An intruder into Donald Trump’s Mar-a-Lago private club had, amongst several other pieces of technology such as cell phones, a thumb drive that could apparently immediately begin installing files onto a computer when plugged in, per the U.S. Secret Service. They indicated that this is very out of the ordinary, as detailed in this story.
A few interesting aspects of this story, in relation to thumb drives as well as other hardware and security. The first is that thumb drives (aka flash drives) are very popular, primarily because of their ease of use: they are an easy way to get programs and files from one computer to another. Because of this, they’re also easy to use to get malicious software onto a computer. This leads to the second and most important point: it is wise to not plug-in thumb drives without positively knowing their source and potential side effects. On this point, it’s a bit alarming that the Secret Service agent didn’t follow this point when they plugged it into their work computer.
The lesson to be gained from the linked article is that employers should not allow their employees to plug-in items such as thumb drives into their computers, or at the very least have security software which prevents the mounting of this type of hardware when it is plugged in.
In addition to being wary of thumb drives, other insecure types of hardware purchased off of sites such as eBay should give a user pause, whether the hardware has been previously used or not. Used hardware always has the potential of having been tampered with, from both a hardware and installed software perspective. For example, users could be spied on through a laptop’s camera, or their keystrokes captured through a hidden keylogger program.
In the realm of “new” hardware, what one person may think is new may actually not be. New hardware should always come in a factory sealed box with a security sticker. Of course, it is possible that this could be faked, but it is much less likely, especially when purchased direct from the Manufacturer.