1 1 00:00:00,570 --> 00:00:03,510 Unauthorized change or hardware. 2 2 00:00:03,510 --> 00:00:05,070 In this lesson, we are going to talk 3 3 00:00:05,070 --> 00:00:08,250 about unauthorized changes or unauthorized hardware, 4 4 00:00:08,250 --> 00:00:11,066 because both of these can be an indicator of compromise. 5 5 00:00:11,066 --> 00:00:13,470 Now, when you're dealing with an unauthorized change, 6 6 00:00:13,470 --> 00:00:14,940 this is any change that's been made 7 7 00:00:14,940 --> 00:00:17,490 to a configuration file, software profile, 8 8 00:00:17,490 --> 00:00:20,310 or even hardware without proper authorization 9 9 00:00:20,310 --> 00:00:22,143 or undergoing the change management process. 10 10 00:00:22,143 --> 00:00:25,800 For example, when I talked about software being installed 11 11 00:00:25,800 --> 00:00:27,840 by some user without permission, 12 12 00:00:27,840 --> 00:00:30,600 that is technically an unauthorized change. 13 13 00:00:30,600 --> 00:00:32,616 Unauthorized changes can occur to software, 14 14 00:00:32,616 --> 00:00:34,980 or they can occur to hardware. 15 15 00:00:34,980 --> 00:00:38,040 Both of these are considered unauthorized changes. 16 16 00:00:38,040 --> 00:00:40,230 Now, let's take a really common example 17 17 00:00:40,230 --> 00:00:41,790 that I see all the time. 18 18 00:00:41,790 --> 00:00:43,680 Somebody takes a USB thumb drive, 19 19 00:00:43,680 --> 00:00:45,059 they plug it into their laptop. 20 20 00:00:45,059 --> 00:00:47,430 That is an unauthorized change 21 21 00:00:47,430 --> 00:00:49,560 if it goes against your current policy. 22 22 00:00:49,560 --> 00:00:52,530 For example, the last couple of organizations I worked at, 23 23 00:00:52,530 --> 00:00:54,930 we did not allow USB thumb drives to be used, 24 24 00:00:54,930 --> 00:00:57,090 because they are a huge infection vector 25 25 00:00:57,090 --> 00:00:59,310 that can bring a lot of malware into your systems. 26 26 00:00:59,310 --> 00:01:01,260 So if we saw somebody do that, 27 27 00:01:01,260 --> 00:01:03,030 that was something that would actually flag an alert 28 28 00:01:03,030 --> 00:01:05,400 on the system, it would reject that information 29 29 00:01:05,400 --> 00:01:07,440 from getting onto the system because of that, 30 30 00:01:07,440 --> 00:01:08,964 and we would actually send out security 31 31 00:01:08,964 --> 00:01:10,500 to go look at that machine 32 32 00:01:10,500 --> 00:01:12,360 and make sure nothing got onto it. 33 33 00:01:12,360 --> 00:01:14,640 The reason for this is because USB firmware 34 34 00:01:14,640 --> 00:01:16,920 can actually be reprogrammed to make that device 35 35 00:01:16,920 --> 00:01:19,020 look like it's another device class. 36 36 00:01:19,020 --> 00:01:21,661 So for example, we block mass storage devices 37 37 00:01:21,661 --> 00:01:23,700 with the use of USBs. 38 38 00:01:23,700 --> 00:01:25,410 So if you plug in a USB thumb drive, 39 39 00:01:25,410 --> 00:01:26,730 it will not read from it, 40 40 00:01:26,730 --> 00:01:28,517 because it realizes this is a USB thumb drive. 41 41 00:01:28,517 --> 00:01:31,770 But if you've changed the firmware on it, 42 42 00:01:31,770 --> 00:01:33,246 you can actually make that USB drive 43 43 00:01:33,246 --> 00:01:37,140 to report as a keyboard or a human interface device. 44 44 00:01:37,140 --> 00:01:38,250 And so when you plug it in, 45 45 00:01:38,250 --> 00:01:40,050 it can actually start sending keystrokes 46 46 00:01:40,050 --> 00:01:41,760 to the operating system. 47 47 00:01:41,760 --> 00:01:43,262 This can actually be another infection vector 48 48 00:01:43,262 --> 00:01:45,240 that malware can use, 49 49 00:01:45,240 --> 00:01:47,640 because instead of being able to copy a file over, 50 50 00:01:47,640 --> 00:01:50,490 it can send in those unauthorized keystrokes. 51 51 00:01:50,490 --> 00:01:52,440 For this reason, I recommend 52 52 00:01:52,440 --> 00:01:56,029 that you do not allow USB devices inside your organization, 53 53 00:01:56,029 --> 00:01:58,500 especially USB thumb drives. 54 54 00:01:58,500 --> 00:01:59,910 Most high security environments 55 55 00:01:59,910 --> 00:02:01,650 will ban this type of device 56 56 00:02:01,650 --> 00:02:03,240 and not allow them in the building. 57 57 00:02:03,240 --> 00:02:04,429 Now, you may be saying, Jason, that's great. 58 58 00:02:04,429 --> 00:02:06,990 You can go ahead and ban devices, 59 59 00:02:06,990 --> 00:02:09,990 but people are still going to need them for certain use cases. 60 60 00:02:09,990 --> 00:02:11,460 So what do you do then? 61 61 00:02:11,460 --> 00:02:14,190 Well, in those cases, you want have a process in place 62 62 00:02:14,190 --> 00:02:15,360 where you can scan them 63 63 00:02:15,360 --> 00:02:17,062 and verify that they're clean first. 64 64 00:02:17,062 --> 00:02:18,570 The way I like to do this 65 65 00:02:18,570 --> 00:02:20,520 is to connect that suspect hardware device 66 66 00:02:20,520 --> 00:02:23,070 to a sandbox and analyze it first. 67 67 00:02:23,070 --> 00:02:25,290 This way we can prevent the number of people 68 68 00:02:25,290 --> 00:02:27,194 who are bringing USB devices into the building, 69 69 00:02:27,194 --> 00:02:29,850 and any that are brought in, we can check 70 70 00:02:29,850 --> 00:02:31,642 and make sure there's nothing malicious on them. 71 71 00:02:31,642 --> 00:02:34,050 This gives us a chance to actually analyze it 72 72 00:02:34,050 --> 00:02:35,878 and look at it, and by using a sandbox, 73 73 00:02:35,878 --> 00:02:37,680 if it is something that was bad, 74 74 00:02:37,680 --> 00:02:39,420 it's not going to get into the rest of the network, 75 75 00:02:39,420 --> 00:02:41,820 because it's isolated in that sandbox. 76 76 00:02:41,820 --> 00:02:43,331 But again, the best policy here 77 77 00:02:43,331 --> 00:02:45,420 is to not allow those USB devices, 78 78 00:02:45,420 --> 00:02:47,340 'cause they are a huge infection vector, 79 79 00:02:47,340 --> 00:02:49,883 and something you should really be on the lookout for.