Generating and storeing keys on usb pen
Robert J. Hansen
rjh at sixdemonbag.org
Wed Apr 25 20:52:41 CEST 2007
> USB is a peer to peer protocol; it requires substantial computing
> power on both ends of the connection. I'm just waiting for the first
> virus which targets common USB drives; it would rip through colleges
> and workplaces like wildfire.
And then, literally minutes later, this crosses my desk:
"Hackers debut malware loaded USB ruse"
By John Leyden
Malware purveyors deliberately left USB sticks loaded with a Trojan
in a London car park in a bid to trick users into getting infected.
The attack was designed to propagate Trojan banking software that
swiped users' login credentials from compromised machines.
Check Point regional director Nick Lowe mentioned the ruse during a
presentation at the Infosec trade show on Tuesday, but declined to go
into further details, citing the need for confidentiality to protect
an investigation he's involved in.
Mikko Hypponen, chief research officer of security firm F-Secure,
said separately that Trojan code was replacing phishing emails as the
preferred method for fraudsters to rip off users' account details.
Banking Trojans are written for profit and sold through Russian
language websites and elsewhere for between $2,000 and $5,000. Two of
the main groups of Trojan malware authors - Corpse and SE-Code - are
based in Russia and "market" the Haxdoor and Apophis strains of
banking Trojans. An unknown Russian speaking virus writer group is
behind Torpig, another banking Trojan family. Malicious code variants
of the Bancos Trojan are sold by an unnamed group in Brazil.
... Moral of the story: be very careful where you go plugging your
USB tokens into, recognize they are infection vectors and infection
targets, recognize they can be compromised, and act accordingly.
More information about the Gnupg-users