Stories
Slash Boxes
Comments

SoylentNews is people

Check Your Halloween Candy For Malicious Payloads

posted by Fnord666 on Sunday November 03 2019, @08:52PM   Printer-friendly
from the evil-week dept.

"exec" writes:

Arthur T Knackerbracket has found the following story:

There's long been much handwringing around Halloween around the prospect of pins, needles and razor blades being hidden in candy and passed out to children. On the very rare occasion this does happen, the outcome is normally little more than some superficial cuts. However, for 2019, [MG] has developed an altogether different surreptitious payload to be delivered to trick or treaters.

Consisting of a small USB device named DemonSeed, it's a HID attack gadget in the genre of the BadUSB devices we've seen previously. When plugged in, the unit emulates a USB keyboard and can be programmed to enter whatever keystrokes are necessary to take over the machine or exfiltrate data. Files are available on Github for those looking to replicate the device.

The trick here is in the delivery. [MG] has produced a large quantity of these small devices, packaging them in anti-static wrappers. The wrappers contain a note instructing children to insert them into their parent's work computers to access "game codes", and to share them with their friends while hiding them from adults.

The idea of children brazenly plugging hostile USB devices into important computers is enough to make any IT manager's head spin, though we suspect [MG] doesn't actually intend to deploy these devices in anger. It serves as a great warning about the potential danger of such an attack, however. Stay sharp, and keep your office door locked this October 31st!

-- submitted from IRC

Original Submission

 
This discussion has been archived. No new comments can be posted.
Check Your Halloween Candy For Malicious Payloads | Log In/Create an Account | Top | 39 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 1, Funny) by Anonymous Coward on Sunday November 03 2019, @11:21PM (1 child)

    by Anonymous Coward on Sunday November 03 2019, @11:21PM (#915474)

    This is one of Barbara Hudson's "friends". Hudson probably gave him the apple.

    Starting Score:    0  points
    Moderation   +1  
       Funny=1, Total=1
    Extra 'Funny' Modifier   0  
    Total Score:   1  

  • (Score: 2) by barbara hudson on Saturday November 09 2019, @09:21PM

    by barbara hudson (6443) <barbara.Jane.hudson@icloud.com> on Saturday November 09 2019, @09:21PM (#918396) Journal
    The girls name was Kathy Holmes. I remember because it was really serious in terms of injuries. Kind of sticks in the mind. This was more than half a century ago. No way to look it up on the internet, sorry. But it's still a problem - https://www.cbc.ca/news/canada/london/parents-check-candy-after-razor-found-1.5351694 [www.cbc.ca] - from London, Ontario this Halloween.

    This case could be a production problem - 100 pound bags of cocoa sliced open with a utility knife, blade snaps, end up in the mix ... the utility knives with grooves so you can snap off the dull tip and have a fresh edge are a problem under stress - the blade gets dull, and rather than snap the edge off, people apply more force, so it can break off and good luck finding the broken pieces unless it's ended up in somebody.

    --
    SoylentNews is social media. Says so right in the slogan. Soylentnews is people, not tech.