Walmart Photo Keychain Comes Preloaded With Malware 224
Blowit writes "With the Christmas holidays just past and opening up your electronic presents may get you all excited, but not for a selected lot of people who got the Mercury 1.5" Digital Photo Frame from Walmart (or other stores). My father-in-law attached the device to his computer and his Trend Micro Anti-virus screamed that a virus is on the device. I scanned the one I have and AVAST did not find any virus ... So I went to Virscan.org to see which vendors found what, and the results are here and here." Update: 12/29 05:44 GMT by T : The joy is even more widespread; MojoKid points out that some larger digital photo frames have been delivered similarly infected this year, specifically Samsung's SPF-85H 8-inch digital photo frame, sold through Amazon among other vendors, which arrived with "W32.Sality.AE worm on the installation disc for
Samsung Frame Manager XP Version 1.08, which is needed for using the SPF-85H as a USB monitor." Though Amazon was honest enough to issue an alert, that alert offers no reason to think that only Amazon's stock was affected.
Old news (Score:4, Informative)
Did you tell Walm*rt? (Score:5, Informative)
Write them a letter telling them what you found. Try this link http://walmartstores.com/contactus/feedback.aspx [walmartstores.com] to get to their headquarters, where something might get done about it. Include enough technical detail for them to replicate the problem, especially the model number or any other identifying information from the package.
If you want someone to care enough to write back, try to not sound accusatory or threaten to sue them. I'm sure they get enough of that on a daily basis.
false positives? (Score:5, Informative)
Looks to me like they used some kind of packer to make the exe's small to not take up a lot of space on the device (understandably). A lot of scanners will automatically detect packing as malware and, due to the nature of how a packer works, trojan is the logical choice. I have a similar problem with anything I compile with delphi since a lot of malware is developed in delphi.
My 2 cents worth...
Packer (Score:5, Informative)
It's not a virus, it's just a exe packer they used.
Virus scanners have been labeling PE Packers as viruses for ages now, simply because a virus could be packed with them, and it's easier to pick out a packer header than a virus contained in it.
A lot of false positives are caused by this, and this looks like one of those cases based on what you linked. "Generic" "NSPack" "PossibleThreat" in the VirSCAN links give that away.
EXE/PE Packers simply compress a binary and decompress it on the fly, simply to save space or "load faster". Likely Walmart's programmers used one to keep the app's size small on a small device like that.
I've dealt with this situation in size-coding competitions before, and it's not fun. A lot of false positives are caused simply because a packer was used.
Fortunately, some of the better virus scaners actually unpack the software before checking it, or look for valid virus signatures instead of a simple Packer.
This basically is just a case of virus scan companies being lazy.
Re:Packer (Score:3, Informative)
those cases based on what you linked
-> those cases based on what the summary linked.
Slight target issue, appologies.
Re:have I missed something? (Score:3, Informative)
Christmas is a twelve day feast that starts on Dec 25, and doesn't let up until Epiphany.
Re:Old news (Score:4, Informative)
USB storage devices aren't actually eligible for AutoPlay. However, if the device presents itself as if it were, say, a CD-ROM, it is. This is how the U3 devices work, which present both a "CD" and a USB disk. The operating system can't really enforce policies on how USB devices present themselves to the system.
Also, my Vista machine, by default, does not actually run the AutoPlay executable without user confirmation.
Re:Packer (Score:2, Informative)
Fortunately, some of the better virus scaners actually unpack the software before checking it, or look for valid virus signatures instead of a simple Packer.
Unfortunately, advanced packers can detect this and can unpack differently if they are being unpacked by a virus scanner. Part of the point of using a packer for a virus is its ability to disguise the signature, so looking for a signature without unpacking is pointless.
Re:Old news (Score:1, Informative)
Re:have I missed something? (Score:1, Informative)
Perhaps where you live, but for others Christmas starts on Dec 24.
Re:Old news (Score:5, Informative)
USB devices certainly are eligible for autoplay, they just prompt the user when the device is first connected by default. however, an autorun.inf file can still change the default action for that drive, so that when the user double clicks on the volume in My Computer, it will run the autplay program rather than open up the drive for browsing. and in that situation the user gets no warning.
and i'm not sure what U3 is, but i know that if a removable drive has a partition formated with CDFS, Windows will assume that it's a copy-protected CD and will allow autoplay without the user's consent regardless of your autoplay settings. i think this can be done with any USB drive, which in a way makes disabling autoplay or prompting the user useless. just one more way consumers get screwed by DRM i guess.
Re:that's why USB autoplay is a bad idea (Score:3, Informative)
Viruses exploiting the AutoPlay is nothing new and going wild. The other day I went to a printing shop with stuff I was going to print stored on a USB stick. I plugged it in the Windows box at the shop and it got infected. Three "folder" icons appeared in the Windows file manager but they were not directories -- they were trojan executables with the icons identical to the default one for directories. They all ended in .exe but the Windows file manager hid the extension part of filename by default so a careless use couldn't tell that from a directory. Also the "autorun.inf" was clearly modified to point to the malware (written in plain text).
I was not infected because my machine is a Linux one and I know these malware tricks well, but I can imagine how many customers of that shop are tricked to click on the trojan program.
Autorun is evil. It is so vulnerable to exploitation and of little use and it's enabled by default on Windows. Sadly, the GNOME team, who's goal is to copy every mistake done by Microsoft, choose to mount removable media automatically by default. What's their next quest? Certified malware-to-malware compatibility?
Luckily I ditched GNOME long ago.
Re:Old news (Score:3, Informative)
That is indeed one of the stupidest features ever put in Windows, and there is no reliable way to disable it.
There's a registry hack on google.
Turning off AutoRun in Windows XP (Score:5, Informative)
Re:Old news (Score:3, Informative)
Disable service called Shell Detection something. That will switch off Autoplay for everything globally. Easiest solution and saves you memory and load time.
Re:Old news (Score:3, Informative)
USB storage devices aren't actually eligible for AutoPlay. However, if the device presents itself as if it were, say, a CD-ROM, it is.
If the autorun.inf file is like this:
[autorun]
open=autorun.exe
shell=explore
Shell\open=&Open
Shell\open\Command=autorun.exe
Shell\explore=&Explore
Shell\explore\Command=autorun.exe
then autorun.exe will be executed when user doubleclicks on their USB device in "My Computer". If you don't believe me - try it out...
I think this will not work on Vista or if autorun.inf reading is disabled, but it will work on XP even if AutoPlay is disabled using group policy editor.
Re:Old news (Score:3, Informative)
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\autorun.inf]
@="@SYS:Does_Not_Exist"
This takes care of autorun.inf once and for all, you can even keep AutoPlay if you want it.
Re:Turning off AutoRun in Windows XP (Score:5, Informative)
If you're really worried, you should disable it at the driver level rather than the explorer policy level.
For Win2k/XP (maybe Vista), open up regedit and find this key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
REG_DWORD "Autorun" - set it to 0
Note: Must be logged on as an admin.
This disables autorun at the driver level, rather than explorer policy level. It may take a reboot to take effect. It should disable all autorun handlers/hooks, effectively turning drives into regular folders. (they just "open")
Autorun.inf files will not automatically run or prompt you to run - actually, on my Win2k box, the right-click autorun option completely vanished!
Note: It doesn't seem to "spin-up" CDs anymore on my computer, until I go into My Computer. It gives it a nasty delay loading that folder, but I figure this is a good thing. It means it isn't accessing the CD or device at all until I tell it to.
Such is the price of security, I suppose!
Re:Old news (Score:2, Informative)
Ahh, a fellow autoplay hater!
http://it.slashdot.org/comments.pl?sid=1074953&cid=26256453 [slashdot.org]
^
My post on how to disable it in the driver. Haven't tested it on Vista, since I don't have Vista.
It's pretty reliably disabled on Win2k/XP, though. ;)
Re:Packer (Score:2, Informative)
Re:Packer (Score:3, Informative)
Well, of course. If they didn't occasionally remind you of their existence, you might start to think you don't need them.
I haven't used a TSR virus scanner for years.
Through adequate user precautions, they're completely unnecessary.
With just a few simple precautions, even in Windows, you shouldn't need one either:
The only threats likely to get past these types of precautions - such as new malware only hours or days old - are unlikely to be stopped by a virus scanner that doesn't know what to look for either. So what have you got to gain by ditching TSR scanners? More system resources, possibly more money.
Re:Packer (Score:3, Informative)
I bought my wife a digital photo frame with no flash memory because it was cheaper.
It did have an SD slot, though, and I had to buy the card, but that still ended up cheaper, and that way it can display as many pictures as she wants...it's just limited to 2GB at a time (no SDHC).
It's also a whole lot easier, as she keeps the frame at work, and every so often swaps SD cards when she wants new (or different) pictures.
Second opinion - scanning another 1.5" photo frame (Score:3, Informative)
All sounds to me that the Walmart photo frame may be truly infected. Interesting to see if a re-scan gives the same results, after AV signature updates.
To identify my photo frame, it has USB vendor code 1908:1320, and gives dmesg output as
and has files on it
Hey, I always stick odd USB devices into Linux first to check them out.
For background info, this photo frame does nothing when first connected. You can set it to "transfer" mode, at which point it emulates a USB CD-ROM of 304 Kbyte size. That CD image tries to autorun the DPFmate software to compress and transfer images to the device. The photos are *not* visible on the device through normal access, must have transferred them to a hidden area. I'd be interested if anyone has more info on the USB protocols used.