While I’m always reluctant to publicise security company’s media releases – believing many of them to be hysterical hype – a quick study by Sophos on lost USB keys has some interesting lessons for all of us who use thumb drives to carry data.
Sophos bought 50 USB drives at Sydney’s CityRail unclaimed lost property auction and analysed them for malware and security risks.
The study – not yet online – found more than 4,400 files including photos, CVs and job applications. Confidential material that could be used for identity theft, stalking or commercial advantage.
Encryption
If you are moving confidential data between computers, it may be a good idea to consider encryption software that protects files from unwanted visitors. Mac OS X has encryption software built in as does all but the home versions of Windows 7 and Vista.
Should you have a computer that doesn’t come with encryption, or you’re taking the drive between different venues, then you may need a third party encryption program like TrueCrypt. Note you’ll need administrator rights to install the software on every machine you use.
The Malware threat
As a security company Sophos leaned heavily towards the malware aspect with a headline that 66%, or 33, of the drives had some sort of malware on them.
While that statistic is suspiciously high, it does illustrate the risk of plugging USB sticks into school, office and internet cafe computers. Like unsafe sex, the likelihood of catching something nasty increases with the more partners you have.
Perversely Apple Macs could be helping spread the malware as Mac users generally don’t use or need anti virus sofware and any viruses picked up on someone else’s Windows system can sit undetected and dormant until they are used on another PC.
Consequently, its good practice to wipe a drive when you’re finished with it so along with deleting malware you are also not keeping unnecessary and possibly out of date files on your drive.
Overall, Sopho’s survey illustrates why cloud services like Dropbox and Box.net are best for sharing data although the USB stick still has an important role when everything else goes wrong.