iPod poses a security risk (including how-to)

Alexander Turcic · 06-30-2005, 06:08 PM

Security consultant Abe Usher explores the idea how Apples iPod can pose a major security risk for enterprises. He wrote a small python tool, slurp.exe, that when it is run from an iPod, can very quickly copy data files off of a PC and on to an iPod.

Quote:

Slurp searches for the "C:\Documents and Settings\" directory on local hard drives, recurses through all of the subdirectories, and copies all document files. Using slurp.exe on my iPod, it took me 65 seconds to copy all document files (*.doc, *.xls, *.htm, *.url, *.xml, *.txt, etc.) off of my computer as a logged in user. Without a username and password I was able to use a boot CDROM to bypass the login password and copy the document files from my hard drive to my iPod in about 3 minutes 15 seconds.

[via The Inquirer]

Chaos · 06-30-2005, 07:19 PM

I saw this a while ago (Slashdot maybe?), and there were several suggestions...

First, just don't allow music players of any sort. This could annoy employees, unfortunately. But if the need for security is so great, then this is the best way.

Second, just disable the ability to connect these devices. This could be done through, probably, either computer settings (on a Unix variant this would be relatively easy, although I don't know about Windows), or just physical security. If an employee cannot reach/access the USB or firewire ports, they can't connect anything to them. This might be harder to do, depending on whether the user needs to be able to access, say, the CD-ROM drive or anything else on the computer, or not.

While it's certainly a concern, there are some ways to deal with it.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Anti- 1-click buy settings. 1-click is security risk? Need support from community	med007	Amazon Kindle	14	07-30-2009 12:37 AM
Google - a national security risk?	Colin Dunstan	Lounge	0	05-27-2005 10:05 AM

06-30-2005, 07:19 PM	#2
Chaos Evangelist Posts: 418 Karma: 281 Join Date: Jul 2004 Location: Canada Device: Assorted older devices	I saw this a while ago (Slashdot maybe?), and there were several suggestions... First, just don't allow music players of any sort. This could annoy employees, unfortunately. But if the need for security is so great, then this is the best way. Second, just disable the ability to connect these devices. This could be done through, probably, either computer settings (on a Unix variant this would be relatively easy, although I don't know about Windows), or just physical security. If an employee cannot reach/access the USB or firewire ports, they can't connect anything to them. This might be harder to do, depending on whether the user needs to be able to access, say, the CD-ROM drive or anything else on the computer, or not. While it's certainly a concern, there are some ways to deal with it.

Advert