Check Your Halloween Candy For Malicious Payloads
"exec" writes:
Arthur T Knackerbracket has found the following story:
There's long been much handwringing around Halloween around the prospect of pins, needles and razor blades being hidden in candy and passed out to children. On the very rare occasion this does happen, the outcome is normally little more than some superficial cuts. However, for 2019, [MG] has developed an altogether different surreptitious payload to be delivered to trick or treaters.
Consisting of a small USB device named DemonSeed, it's a HID attack gadget in the genre of the BadUSB devices we've seen previously. When plugged in, the unit emulates a USB keyboard and can be programmed to enter whatever keystrokes are necessary to take over the machine or exfiltrate data. Files are available on Github for those looking to replicate the device.
The trick here is in the delivery. [MG] has produced a large quantity of these small devices, packaging them in anti-static wrappers. The wrappers contain a note instructing children to insert them into their parent's work computers to access "game codes", and to share them with their friends while hiding them from adults.
The idea of children brazenly plugging hostile USB devices into important computers is enough to make any IT manager's head spin, though we suspect [MG] doesn't actually intend to deploy these devices in anger. It serves as a great warning about the potential danger of such an attack, however. Stay sharp, and keep your office door locked this October 31st!
-- submitted from IRC
Read more of this story at SoylentNews.