USB baiting method and design

• US 10,380,051 B1
• Filed: 08/11/2016
• Issued: 08/13/2019
• Est. Priority Date: 08/11/2016
• Status: Active Grant

• Current Assignee: Kimberly-Clark Worldwide Incorporated (Kimberly-Clark Corporation)
• Original Assignee: Kimberly-Clark Worldwide Incorporated (Kimberly-Clark Corporation)
• Inventors: Guneydas, Ismail
• Primary Examiner(s): Auve, Glenn A.
• Application Number:
  US16/320,523
• Publication Number:
  US 20190251052A1
• Time in Patent Office: 1,097 Days
• CPC Class Codes: G06F 13/385 for adaptation of a particular data processing system to different peripheral devices
• CPC Class Codes: G06F 13/4081 Live connection to bus, e.g. hot-plugging current or voltage limitation during live insertion H02H9/004
• CPC Class Codes: G06F 16/953 Querying, e.g. by the use of web search engines
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2213/0042 Universal serial bus [USB]
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G09B 19/0053 Computers, e.g. programming

Abstract

A method for training personnel includes providing a lure device including a unique lure device identifier; providing a data-gathering application to read files and registry entries from a first network-attached computer; recognizing a plug-in event when the lure device is connected to the first network-attached computer; and associating a user with the first network-attached computer. A system includes a lure device including a unique lure device identifier; a first network-attached computer configured to generate a registry entry when the lure device is connected to the first network-attached computer; a data-gathering application configured to determine an identity of the first network-attached computer and to read the registry entry and the lure device identifier on the first network-attached computer; and a reporting application configured to associate a user with the first network-attached computer.

Claims

1. A method for training personnel with respect to computer security, the method comprising:

providing a lure device configured to include a universal serial bus (USB) connector or to be connectable using a USB connector, wherein the lure device includes a unique lure device identifier;

providing a data-gathering application to read files and registry entries from a first network-attached computer;

recognizing a plug-in event when the lure device is connected to the first network-attached computer by the registry entries generated in the first network-attached computer in the plug-in event;

reporting the plug-in event to a reporting server; and

associating a user with the first network-attached computer.

2. The method of claim 1, further comprising including a lure file on the lure device.

3. The method of claim 2, further comprising reporting each attempt to access the lure file to the reporting server.

4. The method of claim 1, further comprising providing a structured database including the unique lure device identifier.

5. The method of claim 1, wherein software is not transferred or installed from the lure device to the first network-attached computer.

6. The method of claim 1, wherein the lure device is a portable USB drive.

7. The method of claim 1, wherein the lure device is a mouse, a keyboard, a microphone, a telephone, a hard drive, a tablet, a camera, a monitor, an exercise monitor, headphones, a speaker, or a headset.

8. The method of claim 1, wherein the data-gathering application is not resident on the first network-attached computer.

9. The method of claim 1, further comprising transmitting a teachable moment web page to the first network-attached computer.

10. A system for training personnel with respect to computer security, the system comprising:

a lure device configured to include a universal serial bus (USB) connector or to be connectable using a USB connector, wherein the lure device includes a unique lure device identifier;

a first network-attached computer configured to generate a registry entry when the lure device is connected to the first network-attached computer;

a data-gathering application resident on a second network-attached computer, wherein the data-gathering application is configured to determine an identity of the first network-attached computer, and to read the registry entry and the lure device identifier on the first network-attached computer; and

a reporting application configured to receive the identity of the first network-attached computer from the data-gathering application and to associate a user with the first network-attached computer.

11. The system of claim 10, further comprising a lure file on the lure device.

12. The system of claim 10, further comprising a structured database including the unique lure device identifier configured to be accessible by the reporting application.

13. The system of claim 10, wherein the lure device is a portable USB drive.

14. The system of claim 10, wherein the lure device is a mouse, a keyboard, a microphone, a telephone, a hard drive, a tablet, a camera, a monitor, an exercise monitor, headphones, a speaker, or a headset.

15. The system of claim 10, wherein the lure device is configured to not transfer software to or install software on the first network-attached computer.

16. The system of claim 10, further comprising a web server configured to transmit a teachable moment web page to the first network-attached computer.

17. A system for training personnel with respect to computer security, the system comprising:

a lure device including a unique lure device identifier, wherein the lure device is a portable universal serial bus (USB) drive;

a lure file stored on the lure device;

a first network-attached computer configured to generate a registry entry when the lure device is connected to the first network-attached computer;

a data-gathering application resident on a second network-attached computer, wherein the data-gathering application is configured to determine an identity of the first network-attached computer, and to read the registry entry and the lure device identifier on the first network-attached computer;

a reporting application configured to receive the identity of the first network-attached computer from the data-gathering application and to associate a user with the first network-attached computer; and

a web server configured to transmit a teachable moment web page to the first network-attached computer when the lure file is activated.

18. The system of claim 17, wherein the lure device is configured to not transfer software to or install software on the first network-attached computer.

19. A method for training personnel with respect to computer security, the method comprising:

providing a lure device including a unique lure device identifier and a lure file, wherein the lure device is a portable universal serial bus (USB) drive;

providing a data-gathering application to read files and registry entries from a first network-attached computer;

recognizing a plug-in event when the lure device is connected to the first network-attached computer by the registry entries generated in the first network-attached computer in the plug-in event;

associating a user with the first network-attached computer;

responding to an activation of the lure file by transmitting a teachable moment web page to the first network-attached computer; and

reporting the plug-in event and the lure file activation to a reporting server.

20. The method of claim 19, wherein software is not transferred or installed from the lure device to the first network-attached computer.