Electronics companies putting virus's onto USB sticks

[Faringdon]

Hi,
Please help with getting   rid of virus’s transferred by USB stick…..

I have worked in multiple different electronics companies. In each of them , I “took work home” by copying  files from my work PC  onto   various USB sticks, then  connecting the USB stick into my home laptop.

It became  blatantly obvious that the companies had  made their PC’s put spy software (and possibly other virus’s)  onto   these  USB sticks. It was  obvious because  often IT staff  were able to tell me  eg what youtube   songs, etc ,  I had listened to the night before.
I have even had staff at work accurately repeating eg  conversations that  i have had with my partner the evening before...so they somehow can even collect the audio and transmit it back to themselves.



Recently my laptops have started to run very very slowly, and I believe that this is due to  virus’s  that I have inadvertently transferred   from my work PC to my home laptop via  the  USB sticks, in this way. (ie , the  companys  somehow make their PC’s put virus’s on any  workers’ USB sticks  connected to them)

Do you know how I can “clean” these virus’s off  these USB sticks?
And do you know how I can “clean” these virus’s off my laptop?
(do I have to reset windows?)

(I have Norton anti-virus, but it obviously hasn’t stopped these virus’s.)

(I guess that these companies do this because they suspect that workers might be trying to steel the company's IP, but i was not trying to do this. I guess the companys inject these virus's because ultimately, they want to destroy  the home laptop, as in their minds, it may contain their IP, due to it possibly being transferred by USB stick)

[nigelwright7557]

There are many reasons why a pc runs slow.
Hard disc nearly full.
Memory problems.

A couple of months back I thought I had a virus.
PC kept crashing.
I even tried reinstalling windows to clear it and it wouldn't install, kept crashing at same point.
I even tried a clean install but had same problem.

So did some checks of hard disc and memory with software and no problems found.

Out of desperation I removed one of my DIMM's and the problem went away.
SO swapped DIMMs and it still worked ok so DIMM's were ok.
Had a look in motherboard manual and it says DIMM's must be installed in pairs in same colour sockets.
I did this and pc been fine since.

Its strange I didn't have problems just after I first installed the second DIMM otherwise i might have twigged straight away.

[langwadt]

you shouldn't put on the tinfoil hat so tight that it restricts blood flow to your brain, it makes you imagine crazy things ...

[ataradov]

Norton is on the deal with those USB stick makers. PayPay me $10000 and I'll give you a proven solution. Just keep it quiet, we don't need your IT guy to find out, and he apparently already knows too much.

[Ranayna]

First of all, you should stop "taking work home" like that. It is almost certainly against company policies. It also opens you widely for liability. If anything ever leaks, you will be the first suspect.

Regarding the browser history thing: Are you using Google Chrome, and are signed in to the browser both at home and at the company? Chrome can (i do not know if it does it by default) syncronize your browser history among other settings. I have heard reports about people beging written up for this, because the scanners found NSFW stuff on their work computers.
I would suggest never signing into your private accounts while at work anyway. It is never smart to mix work and private life...

[Gyro]

That's why many (most?) reputable companies, at least the ones I've worked in, have a ban their employees using their home storage devices in work computers. There is too much risk of 'cross contamination', particularly with the type of people who tend to do this.

For a company with any commercially sensitive / confidential IP, the risk of uncontrolled information going off-site is unacceptable. Nobody else had it in their terms of employment (and therefore, a disciplinary matter)?


P.S. In terms of most of the OP's post, typical Tre Faringdon incoherent ramblings! The whole 'my employer gave me a virus' thing is an entertaining plot twist though!

[Faringdon]

Regarding the browser history thing: Are you using Google Chrome, and are signed in to the browser both at home and at the company?

Thanks, no i never do this......all i do is take work files ive done on the work computer home on a USB stick, then plug it into my laptop at home so i can continue the work there.

[andy3055]

Why would you spend your private time doing office work at home? Do you get paid for it? If so, ask the office to provide you with a laptop. If they are so desperate that you must spend your time like that, they must pay you and provide the equipment also.

Meanwhile, if you are so sure about this, run a program like "Super Antispyware" or "Malwarebytes" and clesn up your laptop at home. Don't ever bring your office stuff on USB and stick them on your laptop.

https://www.superantispyware.com/download.html

https://www.malwarebytes.com/lp/sem/en?gclid=EAIaIQobChMIwbS52Znf8wIVvYNLBR1a0gngEAAYASAAEgJGi_D_BwE

Both of those have free versions.

[Faringdon]

Thanks, i have Norton 360. I was reading on the web that its best to only have one anti-virus programme, otherwise, they can "attack" each other and mess up the computer while they're at it.

[m3vuv]

reminds me of a company i used to work for,we had a crypton cmt500 engine analyser,this was also the gas analyser for mot cat checks,one guy brought a game to work on floppy disks,long story short these virused the pc controling the analyser,had to stop doing mot tests for a week or so until it was sorted.

[andy3055]

Huh! How did Norton work for you? Stick with it.
No more comments from me on this post.

[Faringdon]

Thanks, BTW, just did this to my USB stick...


...i hope it works.
I am loathe to load more antivirus software as i already have norton...and  antivirus softwares fight each other.

Also, is another good way to clean virus's off a USB stick to put the files on a laptop...then "format" the USB stick, then put your files back onto it?

[NiHaoMike]

First of all, you should stop "taking work home" like that. It is almost certainly against company policies. It also opens you widely for liability. If anything ever leaks, you will be the first suspect.

It's common for larger companies to have a policy against that, although they also generally provide laptops for working from home so no reason to use a personal device for that purpose. But some smaller companies might not have such a policy or even specifically allow using personal devices for working from home. Also, the spike in working from home thanks to COVID might have made temporary exemptions to that rule even at larger companies.

Have you considered using a separate personal device like an older laptop or a Raspberry Pi for that? Consider using something like Tails OS for that route, just reboot when you're done and there's no information left on the device to leak.

[cgroen]

I don't think you have been hit by a virus, I think there is something else wrong.....

[ejeffrey]

I am sure there are IT departments that have deliberately infected users with viruses because they think it's hilarious.  There are terrible people everywhere.  However it's highly unlikely to be a deliberate policy.  It's insanely stupid, opens you up to massive civil and criminal liability, and has a high risk of infecting your own infrastructure and/or destroy the very "sensitive IP" that they could be protecting.  Penalties for criminal hacking can be extremely severe. Generally if companies have a policy against taking data home they would just fire people who violate it, not infect their computers with a virus yet for some reason keep them employed.  On the other hand many companies are perfectly happy to have employees working off the clock and would have no reason to sabatoge someone doing so.

You may have a virus and there is an outside chance someone from IT is harassing you but if so it is because they are abusive assholes not to protect company property.

[newbrain]

Thanks, BTW, just did this to my USB stick...

That video is a load of bollocks!
It gets the prize for the stupidest thing I have seen or heard this week, and there were good contenders.
It shows a complete misrepresentation of what a .lnk file is, I can't say if on purpose or out of sheer ignorance.

My employer has a policy of no work data on personal device, unless they have been vetted and prepped by IT including loading a number of security SW. Moreover USB mass memory devices are disabled on our laptops.

[Bassman59]

Do you know how I can “clean” these virus’s off  these USB sticks?

You can start by NOT using the greengrocer's apostrophe to indicate a plural.

English is your first language, right?

[golden_labels]

Faringdon: I avoided answering this thread, as I can’t help with Windows, but how the discussion develops makes it clear advice of different kind might be worth passing to you. A more general one. Possibly even related to the original question, as it is very likely not following that advice is the source of your problems.

Learn to differentiate between good and bad sources.

The video you linked is not merely wrong: it’s utter bullshit. Being wrong would mean that someone expressed an opinion honestly, trying their best to accurately address an actual issue, have their statements well founded and make sense, but failed at that task. The video is dispersing a totally random advice, bearing no logical connection with the problem, and is not rooted in knowledge. Skimming over the content of the Trickology channel reveals the above asessment is true; and channel’s name is well fitting: it is indeed tricking a particular kind of vulnerable audience into watching the videos, so the owners could enjoy their income.

It’s important to understand that, because the cause of your problem may be taking information from such sources. Reading, what you have written in this thread so far, I get the impression of that being very likely. I can’t tell, what causes your particular issue, and it’s impossible to rule out malicious actions of your employer. But that explanation is not very plausible, given (the lack of?) evidence. Don’t take that as a personal attack: I am only a person, who recognized a common pattern and tries to help you avoid trouble in the future. The way you describe your problem, the concepts you refer to, the explanations you provide and — finally — linking that video, are strong indicators that you are still at the stage of learning the basics. It seems to be that you are taking very poor choices regarding managing your computer and you are not understanding well that technology. Despite you may think otherwise. And that is the cause. Whether anyone in the company attacked you is actually less important.

Unfortunately there is no way to protect yourself against such people, other than acquiring knowledge on both the subject of interest and in what ways you may be vulnerable to such sources. “Unfortunately”, because it’s not one post on a forum that can pass you that knowledge. Not even a hundred threads. It’s years of hard work ahead of you and not on random websites, but with paper books. Wikipedia is in general decent source for most computing stuff, but usually it gives only an overview of the topic. However, you should get at least Wikipedia level of the feel about this subject, so seeing videos like that would invoke involuntarily WTF response, followed by a facepalm. As for deception, you may see Calling Bullshit lectures. This is a very basic introduction, but I believe you may benefit even from that.

[Faringdon]

Thanks, ill bear these things in mind. It does puzzle me a bit.....why is it that USB sticks are such effective carriers for virus's?.....i mean, would i be reducing the chance of getting virus'd if i emailed the work computer files to my google drive from the work PC...and then downloaded it from there to my home laptop? (ie, avoid using a USB stick)

And suppose i have a virus'd USB stick...and i download all the files on it to my home laptop.....then the laptop will be virus'd...but presumably i can just re-install windows (whilst keeping the files there and not deleting them)...and then when ive re-installed windows, and removed the USB stick, then i will have all the files off the virus'd USB stick, and no virus on my laptop?

[Just_another_Dave]

That's why many (most?) reputable companies, at least the ones I've worked in, have a ban their employees using their home storage devices in work computers. There is too much risk of 'cross contamination', particularly with the type of people who tend to do this.

For a company with any commercially sensitive / confidential IP, the risk of uncontrolled information going off-site is unacceptable. Nobody else had it in their terms of employment (and therefore, a disciplinary matter)?


P.S. In terms of most of the OP's post, typical Tre Faringdon incoherent ramblings! The whole 'my employer gave me a virus' thing is an entertaining plot twist though!

Most companies I know deactivate USB ports to avoid workers doing that. It is not just a matter of what could be leaked, but also about the contents that the drive might have due to the risk of propagating malware through the network of the company

[TimFox]

I installed equipment with a Windows computer at a secure military-contractor site.  They had no tolerance whatsoever for USB thumb drives.  We normally connected our motor controls to the host computer through USB, but they required us to use Ethernet instead to reach the motor drivers outside of the locked drawer containing the computer.  To bring software into the facility, we had to put it on a CD/DVD disc that they passed through their anti-malware test system before giving it back to us.  We delivered the hardware with a blank hard drive, on which their IT department installed a secure Windows, which was a bit problematic for us since we had tested everything at the factory with normal Windows on a different drive.  Our application software, after the discs passed their tests, was then installed at their site.  Since the computer was locked into its drawer by their security staff, I don't remember if they also poured epoxy into the USB jacks (with which such a computer is infested) to enforce the policy.

[timenutgoblin]

It became  blatantly obvious that the companies had  made their PC’s put spy software (and possibly other virus’s)  onto   these  USB sticks. It was  obvious because  often IT staff  were able to tell me  eg what youtube   songs, etc ,  I had listened to the night before.
I have even had staff at work accurately repeating eg  conversations that  i have had with my partner the evening before...so they somehow can even collect the audio and transmit it back to themselves.

I'm not sure exactly what this discussion thread is about, but it sounds like an attempt at social engineering.

https://www.webroot.com/au/en/resources/tips-articles/what-is-social-engineering

https://now.symassets.com/content/dam/norton/global/images/non-product/misc/tlc/in-post-02-social-engineering-tactics-to-watch-for.png

As others have suggested, it's probably just the company's attempt at securing their IP.

[golden_labels]

Thanks, ill bear these things in mind. It does puzzle me a bit.....why is it that USB sticks are such effective carriers for virus's?

They are not. An USB stick is not carrying malware any better than any other storage medium. By themselves they are just passive devices and do not offer any technical means to infect computers.

Historically the primary threat is running Windows. Microsoft thought it’s a great idea to allow removable media, like CDs and USB sticks, to be able to execute arbitrary commands upon insertion and refused to remove that vulnerability for 15 years. It may be turned off by the user, if they are aware of the risk, but only since Windows 7 it’s disabled by default. On top of that about a decade ago Explorer had a flaw, which allowed attackers to execute arbitrary code while icons of shortcut files were displayed,⁽¹⁾ which led to a large number of high-profile attacks and remains an attack vector on outdated systems. It’s important to understand, that it’s not a problem of pendrives technology themselves: those were not part of either hardware or mass storage USB devices, but choices by a particular software vendor.

Aside from those special cases, any medium that is used to exchange data between computers is a likely transmission vector. In the past those were floppy disks. When pendrives replaced floppies, they also took the role of the infection spreader. Not because USB sticks are in any way more suitable for that purpose, but simply because users put them in any hole they can, copy files to many computers and do not observe basic security hygene. If someone visits 30 brothels a month, they shouldn’t be surprised if diagnosed with chlamydia. The idea is the same. If you think that people, who are not instinctively disgusted and threatened by someone asking them to run some program or disable a security feature, are naïve, there is one more level: people, who can put an USB stick they found on a street into their computer and even execute things from there without giving it a second thought. That has been used uncountable times to circumvent security measures in companies⁽²⁾ and is among the standard tests done by pentesters.

A third, less common threat arises from USB devices complexity. You have no way to determine, what you are putting into your USB port. It may look like an innocent pendrive, but it may present itself to the computer as a keyboard and send keystrokes to control the operating system. It may be a Bluetooth dongle with a built-in keylogger. It may exploit kernel-level vulnerabilities related to how those devices are handled. Or anything else. Those are rare, because other methods are cheaper and easier to conduct, but not unheard of. And, of course, there is also the good old USB Killer, which is harmless in comparison — it only kills the USB port or the computer.

But it should be clear: none of the above is caused by any technical aspect of pendrives themselves.

.....i mean, would i be reducing the chance of getting virus'd if i emailed the work computer files to my google drive from the work PC...and then downloaded it from there to my home laptop? (ie, avoid using a USB stick)

With 99.9% certainity: no. If you were in fact attacked by someone from your company, they didn’t use any sophisticated attacks, but relied on you yourself trusting the files and executing malware.

And suppose i have a virus'd USB stick...and i download all the files on it to my home laptop.....then the laptop will be virus'd...

Uhh… first of all, please stop using “virus’d”. It doesn’t make you sound cool. Quite opposite. In particular since computer viruses are extreme rarity. And no, by copying files you are not infected. Malware does not spread by being somewhere. Malware spreads by being run in some way. So you must consciously either run some program or use a file that exploits vulnerability in other program. Without that nothing happens. And no, USB stick itself is also not infected. It may at most contain malware, which is just normal files like any other file and just like any other file may be deleted.⁽³⁾

but presumably i can just re-install windows (whilst keeping the files there and not deleting them)...and then when ive re-installed windows, and removed the USB stick, then i will have all the files off the virus'd USB stick, and no virus on my laptop?

Assuming the malware is not spread beyond the operating system, you may wipe the drive and install a fresh copy of Windows. If you have restoration point set up in Windows, you may try using it — it’s likely it will also provide a clean version.

Assuming that files on that pendrive were the attack vector, it will stay clean until you will infect it again by using those files. The files are the problem, not the USB stick.
____
⁽¹⁾ This is probably the grain of truth on which that video was based.
⁽²⁾ Which is why in many companies you can’t put anything into USB ports, as mentioned by someone above.
⁽³⁾ For pedants: technically a pendrive itself could be infected, but that’s not seen in practice. And someone having such malware in their hands would not use it to learn what songs your are listening to.

[Jan Audio]

You need a extra "ZOO" computer, where all the virusses live.

[Faringdon]

Thanks
If you get a virus from a USB stick, then is the only way to get rid of it to re-install windows?
Does re-installing windows definetely get rid of a virus?

[Bassman59]

Thanks
If you get a virus from a USB stick, then is the only way to get rid of it to re-install windows?
Does re-installing windows definetely get rid of a virus?

The only way to get rid of those viruses (not virus's) is to toss your computer into the shredder.

[Just_another_Dave]

Thanks
If you get a virus from a USB stick, then is the only way to get rid of it to re-install windows?
Does re-installing windows definetely get rid of a virus?

It depends on the type of malware. Most can be eliminated easily just by deleting the infected files (this might require substituting them by a non infected version if the file is necessary for the system). In this case, re-installing windows will get rid of the malware, yet other methods can be used (manually deleting the file, using an antivirus, starting the system in safe mode to impede it from executing and then running the antivirus, running an antivirus from a live cad, etc)

However, there are other types of malware that infects the master boot record or the bios of your computer, making it more resilient and difficult to delete. In this case, it would be necessary to rewrite the MBR or to flash an uninflected firmware to your computer bios

[dietert1]

People cannot use USB pen drives in a company for safety reasons. Everybody educated in IT should know that executables are hidden that establish communication between the systems that the USB drive visits. If one of those systems happens to be online, the data gets dumped to a host somewhere in the US or in China. The sticks carry with them all kinds of logs, images etc. It has hidden partitions for that.

If you want to transfer data in a safe way, there are tools for that. USB pen drives cannot be used. Once i happened to see somebody using a private USB pen drive in our office. He had to leave for good. There is no excuse. Serious companies have monitoring software to detect such violations.

Regards, Dieter

[Faringdon]

Thanks, also supposing i used a USB mouse on the work PC, then come home and connect this same USB mouse to the home laptop, then could that USB mouse spread a virus to the home laptop, just as if it were a USB stick?

[dietert1]

I never heard of that. It may be difficult due to the different protocols a human interface device uses.
Also your case is the first time i hear that they not only detect security violation automatically but include immediate punishment.

Regards, Dieter

[Just_another_Dave]

Thanks, also supposing i used a USB mouse on the work PC, then come home and connect this same USB mouse to the home laptop, then could that USB mouse spread a virus to the home laptop, just as if it were a USB stick?

That would require having a rewritable memory inside the usb mouse that could be accessed by the computer, which is not a common thing as far as I know. A mouse that installs malware on your machine when connected for the first time seems easier to make (something similar to rubberducky), but I haven’t heard of anything like that, so it seems quite improbable that if your computer has a virus it was installed this way

[golden_labels]

People cannot use USB pen drives in a company for safety reasons. Everybody educated in IT should know that executables are hidden that establish communication between the systems that the USB drive visits. If one of those systems happens to be online, the data gets dumped to a host somewhere in the US or in China. The sticks carry with them all kinds of logs, images etc. It has hidden partitions for that.

Any reputable source confirming that story? In particular one that explains, how that works from technical point of view and how comes no one knows about that? If not, than stop making Faringdon even more confused than they already are.

If you get a virus from a USB stick, then is the only way to get rid of it to re-install windows? Does re-installing windows definetely get rid of a virus?

That has already been asnwered in my post. Along with telling you that viruses are nearly non-existent nowadays and nearly surely it’s not a virus. Give yourself a few more minutes to read posts carefully. You can’t acquire understanding of any topic by skimming over a piece of text and picking up some random words.

[dietert1]

In a town nearby named Ettlingen there is a software company named Prosoft. They are making those monitoring tools i mentioned above.
I think i already mentioned how it works: When you buy the stick it comes prepared with hidden storage space and with executables that support hidden collection and distribution of data. As far as i remember it requires support from the operating system and that exists since W7.
Have a look here:
https://www.all-about-security.de/unternehmen-im-fokus/prosoft/usb-sticks-in-industriellen-steuerungssystemen/
Their idea seems to be: One can use USB pen drives in an environment with the proper safety tools (hardware and software).

Regards, Dieter

[golden_labels]

This is not a source for what you have said above. Provide source for the claim you actually made. Also, please provide it in English, for everyone being able to read it: after all a worldwide conspiracy of that scale must be covered by some English source, right?

[dietert1]

The link i gave you referred to "stuxnet"? On the web you will find some details, like it was a US military project and cost about 50 Million US$. A general named James E. Cartwright was accused in 2013 for giving details of the project to the New York Times. Stuxnet has peer-to-peer capabilities, that is communication when not online. Why don't you ask the experts at Prosoft? If they mention stuxnet in context with USB pen drives, they certainly know more. These things are real.

Regards, Dieter

[golden_labels]

tl;dr: you seem to inflated facts, blown a story out of proportions by a few orders of magnitude, turning a relatively small event of “may happen” nature to a distorted, grotesque vision of the reality where “may” was replaced with “always”. Which is false and harmful to OP.

Yes, it did. But what you said is not that Stuxnet exists. Not even that there exist malware that is being spread on pendrives. Not even about a possible, though complicated and expensive attacks using specially crafted USB sticks. For that I would not ask for sources, considering that I have already covered those in my own answer.

You made a claim, extreme in its nature, about arbitrary USB sticks being inherently dangerous to use, that they run (magically by themselves!) hidden executables, collect data and send them to servers. Drawing a picture that implies they shouldn’t be used at all, and either pretending that’s authoritative information or shutting off criticism by adding that “everybody educated in IT” would support that.

To start with, this is a universal quantification style statement. For that you can’t link a source that gives existential quantification. Even worse, a source that is referring to events that are mostly historical, while your claim is in present tense.

So I am asking, again: provide sources that confirm the statement you have actually made. Not something that matches some random words from it. Otherwise stop spreading misinformation. Feringdon is clueless enough, already fell victim to people spreading similar bullshit and by making such frivolous claims you are hurting them even more. I will not make guesses, what motivates you to do that, but perhaps think twice about the harm you are causing.

No, there is no inherent risk associated specifically with that technology. USB sticks in your control do not come from factory preloaded with malware to steal data from your system and send it to three letter agencies. There is no “everyone educated in IT knows” style knowledge about such a thing. Using pendrives may cause risk, just like anything else may: that happens for very specific reasons and in particular circumstances, not by default. The full explanation is above. You are free to disagree and address concrete points, in case I conveyed invalid information.

[newbrain]

tl;dr: you seem to inflated facts, blown a story out of proportions by a few orders of magnitude, turning a relatively small event of “may happen” nature to a distorted, grotesque vision of the reality where “may” was replaced with “always”. Which is false and harmful to OP.

Yes, it did. But what you said is not that Stuxnet exists. Not even that there exist malware that is being spread on pendrives. Not even about a possible, though complicated and expensive attacks using specially crafted USB sticks. For that I would not ask for sources, considering that I have already covered those in my own answer.

You made a claim, extreme in its nature, about arbitrary USB sticks being inherently dangerous to use, that they run (magically by themselves!) hidden executables, collect data and send them to servers. Drawing a picture that implies they shouldn’t be used at all, and either pretending that’s authoritative information or shutting off criticism by adding that “everybody educated in IT” would support that.

To start with, this is a universal quantification style statement. For that you can’t link a source that gives existential quantification. Even worse, a source that is referring to events that are mostly historical, while your claim is in present tense.

So I am asking, again: provide sources that confirm the statement you have actually made. Not something that matches some random words from it. Otherwise stop spreading misinformation. Feringdon is clueless enough, already fell victim to people spreading similar bullshit and by making such frivolous claims you are hurting them even more. I will not make guesses, what motivates you to do that, but perhaps think twice about the harm you are causing.

No, there is no inherent risk associated specifically with that technology. USB sticks in your control do not come from factory preloaded with malware to steal data from your system and send it to three letter agencies. There is no “everyone educated in IT knows” style knowledge about such a thing. Using pendrives may cause risk, just like anything else may: that happens for very specific reasons and in particular circumstances, not by default. The full explanation is above. You are free to disagree and address concrete points, in case I conveyed invalid information.

I must thank you for sparing me the hassle of writing pretty much the same things.
Extraordinary claims need extraordinary proof, not a link to a three paragraph, generic, article.

[coromonadalix]

I've been given 2x chineese foldable led lamps with an micro usb port for charging them

When i connect them to my pc, they do try to enumarate as a device in the windows device manager, but gives an error mark with no pid vid to show ...

Sure Windows is seeing something ??

I was always intrigued by them, never dismantled them to see what they hide

After this small incident, i always disabled the autorun feature of any windows ...

[dietert1]

Exactly, Autorun is the visible part that you disable to feel safe. Nobody should believe public statements over IT safety. There is good reason to ignore those and instead adhere to restrictive IT safety methods. No USB pen drives in the office!

Although it isn't my business: One exercise i recommend is running a windows PC with airgap. No online connection, no WLAN, tape over USB slots. And it needs to be an older hardware that doesn't include hidden wireless technology on its mainboard. You will find yourself in a miserable situation. After some weeks i setup a data connection based on a MCU testkit, using RS232 to transfer data to the rest of the world. And i found screenshots on the system disk waiting for transmission. Thus you can learn something about IT safety.

Regards, Dieter

[Bassman59]

Exactly, Autorun is the visible part that you disable to feel safe. Nobody should believe public statements over IT safety. There is good reason to ignore those and instead adhere to restrictive IT safety methods. No USB pen drives in the office!

The pro audio company Avid's line of live sound mixing consoles (D-Show, Profile, SC-48, S6L) all run Windows under the hood, because in large part the processing is based on ProTools.

The usual USB drives are used by mix people to store and transfer "show files," which keep all of the console's settings and allow you to build a show on a computer and then load it into the console and now you're all configured as you like.

And I know owners of these consoles that have had to wipe them clean and reinstall the software because someone brought in a USB drive with a virus on it, and the console's Windows doesn't disable the autoload and yes, the console got a virus and wouldn't work. A friend just told me she mixed a show at the Bowery Ballroom in NYC and they have a new S6L and she said that the venue production manager took her USB drive and scanned it for viruses on a computer before allowing her to plug it into the console.

USB drives are just too convenient but there has to be a better way to manage the virus problem with them. Maybe not running Windows is the first step?

[ataradov]

Disabling autorun is not going to help against malicious devices. Your lamp can enumerate as a keyboard, windows (or linux, or mac) will install drivers automatically. The lamp then can launch a browser, type  any address it likes, close the browser. Now you are relying on the browser security and its ability to not launch things unannounced.

And you always run into this risk. The device may not even appear malicious - it may be a normal mouse or USB drive. But after 10 hours of operation it will re-enumerate as a HID device and to the thing. It then can return to its normal state, and you may not notice it for a long time.

[richnormand]

How about this neat toy I have:
https://hak5.org/products/usb-rubber-ducky-deluxe

Just a bit too pricy to leave in the parking lot for some employee to find.... but.
Many USB keys do have a embedded built-in microprocessor and many can be reprogrammed to show you what they want, including looking like a mouse or whatever.

In some sections in my former employment being caught with a USB was pretty much an instant dismissal, after investigation.

[Doctorandus_P]

One way that is a pretty sure method to get rid of viruses is to buy a new SSD, put it in your PC and then make a fresh install of your OS. These day's you've got a pretty decent SSD for EUR50, so cost is not a very big factor. Additional advantage of this method is that you automatically have a backup of your old configuration.

Another method is to download some kind of Linux distribution, put it on an USB stick and then boot from that, and use it to completely wipe your SSD. Some of the Linux distributions are especially designed as (emergency) boot media and come fully loaded with system management utilities.

[Faringdon]

Thanks for all replies...
Please advise if computer hackers can hack into your laptop by knowing what is the IP address of your home router?

I have an EE 4G mobile wifi router. This has an IP address written on the back of it. So I guess its IP address is fixed to that.(?)

Now, as discussed, I have also been connecting USB sticks into work PC’s, and then connecting these same USB sticks to my home laptop, in order to continue working at home. Now it emerges that the companys have set their PC’s up to put malware etc onto USB sticks so connected. I know this because IT staff have recounted to me what youtube songs I listened to the night before, and even repeated exerpts of conversation I had with my partner, the previous evening. I also believe it may be why my home laptop is freezing and hanging regulatly….the “blue circle” has almost become my personal “coat of arms”.

Anyway, I have re-installed windows on the home laptop, but am still getting problems. I actually wonder if they virus’d the USB stick such that it made my home laptop transmit my router IP address to them. Then knowing this IP address…they could hack into my laptop and make it freeze etc?

..As discussed my home laptop is regularly freezing. Strangely this tends to happen mostly between the hours of 11am to 5pm weekdays. When my laptop freezes, and can’t get on the internet, I then take it to the local coffee shop, and go on their wifi there, with no problems.

So this is kind of making me think that the hackers (or their malware) have got my home router IP address, and are able to use it to mess up my home laptop?

I mean, I am on coffee shop wifi now, and my home laptop is fine. (it couldn’t get on the internet 10 mins ago when I was at home) So I am thinking there is some connection with my home router, and its IP address, being “known” to the malware?

So can I change my home routers wifi address?

[Jeroen3]

Nobody talking about the fact that what op describes can be very illegal?

[Just_another_Dave]

Thanks for all replies...
Please advise if computer hackers can hack into your laptop by knowing what is the IP address of your home router?

I have an EE 4G mobile wifi router. This has an IP address written on the back of it. So I guess its IP address is fixed to that.(?)

Now, as discussed, I have also been connecting USB sticks into work PC’s, and then connecting these same USB sticks to my home laptop, in order to continue working at home. Now it emerges that the companys have set their PC’s up to put malware etc onto USB sticks so connected. I know this because IT staff have recounted to me what youtube songs I listened to the night before, and even repeated exerpts of conversation I had with my partner, the previous evening. I also believe it may be why my home laptop is freezing and hanging regulatly….the “blue circle” has almost become my personal “coat of arms”.

Anyway, I have re-installed windows on the home laptop, but am still getting problems. I actually wonder if they virus’d the USB stick such that it made my home laptop transmit my router IP address to them. Then knowing this IP address…they could hack into my laptop and make it freeze etc?

..As discussed my home laptop is regularly freezing. Strangely this tends to happen mostly between the hours of 11am to 5pm weekdays. When my laptop freezes, and can’t get on the internet, I then take it to the local coffee shop, and go on their wifi there, with no problems.

So this is kind of making me think that the hackers (or their malware) have got my home router IP address, and are able to use it to mess up my home laptop?

I mean, I am on coffee shop wifi now, and my home laptop is fine. (it couldn’t get on the internet 10 mins ago when I was at home) So I am thinking there is some connection with my home router, and its IP address, being “known” to the malware?

So can I change my home routers wifi address?

Home routers normally use dynamic ip addresses. This means that they change their ip from time to time and sometimes it can be forced by restarting the router. However, attacking a computer just knowing it’s in address can be difficult. Routers perform an operation called network address translation, which substitutes the sender IP address in packages by its own, so in order to achieve that type of attack they would need to access an open port in the router that redirects to your computer. Additionally, that port would need to have a vulnerability that could be exploited.

Trojans and remote access tools normally don’t work like that. They are usually based on a reverse connection, which means that the infected computer is the one that connects to the attacker. Therefore, knowing the victim’s ip is not needed

On the other hand, as Jeroen3 has stated, installing malware intentionally on your workers’ computers (or in anyone else’s pc) is illegal in most countries

Edit: If problems occur always at certain times of the day, you might want to check which processes start or are running at those moments as probably the one that is causing the problems is one of them

[Bassman59]

Thanks for all replies...
Please advise if computer hackers can hack into your laptop by knowing what is the IP address of your home router?

I have an EE 4G mobile wifi router. This has an IP address written on the back of it. So I guess its IP address is fixed to that.(?)

The router will have a MAC address (actually more than one). You can't change that.

The IP address on the WAN side is assigned by your ISP. The IP address on the LAN side is something you configure.

[janoc]

The amount of BS in this thread is just   

And thinking that most people here are engineers and are supposed to have at least a basic clue how computers work?

(to the person who thinks that their Chinese lamp is trying to hack their Windows - nope, what you are seeing is just Windows attempting to enumerate an USB device and failing at it because the lamp most likely  isn't really talking to the computer at all, only drawing power from the port. All you need for Windows to detect something being connected is a pull-up resistor on one of the data lines.)

[blacksheeplogic]

(to the person who thinks that their Chinese lamp is trying to hack their Windows - nope

Yea, why chip the lamp when it's much easier & cheaper to chip the USB cable. But not to worry, 5G's coming and this will be a thing of the past.

[golden_labels]

While Just_another_Dave’s explanation is delivering the right message, two things need to be clarified.

Whether the IP address is changing with modem reset depends on ISP’s policies. They may, they may not. Even if the address changes, enumerating the entire IPv4 address space is just a few minutes in 2020s.

While NAT accidently provides some level of protection, it is not a firewall. It has never been designed to prevent intentional access to computers behind NAT. NAT’s job is to route packets to desired addresses, not to prevent packets from not being routed. The abstraction NAT provides may be easily misunderstood and wrong conclusion may be drawn from that view, if someone forgets what are the limits of that abstraction. Saying that NAT is a security mechanism is the same as saying that a “turn left” sign on a road prevents cars from turning right. Of the general purpose attacks slipstreaming is the most recent, but there has also been many other examples, dealing with NAT implementations doing nothing to protect against specifically crafted ingress traffic. A quick overview here. On top of that you have vulnerabilities in gateways. And, if that wasn’t enough, NAT may be skipped if the adversary can execute their software inside the target network.

That of course doesn’t mean the response to OP was in general wrong. I support it — just making it clear that some things are not exactly right.

[dietert1]

..
(to the person who thinks that their Chinese lamp is trying to hack their Windows - nope, what you are seeing is just Windows attempting to enumerate an USB device and failing at it because the lamp most likely  isn't really talking to the computer at all, only drawing power from the port. All you need for Windows to detect something being connected is a pull-up resistor on one of the data lines.)

So, you think there is that pull-up resistor but nothing else. Then the pull-up resistor should not be there. The more plausible scenario is a chip in the lamp to ask for a certain power level. I guess the lamp is chipped and we should be aware of that. The only conclusion can be: Don't use USB lamps in office.

Regards, Dieter

[Just_another_Dave]

While Just_another_Dave’s explanation is delivering the right message, two things need to be clarified.

Whether the IP address is changing with modem reset depends on ISP’s policies. They may, they may not. Even if the address changes, enumerating the entire IPv4 address space is just a few minutes in 2020s.

While NAT accidently provides some level of protection, it is not a firewall. It has never been designed to prevent intentional access to computers behind NAT. NAT’s job is to route packets to desired addresses, not to prevent packets from not being routed. The abstraction NAT provides may be easily misunderstood and wrong conclusion may be drawn from that view, if someone forgets what are the limits of that abstraction. Saying that NAT is a security mechanism is the same as saying that a “turn left” sign on a road prevents cars from turning right. Of the general purpose attacks slipstreaming is the most recent, but there has also been many other examples, dealing with NAT implementations doing nothing to protect against specifically crafted ingress traffic. A quick overview here. On top of that you have vulnerabilities in gateways. And, if that wasn’t enough, NAT may be skipped if the adversary can execute their software inside the target network.

That of course doesn’t mean the response to OP was in general wrong. I support it — just making it clear that some things are not exactly right.

Thanks for clarifying my answer. I didn’t want to mean that NAT is a security mechanism, but that reverse connection is simpler and therefore more probable (although direct connection has been used by some Trojans in the past). Therefore, I wouldn’t get paranoid and try to force a change of my ip constantly. Looking for strange processes running on your computer might be a more effective way of detecting if something strange is running on it (although it is possible to hide it).

Whether or not it came from his company, having any type of malware running on your computer is a risk and, therefore, I understand Faringdon being concerned about things happening that he hasn’t done. But concern mixed with lack of knowledge on this topic can escalate pretty quickly to fear and paranoia, specially if you’re not familiar with any of the topics discussed in this thread (I don’t know his background, so I shouldn’t assume that he knows how a computer works internally). Erasing his computer could erase most virus and in any case it will solve most problems, specially those ones caused by messy uninstallations, so there will always be an improvement if that reduces his concerns.

However, having a constant fear of being infected with some kind of virus could be a problem and, if that’s going to be the case, it might be a better idea to take the computer to someone that can inspect it (some technical services offer those services and his country might have a public it security service, like Incibe in Spain)

Edit: Regarding mouses, usbs or lamps that install malware on your computer, the same thing happens. I’m pretty sure that if you search on defcon videos someone has done something like that (and it hasn’t been done yet, it will in a future defcon). However, I doubt that his company has the means to interfere in the devices bought by its employees in any store to substitute them with malware infecting ones (and a massive attack would probably had been detected). For that reason, it wouldn’t be the first place were I’d look for the source of a possible infection. Although it is technically possible, it is quite improbable.

Additionally, I wouldn’t assume that the malware has been provided intentionally by his company. There are many other possible sources and considering that the company might have provided it unintentionally is also worth it (if they haven’t deactivated the USB ports of their computers, they might have been accidentally infected by another employee). In any case, once a trojan has been isolated it is easier to find its source by inspecting its connections, so it seems a better idea to focus on determining whether or not some kind of malware is installed on the computer before start creating conspiranoic theories that could potentially frighten him

[Just_another_Dave]

..
(to the person who thinks that their Chinese lamp is trying to hack their Windows - nope, what you are seeing is just Windows attempting to enumerate an USB device and failing at it because the lamp most likely  isn't really talking to the computer at all, only drawing power from the port. All you need for Windows to detect something being connected is a pull-up resistor on one of the data lines.)

So, you think there is that pull-up resistor but nothing else. Then the pull-up resistor should not be there. The more plausible scenario is a chip in the lamp to ask for a certain power level. I guess the lamp is chipped and we should be aware of that. The only conclusion can be: Don't use USB lamps in office.

Regards, Dieter

You can always open it up and inspect what’s inside of it. If it’s just a pull up resistor to ensure that the lamp is detected so the computer delivers energy to it, everything is fine, and if there’s something concerning inside it, you will help a lot of people by notifying it. Additionally, this is an electronics forum, so you can always build your own lamp if you don’t trust the ones available at stores