Slashdot Log In
Malware Distribution Through Physical Media a Growing Concern
Journal written by twitter (104583) and posted by
Soulskill
on Sun Jan 13, 2008 11:09 AM
from the beware-geek-squad-bearing-gifts dept.
from the beware-geek-squad-bearing-gifts dept.
twitter brings us a story about the increasing number of digital devices reaching consumers with malware already installed. In this case, digital photo frames from three different Sam's Club stores were found to contain the same type of malicious code. We discussed a similar problem with iPods a while back, as well as a more recent situation with Maxtor hard drives. Quoting the Register:
"While a compromise at the manufacturer is the most likely scenario, ISC's Sachs also pointed to retailers as a possible point of infection. Returned products, which could have been infected by the consumer, are frequently put back on the shelf, if they are in sale-able condition, and attackers could take advantage of a store's poor digital hygiene, he said. 'Trying to (infect a product) all the way back at the factory — getting it through all the checks and balances — would be pretty hard to do,' he said. 'But doing it at the store, where there might be loose return policies, and (where) they put it back on the shelf - you are not going to get a million infections, but you might get a person from an investment bank next door.'"
Related Stories
[+]
Apple: iPods Come Complete With Windows Virus 672 comments
kaufmanmoore writes "Cnet is reporting that some video Ipods made after September 12th have the RavMonE virus loaded onto it. In Apple's announcement they take a swipe at Windows security and encourage Windows users to install anti virus applications."
[+]
Hardware: Trojan Found In New HDs Sold In Taiwan 344 comments
GSGKT writes "About 1,800 brand new 300-GB or 500-GB external hard drives made for Maxtor in Thailand were found to have trojan horse malwares pre-installed (autorun.inf and ghost.pif). When the HD is in use, these forward information on the disk to two websites in Beijing, China: www.nice8.org or www.we168.org. The article implies that authorities believe the Chinese government is behind the trojans. A later article pins down the point of infection to a subcontractor company in China. A couple of months back the Register was reporting on pre-installed malware detected on Maxtor disks sold in the Netherlands. This earlier report was downplayed by a Seagate spokesman." The more recent Taipei Times article says that Seagate admits the problem on its Web site, but a search there turns up nothing.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
1990 called... (Score:3, Informative)
(yes I know this is a different story than back then, but it's the same headline)
Pretty bad when photo frames spread computer virus (Score:3, Insightful)
Re: (Score:2)
Re:Pretty bad when photo frames spread computer vi (Score:4, Informative)
Parent
It's only a problem if you use Windows. (Score:5, Insightful)
Now, someday this may start to affect other, non-Windows operating systems. But in many ways I don't think it will be as much of an issue, because many of the alternative OSes have a far more sensible security model than that of Windows. So what easily causes problems with Windows has little to no effect on Solaris, Linux or OpenBSD.
Re: (Score:3, Funny)
Re: (Score:2, Informative)
"Its rare you hear of a Windows infection. Those Linux users need to get with the program if they ever want to gain the desktop." - by Anonymous Coward on Sunday January 13, @11:25AM (#22025570)
True, if they did this stuff, here:
:)
HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA + make it "fun" to do:
http://www.security-forums.com/viewtopic.php?t=50567&sid=c8b24a76a3974ec9bef2bed38c4b64d4 [security-forums.com]
* Windows CAN be secured very well, with a bit of effort, for years of security, even online, for years into the distance if you try what's in that URL above!
It works - & for a small investment of your time, only, & the work done by YOU, only!
(Simply by using the CIS Tool as your guide
Re:It's only a problem if you use Windows. (Score:5, Interesting)
I'm not sure why you've been marked as a "troll", because what you said is completely accurate. Windows systems are more susceptible to malicious software. I'm not sure how that could be disputed. Now, things have gotten vastly better than they were when Windows 95, Windows 98 and Windows ME were developed. But even Windows XP has been widely affected by worms and malware, and Windows Vista is usually little better.
Although I'm an accountant by trade, I've worked at several companies with mixed Windows and UNIX networks. And at all of them we've had significant downtime due to Windows worms and viruses wreaking havoc on our internal networks. But I've never once, at any of those companies, heard of any downtime of the UNIX systems because of such a security threat.
Parent
Re:It's only a problem if you use Windows. (Score:4, Interesting)
Parent
Re: (Score:3, Funny)
Re:It's only a problem if you use Windows. (Score:4, Funny)
Parent
I disagree ... (Score:5, Interesting)
Apparently this guy has never worked in a production firmware environment before: there are fewer checks and balances than you might think, especially because embedded-system guys generally don't have much awareness of Windows malware issues. Unfortunately, more and more embedded devices are being plugged into desktop machines, and with auto-run enabled
Re: (Score:2)
I plead guilty... sort of (Score:5, Insightful)
As a result of this, we started using virus scanners from three different manufacturers. As a software vendor, the risk of shipping a nasty virus to your best customers is very real, no matter how hard you try to prevent it.
Parent
Re: (Score:3, Interesting)
There is a responsibility problem here. Do we blame the hardware manufacturers for producing faulty pro
Autorun is evil (Score:5, Insightful)
I almost got some malware from autorun off a thumb drive, fortunately the anti-virus recognized it and stopped it from running. When that happened, I looked for a surefire way to turn off autorun (and autoplay) but all I found was a bunch of registry edits that may or may not (according to different accounts) turn off autorun/autoplay. Why is there no global option in a Windows control panel for that?
Parent
Re:Autorun is evil (Score:4, Informative)
The closest thing I know of to an official way of disabling autorun is to install Microsoft's powertoy TweakUI [microsoft.com]. As you might guess from the name, it gives you a GUI to tweak various aspects of the Windows user interface, including letting you turn off autorun. I've never had a problem with it.
Parent
Stupid idea (Score:5, Interesting)
Re:Stupid idea (Score:5, Informative)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDROM]
"AutoRun"=dword:0000000
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000FF
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
Takes care of the autorun idiocy.
Parent
Re: (Score:2)
Re: (Score:2)
Registries and stupid ideas (Score:4, Interesting)
Erm - a single script file can easily update thousands of different configuration files on any platform. And for all the world-famous Windows user-friendlyness, I'll take editing some bizarre Linux scripts where key=value over trying to remember hexadecimal codes for Internet Explorer registry entries :-)
Lets not overlook the dangers of having a single, unrebuildable registry for all the system settings... What happens when it gets hosed? I seem to remember that Windows 95 used to keep two copies of the registry around and could rebuild it if you deleted it. Windows XP seems to have lost that ability - I have no idea if Vista has recovered it.
Cheers,
Toby Haynes
Parent
Re: (Score:3, Interesting)
Re:Stupid idea (Score:4, Insightful)
This is just what I've always been talking about with Windows. Why does it take this level of deep knowledge of the operating system to secure against the most idiotic of exploits? Ask an engineer of any other operating system about autorunning executable code from just any media that's inserted and they'll look at you like you've been taking crazy pills.
This is along the same lines as many other questions I have about Windows, like why can image files execute code? Why is it possible for ActiveX scripts to change system registry values and download software to your hard drive? Why is everything not named the same between versions? Why does everyone still use it?
Le sigh....
Parent
Re:Stupid idea (Score:4, Informative)
By the way, like so many other Windows features, this one was copied from Apple. HFS CDs could have some flags set designating them as autostart CDs and a named file would be run when they were inserted. This 'feature' was used to spread a few Mac viruses in the '90s and was never added to OS X.
Parent
Re:Stupid idea (Score:4, Insightful)
Parent
Re: (Score:2)
Re: (Score:3, Funny)
grrrr...this one bit me at work again last week. I was in the middle of a big project and had probably half a dozen windows open. I cannot imagine why MS thought this was a good idea. Can I turn it off?
Re: (Score:2)
Malware Economics 101: It's a quantity game (Score:5, Insightful)
Rather, I suspect infection at or near the source -- slipping malware into the firmware or shipped software that goes with the device. At that point in the software delivery chain, a single act of infection can be distributed to tens or hundreds of thousands of machines. I could also imagine targeting highly promiscuous machines (e.g. WiFi routers) that have a high chance of being in contact with other promiscuous machines (i.e. other routers or laptops).
Although I'm sure some people get their grins by infecting one machine at time, the malware industry is more about collecting the largest quantity of machines at the lowest possible cost.
Re:Malware Economics 101: It's a quantity game (Score:5, Insightful)
If the world was asshole-free then people would never get their cars keyed, tires slashed or houses egged unprovoked.
Parent
Sony? Sears? (Score:5, Insightful)
Learned About this a Long Time Ago (Score:5, Interesting)
I downloaded a free copy of McAffee and it found the virus on my computer as well as every floppy that I had inserted since then that wasn't write protected. McAfee's software offered to clean it but all it did was wipe out the MBR making it where I had to reformat and reinstall everything.
I told a friend at school who had just bought a similar motherboard. He broke the seal on his driver disk, scanned it, and found the virus there too. It was coming from the factory infected.
That was a lesson I will never forget and it happened almost 20 years ago.
Re: (Score:2)
Re: (Score:2)
However, a whole lot of people would reset their computers and forget there was a floppy in the drive. In the time it took them to realize what they had done, the boot sector virus would load and then infect the hard drive boot sector.
It was extremely common.
Re: (Score:3, Interesting)
It's amazing what went out on floppies back then. Out of curiosity, I would scan through "free" sectors on floppies and often I would find internal documents, source code, QA results, unrelated software, etc.
That "idiot" in Bulgaria was probably no idiot... (Score:5, Informative)
Parent
Re: (Score:3, Funny)
Back in the, good ol' days... (Score:2)
Special software included. Yay. (Score:5, Insightful)
No, it isn't anymore. Somebody in marketing had the bright (read: revenue-producing) idea of loading up a new storage device (which should be blank, damnit) with a bunch of advertising crap. Combine this with Windows' oh-so-helpful autolaunch features. Frankly I'm surprised it took this long to become a problem.
I long for the days when you could buy an UNFORMATTED device. The OS would tell you it's unformatted, so you formatted it. Done.
the pervasiveness of malware contributes (Score:2, Insightful)
The pervasiveness of the malware problem contributes to this
Our shop had one shrink wrapped package that had malware included and when this was tracked down the vendor didn't know they had become infected and were distributing shrink-wrapped malware
this underscores the importance of putting a stop to malware
the fundamental error is at the concept level: it is wrong to think it is OK to run your programs on someone else' computer without their knowledge or permission
to invert this properly back to the
Re: (Score:2)
Remember that its their 'feature' which is causing this problem, not the user and the malware authors are only taking advantage of it.
I got one of these! (Score:5, Informative)
I told Microcenter about it and they were like "Huh." Didn't ask anything more, nor did they remove the frames or check them. I was somewhat pressed for time, so I didn't try going up the chain of management to get someone to acknowledge that there was a problem.
It's a good thing I found it though, since it was a gift for my technologicallly illiterate parents. I had taken it out of the package to load pictures up on it. If I had just given it to them directly, I'm not sure what would have happened. AVG caught it when it was plugged in via USB, so probably nothing drastic, except a phone call from my Dad asking me what the pop-up box meant.
Old news... (Score:3, Funny)
Computers have been shipping with Microsoft products preinstalled for some time, I believe.
Re: (Score:2, Funny)
Is windows a virus?
No, Windows is not a virus. Here's what viruses do:
* They replicate quickly - okay, Windows does that.
* Viruses use up valuable system resources, slowing down the system as they do so - okay, Windows does that.
* Viruses will, from time to time, trash your hard disk - okay, Windows does that too.
* Viruses are usually carried, unknown to the user, al
I, for one (Score:5, Interesting)
I have one (Score:2)
It's branded as an eMotion device (model DF-EM7), but it looks identical to the ADS product.
My question - because here at /., I'm not all that relatively geeky - is how would this spread? It accepts photos direct from the computer via a USB 2.0 cable or via memory card. Assuming I'm not stupid enough to plug the thing directly into my computer, am I safe? Will the trojan infect the memory card for subsequent infection of my hard drive (of my Windows machines, not my Mac, right?)?
Also, is there a way f
Re: (Score:2)
Re: (Score:2)
Neither solution works. (Score:3, Informative)
This will offer some protection against factory sabatoge.
No it won't - if the "factory sabotage" consisted of (deliberately or accidentally) having malware as part of "what [the firmware] should be".
2) Any time a unit is returned it should be reset to factory condition.
This will take care of shoppers who buy, infect, and return merchandise.
And how is a reai