Office Cleaners Pose Cyber Risk, Police Warn

British police have reportedly warned of a cyber threat posed by a remarkably low-key intrusion method, namely the use of office cleaners.

According to the news publication CBR (formerly Computerwire’s Computer Business Review), criminal gangs are planting “sleepers” in cleaning companies.

CBR quoted a senior police officer with responsibility for cyber crime, namely Shelton Newsham, who manages the Yorkshire and Humber Regional Cyber Crime Team, as its source.

Office cleaners

Newsham reportedly told an audience at the SINET security event that he was seeing a “much larger increase in physical breaches” as criminal gangs diversify how they attack corporations.

“Exploitation of staff is a key area”, Newsham was quoted by CBR as saying. “Organised crime groups are planting ‘sleepers’ in cleaning companies that a procurement team may look at bidding for. There’s no way of auditing their vetting. They’ll also using people in painting and decorating firms; anyone who has out-of-hours access to a building is fair game.”

And Newsham also highlighted an old school attack method when he said that “even the old ‘drop a USB stick’ is back.”

This refers to a technique whereby a malware infected USB stick is dropped in an office car park as bait. It relies on it being spotted by a curious staff member who then decides to plug the infected stick into an office computer.

Low-tech intrusion

It is often easy to overlook the risk of physical breaches such as the above techniques, and Newsham’s warning is a timely reminder to companies that they should not neglect traditional security approaches, as hackers seek to exploit low-tech ways of infiltrating organisations.

This need to safeguard against physical intrusion was noted by ESET’s cybersecurity specialist Jake Moore.

“Cyber security can be very easily undermined if there is poor physical security alongside it,” said Moore. “It’s best to bolster both of these bases of security to maximise protection as without one, the other is flawed. However, this message is difficult to get into the board room sometimes- especially once the price tag is seen.”

“The best way to realise a business’ own flaws is to conduct a basic penetration test that involves both physical and cyber threat vectors, and this will easily highlight where those risks lie,” said Moore. “It would be arrogant to think that your business does not have weaknesses, so it is best to test these out using red team professionals who will acknowledge any weak points that need addressing.”

Do you know all about security? Try our quiz!

Tom Jowitt

Tom Jowitt is a leading British tech freelancer and long standing contributor to Silicon UK. He is also a bit of a Lord of the Rings nut...

Recent Posts

Patient Dies In Germany After Hospital Ransomware Attack

Real world consequence of ransomware attacks. A female patient has died as a result of…

1 hour ago

Tesla Driver Charged For Sleeping As Car Drove At 90mph

Unbelievable! Driver in Canada charged with dangerous driving, after he slept in fully reclined seat…

3 hours ago

ByteDance Majority Stake Puts Oracle-TikTok Deal At Risk – Report

Plan to keep majority stake in TikTok, will hinder White House approval reports suggest, as…

22 hours ago

Nintendo Shuts the Lid On 3DS

Nearly a decade after it first launched, Japanese gaming giant Nintendo discontinues its popular 3DS…

22 hours ago

Aussie Regulator Refuses To Back Down After Facebook News Warning

Blunt warning from Facebook about blocking news sharing down under, receives equally blunt response from…

23 hours ago

Academic Sector Warned Of Cyber Threat By NCSC

Universities and schools are being warned by UK's cyber guardian of threats posed to their…

1 day ago