British military bans iPods

You'll have to leave your iPod behind next time you drop by the Ministry of Defence for briefing, since the British military has added Apple's digital audio player to their list of things you can't bring to their headquarters.  To be fair, they haven't just singled out the iPod—pretty much any plug-and-play storage device is now verboten due to fears that it'll make they'll make it too easy to smuggle out sensitive information. This, of course, follows on last week's recommendation by research consultancy Gartner that companies ban iPods in their to prevent data theft by employees.

UPDATE: The BBC reports that the MOD is trying to clarify matters and are stating that there is no outright ban on the iPod but that for security reasons they are barring portable storage devices from secure areas.

[Kelvin @ Dec 19th 2005 12:03AM]

why don't they just ban the iPod cable? or put a piece of tape over the computer USB ports?

[Ryan @ Dec 19th 2005 12:03AM]

RAF Wing Commander Peter D'Ardenne says:
"With USB devices, if you plug it straight into the computer you can bypass passwords and get right on the system,".

Since when does a USB device bypass passwords? You would need to be logged on already to even use the device. And if it is the BIOS that is password protected, the OS will not have been loaded to run the drivers/software anyway.

How about he flys the planes, and they leave the security details to their sysadmin.

[nojetlag @ Dec 19th 2005 12:03AM]

@Ryan
they also told us that Saddam has WMD, so of course USB must at least the same danger to us then Saddam was no ? :D Glad the guy got a job in the army otherwise he would likely be on benefits ;-)

[Nebs @ Dec 19th 2005 12:03AM]

@ Ryan

Have you never tried the boot menu on a recent motherboard? Obviously not as you would know that it is possible to boot from the FDD, HDD, NIC, CD/DVD or USB devices. At that point your OS is in control and not the host machine. This gives you complete control of the host resources, nic and hdd; allowing you to dump shadow or sam files, sniff the network or access any file on the hdd. So yes it does allow you to bypass passwords. Oh and BIOS passwords are easy to bypass, erase or guess (http://www.cirt.net/cgi-bin/passwd.pl).

Also, if a usb device is inserted to a system�s that running a windows OS, it will automount the drive and try to run an autorun script in the background (unless specifically disabled. By carefully configuring this script you can perform local privilege escalation and end up with root/admin access. I have seen just such a script at it took only 15 seconds to insert, run and to exit (having performed the exploit). Even without an exploit, how many time have you observed highly privileged accounts left unlocked or logged out? Simple plug in you usb device and run something like pwdump3 and hey presto you have the complete sam database.

I have several usb devices � CLIE, MP3 Player, USB pen drive and every single one have at least 30 mbs of hacking and network security tools � with a couple of exploits thrown in for good measure.

People can and do use usb devices to store and mount attacks from, I have seen it and I do it.

Nebs

ps @ nojetlag

RTFB - the quote said RAF not army - and the RAF had nothing to do with the generation of the intelligence Blair used to go to iraq that was the Security Service, GIC, MI5 and possibly MI6 - geez guy read the press and the postings first - or do you need your nhs prescribed glasses changed?