Three weeks ago my company ordered a lot of hardware (real hardware, not IT-related) from China.
Today, the warehouse girl comes to my office and says that, mixed in the stuff, she found a white USB drive saying "Lihuiyu Studio Labs 2012.10.25"
Curious, I had a reaction like "YAY! A free USB drive! Let's see what's inside!" and stupidly plugged in my main machine, and I was shocked to discover that it's detected as an USB HID and keyboard.
Paralyzed from the shock, I waited 20-30 seconds before removing it.
Nothing happened on screen, an USB Rubber Ducky-like device should show something on screen, right? There is no way that it has compromised our company system with some lightspeed commands impossible to see at naked eye, right?
Primary question:
Is there any way to protect Windows systems from USB devices like this?
We need to plug hundreds of different USB drives every week, so removing/disabling USB support is not an option
Secondary question:
How can I see what this USB device is really doing?
There is nothing that could be done to protect Windows systems from USB devices like this?
Sure, don’t plug in anything suspicious. Maybe that’s too obvious.How I could see what this USB device is really doing?
Use a quarantined honeypot instead of a connected, production system. Again, perhaps too obvious; forest for the trees sort of thing…