Defending against malicious CDs and USB flash drives

Not long ago the Department of Homeland Security repeated a test that has been written about before. According to Bloomberg, they dropped CDs and USB thumb drives in parking lots. As you might expect, people working in the buildings that populate those parking lots picked up the devices and inserted them into their computers.

The news here, according to Bloomberg and people they interviewed, is the actions of the employees. Not to me. I see the story being the failure of the IT departments to educate employees about how dangerous this is. And, how Windows computers can be defended against this sort of thing. Neither is rocket science. 

One supposed expert that Bloomberg consulted called the employees "idiots". This is ridiculous. These people worked for either the US government or private contractors with, no doubt, dedicated IT staff. Bankers don't blame computer nerds when loans aren't re-paid yet computer techies blame civilians when the stuff they are responsible for, fails.

 The first time I read about a test like this, the USB flash drives exploited the autorun feature in Windows. The Bloomberg story didn't go into this, but it bears repeating: autorun in Windows can be totally, perfectly, 100% defended against. Too few people are aware of this. The defense is a simple modification of the registry,  and it works on all versions of Windows. I  wrote about it, here, back in January 2009 (The best way to disable Autorun for protection from infected USB flash drives).

In a follow-up to the Bloomberg story, Lifehacker suggested opening suspect hardware in a virtual machine. There are better, simpler options. 

The safest approach is to use Linux, as so little malware targets it.

Windows users are best served with a copy of Linux on a USB flash drive. Just yesterday I ran Mint version 10 off a USB flash drive to delete files in the Windows recycle bin, files that Windows itself would not display, but were there nonetheless.

Many Linux distributions can also run off a bootable CD, but CDs are slow and some computers don't have optical drives.

Another option is to install Linux under Windows (Ubuntu can do this using Wubi). Then, much like Apple's Boot Camp, you can chose to run Linux or Windows when the computer is powered on.

 Sticking solely with Windows, Sandboxie can offer excellent malware protection, even using the free edition. A case can be made that Sandboxie protection is better than that offered by anti-malware software. 

In dealing with malicious CDs and thumb drives, run Windows Explorer in a sandbox configured to discard all changes. Close Windows Explorer, and changes made to the system by a malicious software on the hardware device get backed out. 

As a plus, Sandboxie can offer ongoing protection from many types of malware, including spear phishing. 

Virtual machines are a valid Defensive Computing approach, but they take much more work than booting to Linux or running inside a sandbox. And, with a virtual machine running Windows, there is still a chance of malware leakage either through file sharing or a bug in the virtual machine software. 

While some government employees may be idiots, that's beside the point. The real issue is that computer techies, at times, blame others for their failings. If a USB flash drive in a parking lot breaches security, it's not the fault of the non-techie that picked it up.

Defending against malicious PDFs with SumatraPDF

We've seen it time and time again: someone sends an employee an email with a malicious attachment, they open the attachment and all hell breaks loose soon thereafter.

One enabler for this type of attack is widely used, bloated, buggy software. Opting instead for small (not many bells and whistles), unpopular software makes you safer. This is especially important when dealing with files from strangers (and any file attached to an email message should be considered coming from a stranger).

This is not to suggest un-installing Word and restricting yourself to WordPad. Rather, that opening files in a word processor that doesn't support macros, for example, makes you safer. 

The epitome of bloated popular software is probably the Adobe PDF Reader.

It's a huge download because it has every feature ever invented. The more code, the larger the attack surface. For example, the Adobe Reader includes Flash, an accident waiting to happen if there ever was one.

Any popular application is always going to be targeted by bad guys as it offers the most bang for the buck. You are therefore, safer as a lesser target. This is not fair to Adobe any more than avoiding Internet Explorer is fair to Microsoft. But, fairness is not my priority, Defensive Computing is.

And, the Adobe Reader has a third strike against it: a long history of security vulnerabilities.

Without question, if someone emails you a PDF file, opening it in the Adobe Reader is a Defensive Computing mistake.

This was illustrated last month in an article, Anatomy of a PDF Hack, by Tomer Bitton. The author, a security researcher, offered a step by step dissection of a malicious PDF file. It's one thing to  read about malicious PDFs, but quite another to see one up close and personal. As Bitton puts it:

PDFs are widely used business file format, which makes them a common target for malware attacks. Because PDFs have so many "features," hackers have learned how to hide attacks deep under the surface. By using a number of utilities, we are able to reverse engineer the techniques in malicious PDFs, providing insight that we can ultimately use to better protect our systems.

The malicious PDF in question started out by exploiting JavaScript, so a knee-jerk reaction is to disable JavaScript in your PDF viewer. But the problem is bigger than JavaScript.* The problem is bloated, buggy, popular software.

What to use instead?

Windows users have an excellent option, the SumatraPDF viewer.

Why SumatraPDF?

1. No bells and whistles. For example, SumatraPDF does not support either JavaScript or Flash. Less code makes for a smaller attack surface.

2. It's not popular so there is little reason for bad guys to find and target bugs in the software.

3. It's free

4. It's open source

5. It is available in two portable editions and a normally installed edition

6. It is actively developed

7. Unlike the Adobe Reader, it does not install software that runs when Windows boots  

8. Updates do not require a re-boot of the operating system   

9. It's fast 

To illustrate how feature-free Sumatra is, the screen shot below shows the available configuration options, all six of them. In contrast, version 4 of the Foxit PDF reader has 15 different categories of preferences, most with more than one option. How many options does the Adobe Reader offer? Frankly, I don't want to count them all.

That said, SumatraPDF does have one useful feature: it remembers where you were in a PDF file and when you re-open the same PDF it takes you back to where you left off. 

Portable versions of SumatraPDF are available both from the author, Krzysztof Kowalczyk and at Portableapps.com. Given a choice, I always prefer portable applications.
The portable version from the author is downloaded as a zip file containing a single SumatraPDF.exe file. Unzipped, the EXE is just over 4 megabytes. As with any portable application, I suggest renaming it to include a version number and/or a date.

In Firefox 5, the portable version of SumatraPDF can be made the default PDF viewer.

To do so, click on Tools -> Options -> Applications tab. Then find PDFs under the Content Type column (the exact name varies depending on the default Windows PDF viewer) and in the Action column, click on the drop-down and select "Use other...".  The portable edition of SumatraPDF may or may not be in the list of available applications for viewing PDFs. If not, click the Browse button and navigate to it. PDFs will open in SumatraPDF rather than a browser window. I did not try the normally installed version.

Chrome users already have another feature-light viewer built into their browser that shares many of the advantages of SumatraPDF.

Still, Chrome 12 users can make the portable version of SumatraPDF their PDF viewer by first making it the default PDF viewer for Windows. Then, enter "about:plugins" in the address bar and disabling the Chrome PDF Viewer is self-explanatory. Doing so causes the browser to fall back on the default PDF viewer for the operating system. 

According to the online manual,

The "full installer" version includes a browser plugin for Firefox, Chrome and Opera (Internet Explorer is not supported). It's not installed by default so you have to use installer's options button to install it. You might need to configure the browser too: enable Sumatra's PDF plugin and disable PDF plugin from other programs.

The author says that SumatraPDF works with Windows XP, Vista and 7. The documentation at portableapps.com also mentions Windows 2000 and Wine under *nix.
The latest version of SumatraPDF is 1.6 and it was released May 31, 2011. 
By default, SumatraPDF automatically checks for updates when you run it, but this can be disabled with one of the six configuration options.

This is not to argue that Sumatra necessarily be the only PDF viewer installed, rather that it be the default PDF viewer. Certainly there will be times that you need one of the bells and whistles provided by a more fully-featured application. Fine.

Just start out safe.

*Even if JavaScript in PDFs was the only issue, you still need to disable it on every computer you come into contact with (in possibly more than one PDF viewer), hope that the next version/release of your PDF viewer doesn't re-enable it by default and know how to enable it again for the rare PDF that needs it. And, the argument to use unpopular software extends to the operating system too. The malicious PDF analyzed in the article targeted Windows. Mac and Linux users would have been safe.