The use of USB's and CRDOMS to distribute malware has been gaining ground over the last year. Yesterday, in Australia, ZDnet.com ran a story "Phishing attack: Your keyloggers are in the mail". It documents the mailing of CDROMS to people within an unidentified Australian enterprise. Users started up the CD's on their computers, which then ran a Windows multimedia file while in the background malware was distributed that collected identity and authentication information.
Quoting Macleonard Starkey from AusCERT the article stated ""Because most users have administrative access to their machines, even in corporate networks today, it will usually be dropped straight to the Windows system32 directory, and start up from there. This is a very low-tech scam but it's also a very good one," Starkey said."
It's very important that enterprises train their employees about social engineering attacks like this. This is another form of a phishing attack where the user has to initiate the attack.
Guy
www.authenticationworld.com
guy.huntington@authenticationworld.com
del.icio.us