Corporate computer crimes, often referred to as cybercrimes, involve unauthorized access, damage, theft, or fraud using computer systems. Cybercriminals employ a variety of techniques, both technical and non-technical, to perpetrate these crimes. Understanding these methods can help organizations prepare and defend against them. Here's a summary of common methods:

1. Phishing Attacks:
- The attacker sends deceptive emails to trick employees into revealing sensitive information, like login credentials or personal information, or clicking on malicious links that install malware.

2. Spear Phishing:
- Similar to phishing, but these emails are more targeted, often aimed at specific individuals or departments within a company.

3. Social Engineering:
- Tricks individuals into revealing confidential information through manipulation or deception. This could be over the phone, in person, or online.

4. Malware:
- Includes ransomware, spyware, trojans, worms, etc. These malicious software programs can steal, encrypt, or delete data, alter or hijack core computing functions, and spy on the user's computer activity without their knowledge or consent.

5. Drive-by Downloads:
- Unintentional download of malicious software onto a user's system when they visit a compromised website.

6. Man-in-the-Middle (MitM) Attacks:
- The attacker secretly intercepts and possibly alters the communication between two parties.

7. Password Attacks:
- Includes brute force attacks, dictionary attacks, and credential stuffing. Attackers try to guess or crack user passwords to gain unauthorized access.

8. Exploits:
- Take advantage of software vulnerabilities. Often, these vulnerabilities are in outdated software versions, which haven’t been patched.

9. Advanced Persistent Threats (APTs):
- Prolonged and targeted cyberattacks where the attacker remains in the network undetected, often for purposes of espionage or data theft.

10. Insider Threats:
- Employees or partners with inside information concerning an organization's security practices, data, and computer systems can be a significant risk if they decide to misuse this information.

11. Physical Theft or Access:
- Direct physical theft of devices (like laptops or hard drives) or unauthorized physical access to a computer or server room.

12. Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks:
- Overwhelm a network, service, or website with traffic, causing it to be slow or unavailable to legitimate users.

13. SQL Injection:
- Attackers exploit vulnerabilities in a website or web application's code to gain unauthorized access to databases.

14. Zero-Day Exploits:
- Attacks that target vulnerabilities in software or hardware that are not known to the vendor or the wider public.

15. DNS Tunneling:
- Uses the DNS protocol to communicate non-DNS traffic, often bypassing network security measures to exfiltrate data or establish command and control channels.

Preventing these attacks requires a multi-faceted approach that includes technical measures (like firewalls, intrusion detection systems, encryption, and regular patching), user training, and strong security policies and procedures.

What was that story about cybercriminals depositing compromised USB drives in the staff car park so that they would take them into the offices past security and plug them in to the system?

The tactic you're referring to is a form of social engineering where cybercriminals "lose" USB drives—often infected with malware—in places where curious individuals might find them, such as parking lots, cafeterias, or other public areas. The hope is that someone will pick up the USB drive and plug it into their computer, either out of curiosity, to identify the owner, or to use it for personal storage. Once plugged in, the malware can auto-execute or entice the user to click on a seemingly innocuous file, thus compromising the computer or even the entire network.

One of the most notable stories that brought this tactic to the public's attention was an experiment conducted by the U.S. Department of Defense in 2008. In this test, USB drives were intentionally dropped in parking lots of government buildings. Reportedly, 60% of the employees who picked them up plugged them into office computers. If there was an official logo on the USB drive, the rate of plugging in jumped to 90%.

This experiment and similar tests highlight the human element of cybersecurity. Even with the best technical defenses in place, human behavior can introduce vulnerabilities. It emphasizes the importance of ongoing cybersecurity training and awareness campaigns in organizations.

However, it's worth noting that not every reported case of such a tactic is true or verified. Some stories get sensationalized or misreported, but the core lesson remains: The human factor is a crucial component of any security strategy.

How Could OOBA Prevent Such an Attack?

Out-of-Band Authentication (OOBA) can be an effective countermeasure against various cyber attacks, including those initiated by malicious USB drives. However, it's essential to understand how OOBA works and how it would fit into defending against such an attack.

OOBA involves using a separate communication channel for verification or authentication purposes. For example, after entering a username and password on a computer (the primary authentication channel), a user might receive a code via SMS on their phone (the out-of-band channel) that they must enter to complete the login.

Now, let's break down how OOBA could prevent or mitigate the impact of an attack from a compromised USB drive:

1. Restrict Unauthorized Access:
If the malware on the USB drive aims to access restricted resources or systems by stealing credentials, OOBA can help. Even if the malware captures a user's primary login details, it wouldn't have access to the separate channel (like the user's phone) to intercept the second authentication factor.

2. Prompt Suspicion:
If a user receives an unexpected OOBA notification (like a code via SMS or a mobile app notification) when they haven't initiated a login or transaction, it can serve as a warning sign that something is amiss. The user might then report the suspicious activity to IT or security personnel.

3. Limit Account Compromises:
If the USB malware is a type of keylogger that records user inputs to capture passwords, OOBA ensures that even with the primary password captured, the attacker would still need the second factor from the out-of-band channel, making unauthorized access more difficult.

However, while OOBA can provide an additional layer of security in these scenarios, it's essential to recognize its limitations concerning compromised USB drives:

- Initial Infection: OOBA can't prevent the initial compromise if the USB drive contains malware that exploits vulnerabilities in the operating system or software. Users should be trained never to plug in unknown or suspicious USB devices.

- Laterally Moving Malware: If the malicious software on the USB device aims to move laterally within a network or exploit system vulnerabilities, OOBA by itself won't stop this. Network segmentation, intrusion detection systems, and regular system patching are essential here.

- Data Destruction: If the USB malware's purpose is to destroy data or cause disruption (like ransomware), OOBA won't directly prevent this. Backup strategies and malware detection mechanisms are crucial.

In conclusion, while OOBA can be an effective tool against specific threats from a compromised USB drive, it's just one part of a comprehensive security strategy. Combining it with user training, system hardening, network segmentation, and other security measures is key to robust protection.

Does OOBA Preculde the Response Being Entered into the Same Terminal as the User's Other Credentials?

Yes, the fundamental principle behind Out-of-Band Authentication (OOBA) is that the authentication process uses two separate channels or pathways. This ensures that even if one channel is compromised, the second channel can still provide a layer of security.

When discussing "terminals" or "channels" in OOBA:

1. In-Band Channel: This is the primary communication channel, usually the one through which the user is accessing a service. For example, if a user is logging into a website via their laptop, the laptop and the process of entering a username and password on the website constitute the in-band channel.

2. Out-of-Band Channel: This is a separate, distinct channel from the primary one. Sticking with the website login example, if after entering the username and password the user receives a code via an SMS on their phone, the phone and SMS service constitute the out-of-band channel.

In a proper OOBA setup, the response (like entering an authentication code) provided via the out-of-band channel should not be entered into the same terminal (or channel) where the primary credentials were provided. If both were entered on the same terminal, it would defeat the purpose of having a separate channel, as a compromised terminal could capture both sets of credentials.

That said, in some scenarios (especially with some software-based approaches), it may seem like both factors are being entered on the same device. For instance, a user might receive a push notification on a smartphone app to approve a login attempt they initiated on the same smartphone. While technically on the same device, the two processes (initiating login on a browser and approving via an app) are separated and secured in different application environments, preserving the principle of OOBA. However, true OOBA would ideally want these on entirely separate devices or channels to ensure the highest level of security.

The core idea behind OOBA is to provide a layer of security even if the primary channel (like a user's computer) is compromised. If both factors are captured on the same compromised terminal, the effectiveness of OOBA is diminished.