Category hub: Social engineering and human risk

In one sentence: Baiting is when attackers leave something tempting, such as a USB stick or free offer, hoping curiosity makes you plug it in or open it and let them in.

What it is

Baiting is social engineering that relies on curiosity or greed. The bait can be physical, such as a USB stick with an inviting label, or digital, such as a free download.

MITRE ATT&CK describes attackers moving onto systems, including air-gapped ones, by copying malware to removable media and relying on Autorun features. MITRE notes mobile devices and some USB charging cables can also infect a PC over USB.

How it works

1. The attacker prepares a device or file. A USB stick may carry malware, or be built to pretend to be a keyboard.
2. They leave it where the target will find it, or post it.
3. They add a reason to use it, such as a thank-you letter, a gift card or a label like “payroll”.
4. Someone plugs it in.
5. A device that presents itself as a keyboard can type commands automatically. Cybereason notes this can work even where policy blocks removable storage.
6. The code installs a way back in, and the attacker moves on to the network.

Who it affects and how badly

• Sole trader to 10 staff. One infected laptop may hold bank logins, client files and email.
• 10 to 250 staff. Offices, hotels, retail sites, manufacturers and construction firms with shared PCs are easy to reach. One infected PC can lead to ransomware.
• 250 plus and regulated firms. More staff means more chances someone plugs in a device. Healthcare, insurance and fintech face breach reporting if the device gives access to personal data.

Air-gapped sites are not safe, because the bait is the way across the gap.

Real examples

• Mailed USB devices. The FBI warned US businesses that a group it linked to FIN7 mailed BadUSB devices to firms in transportation, insurance and defence from August 2021. According to BleepingComputer’s report of the alert, the senders impersonated Amazon and the US Department of Health and Human Services, with letters, forged thank-you notes or counterfeit gift cards. The FBI said the aim was to deploy ransomware. CNN noted Mandiant had low confidence in the FIN7 attribution. We read this through press reports, not the FBI notice itself.

How to detect it

• New USB devices appearing on a PC, especially ones that identify as keyboards.
• Windows logging of new external devices (the Audit PNP Activity setting).
• Endpoint alerts for programs launched from removable drives, or PowerShell starting right after a device connects.
• Staff reports of parcels, gifts or USB sticks nobody ordered.

How to fix or prevent it

1. Tell staff never to plug in a device they did not buy or receive from a known source. Report it to IT.
2. Block USB storage by policy, for example with Group Policy or Intune device control, on machines that do not need it.
3. Disable Autorun and AutoPlay, a mitigation MITRE lists.
4. Allow only approved keyboards and mice where device control supports it.
5. Keep endpoint protection that watches behaviour, not just files.
6. Give staff a safe way to hand in found devices, such as a locked box and a ticket.
7. Include baiting in awareness training.

Related terms

• Social engineering
• Pretexting
• Phishing
• Trojan
• Tailgating and piggybacking
• Ransomware

FAQ

What is baiting in cyber security?
A social engineering attack that leaves tempting bait, such as a USB stick, so a person lets the attacker in.

Can a USB stick infect a PC even if USB storage is blocked?
Cybereason notes a BadUSB device can register as a keyboard, which may work even where removable storage is disabled.

Which controls does MITRE list for removable media attacks?
Disabling Autorun, limiting hardware installation and using behaviour prevention on the endpoint.

Sources

• https://attack.mitre.org/techniques/T1091/
• https://www.bleepingcomputer.com/news/security/fbi-hackers-use-badusb-to-target-defense-firms-with-ransomware/
• https://www.cybereason.com/blog/fbi-warns-us-companies-to-avoid-malicious-usb-devices
• https://www.cnn.com/2022/01/07/politics/fbi-usb-hackers-warning/index.html

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.