Network penetration firm compromises network with rigged mouse

[pctech]

Some very interesting reading here

http://www.theregister.co.uk/2011/06/27/mission_impossible_mouse_attack/

[Glenn]

I was reading that yesterday, how do they ensure that the mouse goes on a particular network, without having access to the company?

[pctech]

As they were engaged by the company (presumably the IT department) they probably prepared the device, gave it to their contact who plugged it into a PC connected to the network.

[Glenn]

I was thinking outside of the experiment, so say hacking into a bank or other large company.

[Technical Ben]

As they were engaged by the company (presumably the IT department) they probably prepared the device, gave it to their contact who plugged it into a PC connected to the network.

It was not a contact. They just posted it to an address listed in the public accessible company documanets/website. With a covering letter, making it look like promotional material.
So, be very reluctant to plug in that "free" 256mb usb drive you receive in the post as a "special offer". (This has also been done at PC expos!       )

Oh, Glenn, I would guess you would need to know something about the software you are attacking. At the least, this is a key logger or key presser programmed into the hardware. So you could just log key presses for account details or passwords. Once it has these, it then "replays" the key presses followed by your desired command. Such as "*windows key* cmd [connect to my server and upload C: drive]". As long as you have compromised an IT or managers pc, it's likely you have the account with external access. Even banks and the like use Windows. Else if it's only a dumb terminal you got access to, you still have access to everything the staff do. So company Intranet, shared drives etc. From there you could try easy attacks. It's limited, but you've still got a "man" or rather "mouse" on the inside.  

[pctech]

I was thinking outside of the experiment, so say hacking into a bank or other large company.

Lot of social engineering involved as Ben says.

Couple of people have fallen foul of clicking on the links in those 'you have a virus' e-mails/pages.

A temporary member of staff was so alarmed she called me over and I managed to close the page before she clicked run on the malware.