Attacks aren't always done across the network.
There are many attacks that are physical attacks.
One type of physical attack might
be with a malicious USB cable.
This looks like a perfectly normal USB cable.
We would use it to plug into our computer
and charge our systems, except it
has some additional electronics inside.
It could, in fact, tell your operating system
that it is a HID, or a human interface device.
This is the categorization for keyboards and a mouse,
so when you plug in this malicious USB cable,
it's able to start typing anything that it
would like into your system.
So you might plug in the cable, it would start up
a command prompt, it would type in some commands
to download some malware from a third party site,
and now your system is infected.
This is why you shouldn't simply plug-in any USB cable
that you happen to find.
You need to have some trusted knowledge of where
this cable came from, and trust that it
came from a reliable source.
Similar to the malicious USB cable
is the malicious flash drive.
This may be a perfectly normal working flash drive,
but it may have some additional electronics inside that could
cause problems on your system.
You might be walking through the parking lot,
there's a flash drive on the ground.
Most people would want to know what's on this flash drive,
and could they use this flash drive themselves,
but plugging in this device is probably
going to be a bad idea.
In older operating systems, we automated the processes
that occurred when you plugged in a flash drive,
and would have programs run automatically
from that particular storage device.
Obviously, this is a significant security concern,
and in most modern operating systems,
this automated functionality has been removed.
But just as with our USB cable, we
could still run things from a USB flash drive
by adding additional electronics inside that
have this device recognized as a HID, or human interface device.
So it appears to be a keyboard or mouse,
and when you plug in the flash drive,
you'll notice the command prompt will open, a lot of things
start typing in, and suddenly your system
is now infected with malware.
Even without that human interface device functionality,
there are ways for attackers to simply put
files on the flash drive that might infect your system.
For example, you can put malicious software inside
of PDF files, or have malicious macros run inside
of spreadsheets.
If your USB interface is configured with a boot device,
you might forget that you have this USB drive installed,
and when you restart the system, the USB drive
infects your system during the boot process.
Add some additional electronics, and this flash drive
can turn into a wireless interface that can then
act as a host for other devices to connect into your system,
and you now become a jumping off point
for an attacker who may want to gain access
to your internal network.
These are just some of the reasons
why you want to be very careful about what USB devices you
connect to your computer.
Stealing credit card information has become a big business,
and there's so many different ways
that the bad guys are trying to gain access to our credit card
numbers.
One way they're able to do this is with skimming.
This is stealing our credit card information
as we use the card for some other purpose.
It's copying information, either from the magnetic stripe that's
on that credit card, or it may be gathering information
from the computer system that you're plugging it into.
This would have your credit card number, expiration dates,
the cardholder's name, and anything else
that's on that magnetic stripe.
The attackers are usually adding additional hardware to the card
reader on the device that you're using, and if you're at an ATM,
they may also have a camera that's
monitoring what buttons you press when you
put your PIN into the system.
The attackers will, obviously, skim your credit card numbers,
and then use that information to perform
other financial transactions.
This is why you should always check very carefully when
using a card reader-- maybe pull on the card reader itself
and make sure it doesn't pop out of the system,
and make sure that everything associated with the card reader
looks like it is built into the original unit.
Here's an example of a card reader
where the attacker had to create a little bit of a wider
connection to be able to fit their card reader in,
and this piece of plastic on the inside
is the one put there by the attacker.
You can see they didn't do a very good job.
They damaged the system itself, and if you walked up
to this system and examined it prior to you
putting your card in, you would notice
that something about this did not look quite right.
Some banks have tried to put some oddly-molded plastic
around the outside of their ATMs as a way
to try to prevent somebody from adding their own skimmer
into the system.
They might also put some type of colored or lighted
piece of plastic on the outside, so you
can see this is original to the ATM
and not added by a third party.
Sometimes, attackers are going to use this credit card
information that they've skimmed to perform online transactions,
but sometimes the attacker needs another physical card to use.
In that case, they're going to clone the details of your card.
They'll create an exact duplicate of your credit card,
with all the same numbers and information,
and they'll put even the same CVC, or card validation code,
on the back of the card as well.
The attackers are cloning the magnetic stripe that's
on the back of the card, so obviously they
would only be able to use this card in transactions
that took that magnetic stripe.
The chips that are on the inside of our cards
are not able to be duplicated and can't
be cloned by the attackers.
One very common use of magnetic stripes on cards is gift cards.
The attackers will clone a gift card,
they'll wait for that card to be activated,
and then they'll use the gift card before the legitimate user
is able to do so.