How a USB drive broke into a secure network

I try not to write too much about technology, since I spend 8+ hours a day thinking about it. Still, here's a story I can't resist sharing.

This guy, Steve Stasiukonis, is VP and founder of Secure Network Technologies Inc. He's hired by a credit union to assess their network security, especially focusing on so-called "social engineering" -- the human weaknesses in the system. Their method of infiltrating the system was both original and brilliant.

We figured we would try something different by baiting the same employees that were on high alert. We gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with our own special piece of software. I had one of my guys write a Trojan that, when run, would collect passwords, logins and machine-specific information from the user's computer, and then email the findings back to us.

The next hurdle we had was getting the USB drives in the hands of the credit union's internal users. I made my way to the credit union at about 6 a.m. to make sure no employees saw us. I then proceeded to scatter the drives in the parking lot, smoking areas, and other areas employees frequented.

Once I seeded the USB drives, I decided to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desks.

I immediately called my guy that wrote the Trojan and asked if anything was received at his end. Slowly but surely info was being mailed back to him. I would have loved to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, then unknowingly running our piece of software.

It's amazing how easily the plan worked. The only truly technical part of this hack was writing the trojan, and that could be done by any high school script kiddy for $50 and a case of beer.