Malware Distribution Through Physical Media a Growing Concern

twitter brings us a story about the increasing number of digital devices reaching consumers with malware already installed. In this case, digital photo frames from three different Sam's Club stores were found to contain the same type of malicious code. We discussed a similar problem with iPods a while back, as well as a more recent situation with Maxtor hard drives. Quoting the Register: "While a compromise at the manufacturer is the most likely scenario, ISC's Sachs also pointed to retailers as a possible point of infection. Returned products, which could have been infected by the consumer, are frequently put back on the shelf, if they are in sale-able condition, and attackers could take advantage of a store's poor digital hygiene, he said. 'Trying to (infect a product) all the way back at the factory — getting it through all the checks and balances — would be pretty hard to do,' he said. 'But doing it at the store, where there might be loose return policies, and (where) they put it back on the shelf - you are not going to get a million infections, but you might get a person from an investment bank next door.'"

1990 called...

[Wonko the Sane]

and it wants its headline back.

(yes I know this is a different story than back then, but it's the same headline)

Pretty bad when photo frames spread computer virus

[Secrity]

I bet that most people would have NO idea that this could possibly happen.

Re:

[Anne Thwacks]

"Digital Photo Frames" is a polite term for "Pornograph". The whole point of these devices os to view the pr0n on your USB key - why else would you want one?

Re:Pretty bad when photo frames spread computer vi

[Secrity]

Nice try; according to TFA, Digital Photo Frames are small flat-panel displays for displaying digital images. TFA didn't specify, but it was implied that they were sold by mainstream retailers.

Re:Pretty bad when photo frames spread computer vi

[pcsourcepoint]

It's like a saying I have heard - buyer beware; Now even more so, for purchased media products. It would pay for the buyer to scan for virus and malware that may be present

It's only a problem if you use Windows.

[Anonymous Coward]

These days, it's really only a problem if you use Windows. Those of us using Linux, *BSD, Solaris, Mac OS X, and other non-Windows operating systems have little to worry about.

Now, someday this may start to affect other, non-Windows operating systems. But in many ways I don't think it will be as much of an issue, because many of the alternative OSes have a far more sensible security model than that of Windows. So what easily causes problems with Windows has little to no effect on Solaris, Linux or OpenBSD.

Re:

[Anonymous Coward]

I know what you mean. Writing a Virus for Windows is extremely complicated given its closed source proprietary nature. Windows users are very diligent on protecting their systems with scanners and always purchase software from a trusting source. Its rare you hear of a Windows infection. Those Linux users need to get with the program if they ever want to gain the desktop.

Re:

[Anonymous Coward]

"Its rare you hear of a Windows infection. Those Linux users need to get with the program if they ever want to gain the desktop." - by Anonymous Coward on Sunday January 13, @11:25AM (#22025570)

True, if they did this stuff, here:

HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA + make it "fun" to do:

http://www.security-forums.com/viewtopic.php?t=50567&sid=c8b24a76a3974ec9bef2bed38c4b64d4 [security-forums.com] :)

* Windows CAN be secured very well, with a bit of effort, for years of security, even online, for years into the distance if you try what's in that URL above!

It works - & for a small investment of your time, only, & the work done by YOU, only!

(Simply by using the CIS Tool as your guide

Re:

[Anonymous Coward]

I wouldn't be at all surprised if your Windows 2003 Server installation was compromised years ago. You just don't realize that it's compromised because Windows so limits the ability of developers to develop the security utilities equivalent to those that come standard with UNIX systems.

WOW; 13 screens of registry hacks and other tweaks

[knorthern knight]

> HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA + make it "fun" to do:

> http://www.security-forums.com/viewtopic.php?t=50567&sid=c8b24a76a3974ec9bef2bed38c4b64d4 [security-forums.com] [security-forums.com] :)

> * Windows CAN be secured very well, with a bit of effort, for years of security, even online,
> for years into the distance if you try what's in that URL above!

There are linux distros with shorter install documentation than that. Wouldn't it be better to use an operating system that did *NOT*,

Re:It's only a problem if you use Windows.

[Anonymous Coward]

The Morris Worm of twenty years ago did cause problems in the UNIX world. However, unlike Microsoft, the UNIX developers and vendors quickly fixed their software. And thus we haven't seen a single worm for UNIX systems since then, although UNIX and UNIX-like systems are the most widely used server OSes, and hence typically networked. Now contrast this to the numerous Windows-only worms that have caused billions of dollars of damages for individuals, businesses and governments around the world, and only in the past decade!

I'm not sure why you've been marked as a "troll", because what you said is completely accurate. Windows systems are more susceptible to malicious software. I'm not sure how that could be disputed. Now, things have gotten vastly better than they were when Windows 95, Windows 98 and Windows ME were developed. But even Windows XP has been widely affected by worms and malware, and Windows Vista is usually little better.

Although I'm an accountant by trade, I've worked at several companies with mixed Windows and UNIX networks. And at all of them we've had significant downtime due to Windows worms and viruses wreaking havoc on our internal networks. But I've never once, at any of those companies, heard of any downtime of the UNIX systems because of such a security threat.

Re:

[complete loony]

"... numerous Windows-only worms". Yes and no. Most of them are trojans, hardly any of them are based on fully automated remote exploits.

Re:It's only a problem if you use Windows.

[TheRaven64]

A decade or so ago, 'UNIX security' was considered an oxymoron. If you wanted security, you ran a real OS like VMS or OS/360. UNIX had a very coarse-grained security model and the code had never been subjected to a proper audit. It's interesting how times change.

Re:

[ajs318]

Coarse-grained security that people actually bother to use is better than fine-grained security that is turned off because it annoys people.

Most people don't need powerful and flexible ACLs. They just need "Ordinary users can't modify this" and "This is not meant to be executable".

Re:

[Monsuco]

Those of us using Linux, *BSD, Solaris, Mac OS X, and other non-Windows operating systems have little to worry about.

So in other words, only a little more than 90% of consumers should worry. Somehow I don't see manufacturers making that argument successfully.

Re:

[gzipped_tar]

Malware being shipped with hardware is hardly news. It is the common practice of computer vendors who ship their hardware with Windows pre-installed.

Re:

[CAR912]

I misread that as "Malware being shipped, with hardware", as though they are now handing out malware with free hardware on which to run it.

Re:It's only a problem if you use Windows.

[Torvaun]

I can't find the "Mac's don't have viruses because no one writes them for macs" "wow, you can't even get people to write viruses for your OS." "yeah, i cry myself to sleep a lot." cartoon.

You mean this one? [cad-comic.com]

I disagree ...

[ScrewMaster]

Trying to (infect a product) all the way back at the factory - getting it through all the checks and balances

Apparently this guy has never worked in a production firmware environment before: there are fewer checks and balances than you might think, especially because embedded-system guys generally don't have much awareness of Windows malware issues. Unfortunately, more and more embedded devices are being plugged into desktop machines, and with auto-run enabled ... well. This whole scenario is hardly surprising.

Re:

[NeverVotedBush]

I would bet a lot of systems that come preconfigured from some small-time vendor have a good chance of being infected too. I'm speaking of point of sale systems, computers attached to instrumentation, etc.

I plead guilty... sort of

[dbc]

Once upon a time I managed a software product testing team. Part of our standard flow for all release candidate CD's was to get fresh signatures and virus scan as both step one and also with refreshed signatures as the last step (2 or 3 weeks later) of declaring a release candidate ready for release. We *still* shipped a CD with malware once, a virus that was too new to show up in the signature files from the scanning software company. Lukily, it was a beta that went to less than 100 customers, and it was a relatively benign Word macro virus. Still, I had to explain to a Vice President how we did virus scanning for releases.

As a result of this, we started using virus scanners from three different manufacturers. As a software vendor, the risk of shipping a nasty virus to your best customers is very real, no matter how hard you try to prevent it.

Re:

[veranikon]

There is the common practice of scanning a filesystem (whether on CD or not) for virus signatures via whatever anti-virus app suits your fancy, but this is an inherently reactionary approach. You can only scan for the virii you're aware of. Why not compute MD5 checkums or something similar over the CD image? Seems like that would be much simpler and more elegant than routinely checking your images against an ever expanding (and always incomplete) list of virii fingerprints. MD5 checksums for linux distr

Re:

[dbc]

You're missing the point. Where does the good signature come from? This is a release candidate CD -- a CD full of freshly revised software and documentation from 100+ developers in 5 sites on 3 continents, all building their deliverables on workstations in some degree of maintenance. Any one of them can source a virus onto their deliverable. You can only make a checksum once you have a known good master. My job was to declare a candidate master "known good".

Re:

[Reziac]

I think the average person overestimates the amount of control a manufacturing process has, unless it's entirely vertical. Buy one chip from some 3rd-party fab, or use a single binary (such as a driver) from outside your trusted, clean-room environment, and you've got a potential attack vector.

The wonder shouldn't be that it happens, but that it happens so *seldom* -- a testament to folks like yourself.

Re:

[Zeinfeld]

Apparently this guy has never worked in a production firmware environment before: there are fewer checks and balances than you might think, especially because embedded-system guys generally don't have much awareness of Windows malware issues. Unfortunately, more and more embedded devices are being plugged into desktop machines, and with auto-run enabled ... well. This whole scenario is hardly surprising.

There is a responsibility problem here. Do we blame the hardware manufacturers for producing faulty pro

Autorun is evil

[kybred]

A better way is to turn off autorun,

I almost got some malware from autorun off a thumb drive, fortunately the anti-virus recognized it and stopped it from running. When that happened, I looked for a surefire way to turn off autorun (and autoplay) but all I found was a bunch of registry edits that may or may not (according to different accounts) turn off autorun/autoplay. Why is there no global option in a Windows control panel for that?

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[fluffy99]

Can I have some of what you're smoking? Linux is infamous for forcing the user to chase down so esoteric option in a text config file. Of course, Windows is really confusing - it's called hold down shift when you insert the USB key (something they stole from Mac, btw).

Re:

[ArmedGeek]

Chevrolets have four tires. (something they stole from Ford)

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[ajs318]

Linux is infamous for forcing the user to chase down so esoteric option in a text config file.

It's not esoteric or obscure. If you have a program, for example wibbulator, you most often can expect its configuration to be stored in /etc/wibbulator -- which, depending on the sophistication involved, may be a simple file or a folder containing several files. What's more, if you want to turn off blah messages, the option is generally a line something like enableblahnotify 1 in the configuration file (or in

Re:

[Anonymous Coward]

hold shift when you connect/insert media and auto-run wont go

Re:Autorun is evil

[Repton]

The closest thing I know of to an official way of disabling autorun is to install Microsoft's powertoy TweakUI [microsoft.com]. As you might guess from the name, it gives you a GUI to tweak various aspects of the Windows user interface, including letting you turn off autorun. I've never had a problem with it.

Re:

[Nirvelli]

I agree, I turned off all of my autoruns with TweakUI, and nothing has ever auto-ran since. Plus, the program has plenty of other awesome options that really should have been shipped with Windows.

Re:

[tlhIngan]

One way to deal with this problem would be to make sure every device has a clearly marked reset button that performs a hard-reset and returns the system to its initial state. Most equipment has this but some does not.

But you don't know how contract manufacturers work. Everyone farms out production to them.

The pace is extremely hectic - if you find a way to speed up testing per unit by 5 minutes, you can save a ton of money.

What happens at the contract manufacturer is a bunch of boards are made, then the "as

Stupid idea

[CastrTroy]

I've always said that autoexecuting stuff on any media inserted was the stupidest feature ever created. It's just asking for viruses to be installed. Actually strike that. It's the second stupidest thing. The stupidest thing is Windows being configured by default to restart for updates after the user doesn't respond for some very short amount of time.

Re:Stupid idea

[jo42]

This is part of a reg file I run on every Windows machine I set up:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDROM]
"AutoRun"=dword:0000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000FF

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

Takes care of the autorun idiocy.

Re:

[ScrewMaster]

I have a similar file myself ... centralized all the best hacks.

Re:

[CastrTroy]

I guess that is one advantage of having a single registry for all system settings. You can easily change tons of settings easily with just a single script file. Changing a bunch of settings in Linux would required a much more complicated script, or a lot more file editing. Still I think that having all the settings in a single file is not a great idea, but it has it's advantages.

Registries and stupid ideas

[tjwhaynes]

I guess that is one advantage of having a single registry for all system settings. You can easily change tons of settings easily with just a single script file.

Erm - a single script file can easily update thousands of different configuration files on any platform. And for all the world-famous Windows user-friendlyness, I'll take editing some bizarre Linux scripts where key=value over trying to remember hexadecimal codes for Internet Explorer registry entries :-)

Lets not overlook the dangers of having a single, unrebuildable registry for all the system settings... What happens when it gets hosed? I seem to remember that Windows 95 used to keep two copies of the registry around and could rebuild it if you deleted it. Windows XP seems to have lost that ability - I have no idea if Vista has recovered it.

Cheers,
Toby Haynes

Re:

[CastrTroy]

Like I said, I prefer the Linux way of doing things, most specifically for the reasons you mentioned. However, there are some advantages to have all the settings in your system in the exact same format, and all able to be edited by the same API, or with a small set of commands.

Re:

[fluffy99]

IF you have thousands of machines, it's likely you have Active Directory by now. Simply set the autorun, as well as the tons of other security settings, in a group policy and be done with it.

Re:Stupid idea

[mstahl]

This is just what I've always been talking about with Windows. Why does it take this level of deep knowledge of the operating system to secure against the most idiotic of exploits? Ask an engineer of any other operating system about autorunning executable code from just any media that's inserted and they'll look at you like you've been taking crazy pills.

This is along the same lines as many other questions I have about Windows, like why can image files execute code? Why is it possible for ActiveX scripts to change system registry values and download software to your hard drive? Why is everything not named the same between versions? Why does everyone still use it?

Le sigh....

Re:Stupid idea

[TheRaven64]

Ask an engineer of any other operating system about autorunning executable code from just any media that's inserted and they'll look at you like you've been taking crazy pills.

The feature was introduced back in 1995. At this time, there were two kinds of removable drives in the average computer; floppy drives and CD-ROM drives. CDs could only be commercially pressed cheaply in large batches and so could be considered trusted. Floppy disks could be written by anyone, and so were not. This made sense until CD writers became cheap, at which point it became an easy virus transmission vector. Enabling it for read-write media was just brain-dead.

By the way, like so many other Windows features, this one was copied from Apple. HFS CDs could have some flags set designating them as autostart CDs and a named file would be run when they were inserted. This 'feature' was used to spread a few Mac viruses in the '90s and was never added to OS X.

Re:

[mstahl]

...was never added to OS X

There you have it.

Re:Stupid idea

[garett_spencley]

While I agree that auto-executing anything is very bad practice, most average users would go ahead and run the program anyway without giving any consideration to it's safety (or just assuming that it's safe because it wouldn't make sense for the manufacturer to harm their costumer's computers ... never thinking about a man-in-the-middle type of scenario).

Re:

[cheater512]

Of course but at least then it would be the dumbass's fault instead of the anonymous dumbass at Microsoft.

Re:

[davester666]

But this is for stuff you wouldn't normally get software to install from, such as a picture frame or an iPod. People would have to go out of their way to find and execute the executable, instead of it just running automatically.

Of course, more and more of these devices [such as CD-R's per earlier slashdot story], Flash USB drives, etc. are coming with bits of software as a "value-add" thing...

Re:

[Peaceful_Patriot]

The stupidest thing is Windows being configured by default to restart for updates after the user doesn't respond for some very short amount of time...

grrrr...this one bit me at work again last week. I was in the middle of a big project and had probably half a dozen windows open. I cannot imagine why MS thought this was a good idea. Can I turn it off?

Re:

[bhtooefr]

I simply tell it to download updates, but not install them. It creates a yellow alert in Windows Security Center, IIRC, but not one that brings up anything in the taskbar. And, it won't automatically reboot unless you install the updates - which you can tell it to do when shutting down, or do before you were going to restart anyway.

Re:

[dotancohen]

This happened to me last year in the middle of a lecture. The professor's computer reset itself. Worse part is, that nobody in the room though it was abnormal. I made a comment about it being absurd, and the response was "what, you don't keep your system updated". I mentioned something about Fedora not automatically reseting itself in the middle of _my_ work, but all I got back were grunts.

Re:

[Blkdeath]

Yep. If you're using XP Professional, run the Group Policy Editor (gpedit.msc).
Once in, use the left-hand pane to navigate to Local Computer Policy -> Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update.

Something hit me today whilst looking up things involving WiFi networking under Windows and learning that under Vista to disable automatic connection to AdHoc networks you have to open a command prompt and type;

netsh wlan add filter permission=denyall networktype=adhoc

I thought Linux was the OS that had complex commands and Windows was all GUI point and shoot style? So now under Windows XP to change basic, every day functionality you have to find and utilize some obscure policy editing applet? How doe

Malware Economics 101: It's a quantity game

[G4from128k]

I'd seriously doubt that malware distributors would focus on returned products as a vector for infection. The value of a pwned PC is simply too low to justify the labor of buying a product, infecting it, and returning it in hopes that it will infect another machine.

Rather, I suspect infection at or near the source -- slipping malware into the firmware or shipped software that goes with the device. At that point in the software delivery chain, a single act of infection can be distributed to tens or hundreds of thousands of machines. I could also imagine targeting highly promiscuous machines (e.g. WiFi routers) that have a high chance of being in contact with other promiscuous machines (i.e. other routers or laptops).

Although I'm sure some people get their grins by infecting one machine at time, the malware industry is more about collecting the largest quantity of machines at the lowest possible cost.

Re:Malware Economics 101: It's a quantity game

[garett_spencley]

I agree with you, but never think that there aren't assholes out there who get kicks off of sticking it to random strangers. Money can greatly escalate a problem and it's scope, but sometimes people are just jerks and gladly act as such for free.

If the world was asshole-free then people would never get their cars keyed, tires slashed or houses egged unprovoked.

Re:

[smurgy]

If the world was asshole-free then people would never get their cars keyed, tires slashed or houses egged unprovoked.

No, we'd just go back to the Victorian times and define such crimes as not standing up when a lady enters a room as being an asshole.

Thank goodness for the freedoms of a permissive society! Now people really have to be vicious to deliver social harm to each other.

Returned media?

[ccguy]

It's really amazing that people can get infected by a returned item... do they still ship drivers in floppy disks? Everything is in read-only media these days, except for media itself (i.e. a "new" hard disk). So people buy a drive, it has a file and run it?

As usual, it's a matter of user education.

Re:

[nurb432]

And you cant fake a CDROM driver disk, right?

Re:

[ScrewMaster]

They buy a USB-enabled device of some kind (flash drive, electronic picture frame, MP3 player, cell phone, you name it) and plug it in. If their Windows box has auto-run enabled (and all do by default) then any malware on the device just got executed. Remember, many such products simply map in as a disk drive: any malware on the computer can recognize that and infect it, so the next time it gets plugged in it can infect another computer. Typical viral spread, the only difference being that now it's high-tec

Re:

[Technician]

Typical viral spread, the only difference being that now it's high-tech electronics being used as the vector, not simple media.

What is missing from most flash based devices is what floppies had.. A write protect.

Re:

[ScrewMaster]

A few do (I had a thumbdrive once that did) but yeah, it'd be a good idea.

Re:

[Damocles the Elder]

Not quite. I'll admit I got burned through this, through turning off auto-run-on-plugin but not turning off auto-run-on-double-click. The culprit was a Sansa e200 mp3 player [sandisk.com].

I'm pretty paranoid about viruses and malware, and I've never so much as had an infection until this drive. And my computer was moderately more secure than most-- it didn't run the autorun feature the instant I plugged it in. Unless you consider trying to convince all Windows users to modify their registry keys to disable autorun on a

Sony? Sears?

[dotancohen]

The cases mentioned were just the accidents. What about deliberate malware installations, such as those done by Sony and Sears?

Learned About this a Long Time Ago

[NeverVotedBush]

I bought a new 80386 (maybe a 486 - I forget) motherboard a long time ago and it had a 5 1/4 floppy disk included with the board drivers software. It was also infected with the Michaelangelo virus. I never knew it until I saw a message on the FIDOnet BBS from some idiot in Bulgaria talking about how his virus was coming and it was going to kill everyone's computers.

I downloaded a free copy of McAffee and it found the virus on my computer as well as every floppy that I had inserted since then that wasn't write protected. McAfee's software offered to clean it but all it did was wipe out the MBR making it where I had to reformat and reinstall everything.

I told a friend at school who had just bought a similar motherboard. He broke the seal on his driver disk, scanned it, and found the virus there too. It was coming from the factory infected.

That was a lesson I will never forget and it happened almost 20 years ago.

Re:

[ScrewMaster]

I'll give you a similar example. A big computer store not too far from where I live (I don't know if they're still in business, like you this happened about twenty years ago) sold hundreds of thousands of blank diskettes that came pre-infected from the factory with a boot-sector virus. Apparently, a lot of these were bulk corporate sales, so it hit a lot of machines. This was brilliant if it was deliberate: I mean, who would think to virus-scan a blank disk?

Re:

[spikedvodka]

I always knew there was a good reason I bought my blank floppies unformatted. I mean it was at least a dollar or so cheaper for the dozen disks... I mean really, how long does it take to `format a:`?

Re:

[DavidTC]

Boot sector viruses did not spread because people attempted to boot from floppies.

Boot sector viruses spread for a single reason: Computers by default tried to boot from the floppy first. People would leave floppies in the drive, and get infected.

Re:

[NeverVotedBush]

That is just the thing - most people wouldn't think to boot from a blank disk.

However, a whole lot of people would reset their computers and forget there was a floppy in the drive. In the time it took them to realize what they had done, the boot sector virus would load and then infect the hard drive boot sector.

It was extremely common.

Re:

[maxwell demon]

Quite some time ago I heard about a virus which came with an AV program. I don't remember the details, though.

Re:

[jmauro]

I've always taken that more as a joke since most AV programs make the computer act as if they had a virus, so really what's the difference.

Re:

[spikedvodka]

not so long ago.

Symantec Corperate edition version 10.1 had a hole in it... that allowed a virus to spread, using SAV as it's vector

Called symantec, the fix: Update to 10.1.5, and scan. We took the switches down while we fixed it

Re:

[sjames]

It's amazing what went out on floppies back then. Out of curiosity, I would scan through "free" sectors on floppies and often I would find internal documents, source code, QA results, unrelated software, etc.

That "idiot" in Bulgaria was probably no idiot...

[i)ave]

Sophia, Bulgaria was the home of the Dark Avenger one of the most notorious virus authors in history. He was quite active during the 80386/80486 time period. Some interesting reading about what is known of him can be found in these links: http://en.wikipedia.org/wiki/Dark_Avenger [wikipedia.org] http://www.research.ibm.com/antivirus/SciPapers/Gordon/Avenger.html [ibm.com] http://www.wired.com/wired/archive/5.11/heartof.html [wired.com] http://findarticles.com/p/articles/mi_m1511/is_n2_v14/ai_13381563/pg_9 [findarticles.com]

Back in the, good ol' days...

[MrKaos]

this'd happen on floppy drives, 'fore any new fangled web browser or memory stick, when a real virus fit in a boot sector. Why we din'ner 'ave no serial bus unless it had a bored rate and even then it had'der have 25 pin's 'fore it were useful...

Special software included. Yay.

[cliffiecee]

"Trying to (infect a product) all the way back at the factory - getting it through all the checks and balances -- would be pretty hard to do"

No, it isn't anymore. Somebody in marketing had the bright (read: revenue-producing) idea of loading up a new storage device (which should be blank, damnit) with a bunch of advertising crap. Combine this with Windows' oh-so-helpful autolaunch features. Frankly I'm surprised it took this long to become a problem.

I long for the days when you could buy an UNFORMATTED device. The OS would tell you it's unformatted, so you formatted it. Done.

Re:

[Lumpy]

It shouldn't be blank. it should be unformatted.

the only SAFE way is to force the user to format the disk on the first use.

Re:

[lucas teh geek]

I long for the days when you could buy an UNFORMATTED device. The OS would tell you it's unformatted, so you formatted it. Done.

wtf? where on earth are you buying your drives? I've bought 3 hard disks in the past 12 months and they were all either unformatted, or NTFS formatted but blank.

Re:

[sgtrock]

Bought a USB key lately? It's getting tough to find one without that marketing crap on it.

Re:

[lucas teh geek]

I cant say I have, but you've cleared things up a bit for me.

the pervasiveness of malware contributes

[Grampaw Willie]

The pervasiveness of the malware problem contributes to this

Our shop had one shrink wrapped package that had malware included and when this was tracked down the vendor didn't know they had become infected and were distributing shrink-wrapped malware

this underscores the importance of putting a stop to malware

the fundamental error is at the concept level: it is wrong to think it is OK to run your programs on someone else' computer without their knowledge or permission

to invert this properly back to the

Re:

[cheater512]

Your logic fits well with the bozos at Microsoft as well.
Remember that its their 'feature' which is causing this problem, not the user and the malware authors are only taking advantage of it.

Re:

[Grampaw Willie]

what you say is exactly correct

thanks to services like /. hopefully we will be able to bring this into plain view

once the problem is in plain view corrective action will be forthcoming and I don't think it will take long at all

how about IBM provide us with a RACF version for the promiscuous Ms. Windows?

Re:

[mstahl]

Do you want the job of authenticating and signing all "safe" apps? No? Well neither does anyone else. Look at what's happened with driver software for Windows. There's just too much of it for all of it to be approved by any central authority.

Re:

[ajs318]

I call bullshit.

Driver software for Linux is approved by one central authority, and Linux actually supports more devices Out Of The Box than Windows. Reason being, there were many older devices for which new Windows drivers were never written; so they won't work with fully-patched-up Windows 2000, Windows XP or Vista.

AOL

[TrdrJoe]

has been distributing malware over physical media for years, in the form of floppy disks and CDs that install the AOL "service" on your computer... and through our own postal service, no less!

I got one of these!

[NitroWolf]

I bought a digital photo frame from Microcenter that was infected. I can't recall what the specific trojan was, but it was fairly benign in so far as it just replicated itself. As I recall it was a fairly old trojan and not very sophisticated... but none the less, it was on the brand new frame that was still sealed in the original factory stuff.

I told Microcenter about it and they were like "Huh." Didn't ask anything more, nor did they remove the frames or check them. I was somewhat pressed for time, so I didn't try going up the chain of management to get someone to acknowledge that there was a problem.

It's a good thing I found it though, since it was a gift for my technologicallly illiterate parents. I had taken it out of the package to load pictures up on it. If I had just given it to them directly, I'm not sure what would have happened. AVG caught it when it was plugged in via USB, so probably nothing drastic, except a phone call from my Dad asking me what the pop-up box meant.

Old news...

[Bob Hearn]

Digital devices reaching consumers with malware already installed?

Computers have been shipping with Microsoft products preinstalled for some time, I believe.

Re:

[Soft Cosmic Rusk]

Old, but still kinda funny:

Is windows a virus?

No, Windows is not a virus. Here's what viruses do:

* They replicate quickly - okay, Windows does that.

* Viruses use up valuable system resources, slowing down the system as they do so - okay, Windows does that.

* Viruses will, from time to time, trash your hard disk - okay, Windows does that too.

* Viruses are usually carried, unknown to the user, al

I, for one

[DNS-and-BIND]

I work in manufacturing in China, and I would not be surprised in the least to find a worker who accepted a shockingly small bribe to place malware directly into factory produced firmware. Not saying that's what happened, but I sure wouldn't be surprised if it did. I also would not be surprised to discover that a worker's Windows PC transferred its infection to the master used for production.

21st Century CyberColdWar, who supplies the MBs?

[shoor]

Something like this came up before: http://hardware.slashdot.org/article.pl?sid=07/11/11/2246246 [slashdot.org]

Motherboards are mostly made in various Asian countries now, aren't they? How paranoid is it to imagine the Chinese deciding to infect motherboards with spyware?

Lest you think I've got my tinfoil hat on, check out some thoughts of Ken Thompson (which I found in the discussion from the "Trojan Found In New HDs" link I provided, at least I think that's where I got it from.) http://cm.bell-labs.com/who/ken/trust.h [bell-labs.com]

Re:

[fluffy99]

Given how aggressively the Chinese are spying on the US govt and commercial industry, it wouldn't surprise me to see malicious code on computers and devices shipping from China. It wouldn't be common stuff that the a/v vendors have signatures for either. I'd guess this was suspected by the govt at some point because there was a brief ban on buying systems from Lenovo. First think I do with any new computer is to nuke and reinstall from a known good source. At the very least this dumps all the adware/spyw

I have one

[Webs 101]

It's branded as an eMotion device (model DF-EM7), but it looks identical to the ADS product.

My question - because here at /., I'm not all that relatively geeky - is how would this spread? It accepts photos direct from the computer via a USB 2.0 cable or via memory card. Assuming I'm not stupid enough to plug the thing directly into my computer, am I safe? Will the trojan infect the memory card for subsequent infection of my hard drive (of my Windows machines, not my Mac, right?)?

Also, is there a way f

Re:

[LWATCDR]

That will not help if it is in the BIOS. If I was a government and was set to plant spyware on a system I would do it in the BIOS and not on anything that the user could scan or format.
Let's face it. The VAST majority of FOSS system have a lot of closed source firmware on them.

iPods?

[tristian_was_here]

We discussed a similar problem with iPods a while back

It seems like iPods must come with iTunes

2 solutions and a boot counter

[davidwr]

1) Right before the equipment is put in the box it should have its memory reset to factory condition AND have the firmware compared to what it should be.

This will offer some protection against factory sabatoge.

2) Any time a unit is returned it should be reset to factory condition.

This will take care of shoppers who buy, infect, and return merchandise.

The device should have a "firmware freshness" indicator that says this is the 1st, 2nd, or 3rd or more boot since a factory reset. When you buy the product it

Neither solution works.

[Ungrounded Lightning]

1) Right before the equipment is put in the box it should have its memory reset to factory condition AND have the firmware compared to what it should be.

This will offer some protection against factory sabatoge.

No it won't - if the "factory sabotage" consisted of (deliberately or accidentally) having malware as part of "what [the firmware] should be".

2) Any time a unit is returned it should be reset to factory condition.

This will take care of shoppers who buy, infect, and return merchandise.

And how is a reai

Re:

[davidwr]

No it won't - if

I said it would offer some protection, not complete protection. This will close off some but not all opportunities for in-house sabotage.

And how is a reailer supposed to do this? Do you know of ANY product that comes with a (true) "reflash to factory status" utility that doesn't depend on what's in the device itself - let alone a cross-industry standard for this? (And you can't trust the media returned with the device, either. If it's writable it also needs "resetting" - and if it's read-only it needs replacing with a fresh copy.)

It may not exist but this is easy enough to implement in hardware:
Divide the boot sequence into 3 steps:
Step 1, from ROM: Check to see if reset pin is pressed.
Step 2a, if reset pin is pressed: Erase volatile firmware and copy contents of read-only firmware backup to run-time firmware. Blink status lights to indicate reset-in-progress/reset-complete/reset-failed codes

Windows ME

[Ngarrang]

And if we needed evidence of early forms of physical media malware spread, we need not look any further than Windows ME. Surely it qualifies as malware!

Feh

[eno2001]

If you use Linux, it means nothing to you (unless you run WINE or a Windows virtual machine). I always wipe the HDs I use. And I only buy media devices that I know will work with Linux.

--
Linux on the desktop has been a reality for me since 1997

one of the big four did it to us...

[pointbeing]

It was about four years ago but we received an infected build from a major hardware manufacturer.

We bought several hundred computers and provided the laptop image to the manufacturer after we'd installed our standard suite of applications. The major hardware manufacturer certified the build and started imaging machines - we had about a hundred of them in house before the first ones got stood up and tripped virus scanners as soon as they were powered up.

The image we sent the manufacturer was virus-free but

Re:

[Technician]

All ipods install Quicktime on your computer, and quicktime is DEFINITELY malware. Apple should be ashamed.

I haven't had that problem lately. I noticed that iTunes seems to try to install Quicktime, but since I've moved to Ubuntu, that problem has gone away. GTKPod
  with the proper lib works wonders on an iPod in place of iTunes/Quicktime on Windows.