Do you think this is a sketchy?

c hris527

c hris527

Known around here
Oct 12, 2015
1,829
2,195
NY
A Customer of mine, Actually a Government entity informed me of a Amazon Delivery they received last week, After unboxing the items they looked at the bottom of the box and saw a extra item, it at first it looked like a credit card or business card.
After they looked at it, turns out its a card with a flip up thumb drive. Who does not love puppies...Eh ? I will get my hands on it this week and get the skinny on this. has anyone else out there run across anything like this before? Considering It is a Amazon
Government account, my bells are going off. They knew not to mess with it because I do the Cyber security training but I will say the ladies were VERY tempted. what does everybody think. Is it a Computer killer by short circuit? Does it have a payload?
Or is it a nice greeting from the seller? Who knows :wow: Edit After looking at the drive, I do not think its a USB Killer, unless they are using super small IC Components.

20240825_223127.jpg
 
Last edited:
  • Like
Reactions: mat200, fenderman, TonyR and 2 others
It has a payload for sure. Plug that into an USB outlet on your laptop and you will find out. I doubt it is a 'killer', more of a trojan.
 
  • Like
Reactions: mat200, CCTVCam, EMPIRETECANDY and 2 others
No way in hell I'm plugging that into anything but a wipeable completely sandboxed system. lol Curious to hear what you find. I do kind of remember people getting thumb drives or some piece of equipment sent to them blindly a while back.

ETA: Search "unexpected deliveries of thumb drive" and you'll see some things. This one was particularly interesting:

ilfri3
•2 yr. ago

JUST had this happen to me! I ordered a computer through amazon but my usb is disguised as a credit card with a picture of puppies in a basket on it? I have messaged the seller and am waiting for a response
Click to expand...

No more info than that unfortunately.
 
Last edited:
  • Like
Reactions: VorlonFrog, mat200, fenderman and 6 others
Mike A. said:
No way in hell I'm plugging that into anything but a wipeable completely sandboxed system. lol Curious to hear what you find. I do kind of remember people getting thumb drives or some piece of equipment sent to them blindly a while back.

ETA: Search "unexpected deliveries of thumb drive" and you'll see some things. This one was particularly interesting:



No more info than that unfortunately.
Click to expand...
I knew If i got this info out here somebody would know or have knowledge of something Similar, yes they ordered a laptop. I have a special VM machine i will test it on when I get my hands on it, should be later in the week. They knew it was going to a Government Entity also.
 
  • Like
Reactions: mat200, fenderman, Flintstone61 and 1 other person
So I was able to get my hands on it, gave it a look on the sandbox, No files looks clean except 256k of used something(I think that's to be expected) did not see any hidden files, no change to anything. However Won't be using it for anything.

usb.jpg
 
Last edited:
  • Like
Reactions: mat200, fenderman, samplenhold and 3 others
many years ago, when USB drives were quite pricey, people would 'repurpose' ones that vendors would give folks (like at conventions) with software or different conversion tables (think CRC math tables) on it. Some would then delete everything on it and use it for their own storage. I know of a couple of people that picked up several that were laying on tables in the snack area. When they plugged it into their home machine, it installed a trojan and they never got control of the pc back.

When I was working in Nigeria, the company had rules about not EVER plugging in a USB drive to any company computer unless it physically came from our IT department after being scanned by them. But some of the locals would fully disregard this. One case in point was a new hire that on her first day after orientation (where she had to sign a form telling about the USB policy), she plugged in one that a 'friend' had given her with music on it that she wanted to play while she worked. It immediately loaded a payload that took over her machine. She was in a cube outside my office, and I heard her yell and I went to see what was up. I pulled the network cable out to stop it from jumping to the LAN. When IT took a look they said if it had been allowed to finish it would have taken down our entire LAN. This led to every PC in our office having the USB ports turned off. It also led to her dismissal.
 
  • Like
Reactions: VorlonFrog, mat200, CCTVCam and 4 others
I see some of my Dell corporate computers are still retaining the PS/2 mouse and keyboard ports. Additionally with a BIOS that can be administered to disallow user level folks from using the USB ports.
Probably thanks to stuff like Stuxnet.
It sure seems fishy.
I often wonder if some of these these USB thumb drives are phoning home, with all their preloaded " helpful User assistance" type files.
 
  • Like
Reactions: mat200, samplenhold and looney2ns
elvisimprsntr said:
Tech savvy adults may have enough common sense not to insert it into a computer, but kids may be easily tempted.
Click to expand...

You are right about savvy tech people knowing not to insert stuff (adults or not), but you would be amazed at how "un tech savvy" most people are. 65% of the population out there is going to say, "ahhhh, cute puppies" and insert this USB drive into their computer. It's not just kids......
 
  • Like
Reactions: mat200, samplenhold, Flintstone61 and 2 others
256K could be file allocation firmware, or it could be something concealed such as a root kit. Personally, I'd contact Amazon and ask them about the "gift". Either way, I wouldn't use it. Maybe one of the Govt bodies might like to make a check as it's in their interests to know what is being sent out to their entities. They'd probably appreciate a vigilent service agent, albeit if you have bosses, check with them 1st. However, as it wasn't sent to you but to the Govt contractor, it's not you that solcitied the goods that came with it.
 
  • Like
Reactions: mat200 and c hris527
CCTVCam said:
256K could be file allocation firmware, or it could be something concealed such as a root kit. Personally, I'd contact Amazon and ask them about the "gift". Either way, I wouldn't use it. Maybe one of the Govt bodies might like to make a check as it's in their interests to know what is being sent out to their entities. They'd probably appreciate a vigilent service agent, albeit if you have bosses, check with them 1st. However, as it wasn't sent to you but to the Govt contractor, it's not you that solcitied the goods that came with it.
Click to expand...
I'm pretty much done with it, The Agency I contract for does not care at this point either( we all know Gov agency's) I have a friend who works at a rather large engineering University locally
and their Cyber security lab is awesome, he said he will run it through when I see him again. At this point I still think its clean but who knows Eh.
 
  • Like
Reactions: mat200 and alastairstevenson
c hris527 said:
So I was able to get my hands on it, gave it a look on the sandbox, No files looks clean except 256k of used something(I think that's to be expected) did not see any hidden files, no change to anything. However Won't be using it for anything.
Click to expand...
It may be nothing.

Some of you are aware of this, but a USB device can potentially appear to the computer as multiple devices like a keyboard and a flash drive (see usb rubber ducky as an example). It could even be programmed to only do that after it's been plugged in for some period of time.
For example it could type win-r, malware.com/somepayload.exe, enter, alt-y to the UAC prompt. Or it could hammer out a more complex series of local commands / access a hidden partition of a flash drive.

This type of stuff can even be embedded in a cable (would present to pc as usb hub).
 
  • Like
Reactions: mat200, quiet.tea, c hris527 and 2 others
You must log in or register to reply here.
Top Bottom