty benign and I don't know it would be worth the trouble to fake them and plant them at a place like Alphabet- where cyber security is taken pretty seriously. Nobody with any sense on campus would stick an unidentified key in their system just to "see whats on it" for fear of malicious intent or physical damage.

It would be a now classic Stuxnet style attack.  

(For those who don't know Stuxnet was supposedly made by Israeli and/or US intelligence operatives as a way to hack airgapped Iranian computer systems.  Specifically those that control the gas centrifuges that they used to enrich Uranium.) 

https://www.youtube.com/watch?v=6WmaZYJwJng 

 

Since then code for stuxnet has leaked out an variations on it have been made that others can use. 

[Kisai]

13 hours ago, goodtofufriday said:

You don't pick up things you find interesting when just walking around? And you don't have areas you find yourself frequently around? 

Never been outside?

I find an average of 2 lost debit/credit cards every year, usually in fall/winter near bus stops.

In fact I have a lost TD one right here that expired this year. There's no name on it, and it looks like it was driven over by a car several times, so my assumption is that it was probably someone's temporary card when they opened a new account. I found a CIBC Debit card with the "Activate" sticker still on it two days ago and turned that one into the closest CIBC.

 

I've also found USB drives and broken flip phones before, but I found the USB drives largely near places university/college students are. 

 

Like let's be honest, some of us are curious, and just want to return the thing to it's owner, so plugging it into a computer you care about would be a bad idea. But plug it into a powered USB hub on a old computer you don't use anymore, that is booted from a single-use OS (eg Linux boot disc/usb drive) and you can figure it out.

 

But these to me suggest they are probably Google's Titan/Yubikey combined with a Keyfob to enter the building. Also someone earlier in the thread answered that part of the question.

 

Something to keep in mind, is that if you found it, and didn't make any attempt to hand them in to Google (eg leave them with the building security/reception) they likely would have already struck them from whatever system they are used with. Returning them just means they can make sure they can issue a new one to the employee and have accounted for it.