HP Admits Selling Infected Flash-Floppy Drives 110
bergkamp writes "Hewlett-Packard has been selling USB-based hybrid flash-floppy drives that were pre-infected with malware, the company said last week in a security bulletin.
Dubbed "HP USB Floppy Drive Key," the device is a combination flash drive and compact floppy drive, and is designed to work with various models of HP's ProLiant Server line. HP sells two versions of the drive, one with 256MB of flash capacity, the other with 1GB of storage space.
A security analyst with the SANS Institute's Internet Storm Center (ISC) suspects that the infection originated at the factory, and was meant to target ProLiant servers. "I think it's naive to assume that these are not targeted attacks," said John Bambenek, who is also a researcher at the University of Illinois.
Both versions of the flash-floppy drive, confirmed HP in an April 3 advisory, may come with a pair of worms, although the company offered few details. It did not, for instance, say how many of the drives were infected, where in the supply chain the infections occurred or even when they were discovered."
In case anyone wonders (Score:5, Informative)
Re: (Score:2)
That makes sense. But why would I want a flash drive built into it also?
If I want a flash drive, I want it to be smaller than a floppy drive.
If I want a floppy drive, then I'm using floppies and don't need the flash storage.
Re:In case anyone wonders (Score:4, Interesting)
Because it makes the thing useful when you're not installing windows.
Re: (Score:2)
One less thing to lose. Twice the utility. Half as many things to plug in. I don't think you care too much that a flash drive designed for servers is too large to easily stuff in a pocket, it's just gonna be sitting in a drawer in the server room, right? Besides, I've got a toaster/oven. HP sells scanner/fax/printer/copiers, why not a floppy/flash? Nash Amphicar?
Re: (Score:1)
I hope you just need to reformat these things because I've been looking for exactly this type of device for a long time (and haven't found any).
Re: (Score:3, Informative)
You can do it without the HP keys, just use their software to prep the stick.
Re: (Score:2)
Re:In case anyone wonders (Score:5, Informative)
OK, I missed something. I don't know if anyone else did because it the summary wasn't clear to me.
This thing is not an actual floppy drive with some flash storage built in, which is what I thought (and a somewhat stupid idea). It's a standard flash drive that is capable of identifying it's self like a floppy drive so that Windows will find it when looking for a floppy drive.
That's actually a very smart idea.
With that detail this this is not a real floppy drive of any kind, this all makes more sense. Question withdrawn.
Re:In case anyone wonders (Score:5, Insightful)
Someone's going to reply "blah blah chain of supply blah blah limited liability" but (back in my day) a manufacturer was liable for tainted/poisoned product that originated at the manufacturer. Everyone should be able to demonstrate that a product works before selling it.
Re:In case anyone wonders (OT II) (Score:1, Funny)
Re: (Score:2)
Re: (Score:1)
Turn in your Slashdot user id and get out now.
Re: (Score:1)
This thing is not an actual floppy drive with some flash storage built in, which is what I thought (and a somewhat stupid idea). It's a standard flash drive that is capable of identifying it's self like a floppy drive so that Windows will find it when looking for a floppy drive.
This past weekend I had to flash the BIOS on a Tyan server mobo (K8SRE). I have no floppy and the current (and new, as well) BIOS won't boot off USB. What to do? Ensure grub and syslinux are installed. Have a floppy image ready (http://bootdisk.com/bootdisk.htm, or Ubuntu CD)
Now, when the floppy image loads, I will only have access
Re: (Score:2)
I thought you could use any USB drive to install mass storage drivers. It's been a while since I installed XP, but I remember that the installer saw my USB key.
Re:In case anyone wonders (Score:4, Interesting)
Re:In case anyone wonders (Score:5, Funny)
Reminded me of Slackware back in the mid 90s. It's just as well most Windows users get the OS preloaded by the PC manufacturer. If they all had to install it themselves, surely most would give up and install Linux instead. The installer boots from the CD and includes all the drivers? What crazy person thought of that insane idea.
Re:In case anyone wonders (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
if it is 1 machine to install then sure put a floppy in
You should use the Driver Packs on your XP Disk (Score:2)
http://driverpacks.net/DriverPacks/ [driverpacks.net]
Re: (Score:2)
Why is this not rated +5 Funny?
Re: (Score:1)
In fact mass storage drivers is a bit of mismomer. I think most of the time theproblem is that the Bios on a new machine puts the SATA controller in AHCI mode instead of of legacy compatible mode. XP doesn't include AHCI drivers.
So it's sort of handy to put the Intel MaAHCI drivers on your slipstreamed XP+SP2 CD. I know it works on boards with an Intel SATA countroller in AHCI mo
Only on WinPE 1.x (Score:3, Informative)
The main purpose for having floppies in servers is because Windows requires them to install mass storage drivers during installation on hardware such as RAID arrays and SATA drives
IIRC, Only on Windows installers that use WinPE 1.x. That includes 2003 Server, but not 2008 Server (which uses WinPE 2.1). So hopefully now floppies should actually become a thing of the past.
Not, of course, that that in any way absolves MS -- it's still shocking that floppies were sometimes needed for a server OS released a mere half decade ago! Although at least you could always install remotely over a network using RIS [wikipedia.org] or WDS and avoid the issue entirely, which is I suppose what most enterprises
Re: (Score:2)
Re: (Score:1)
Also iun the news (Score:1)
I've never seen a "welcome to such and such" screen in over a year
Security improvements (Score:5, Informative)
Re: (Score:3, Interesting)
Where's the factory? (Score:4, Interesting)
Perhaps it's a test run.
Re: (Score:3, Informative)
Re: (Score:1)
Re:Security improvements (Score:5, Informative)
Start --> Run --> gpedit.msc
Computer Configuration --> System --> Turn of Autoplay
Enable on all drives
You're right, this should be default, but at least there's a fix.
Re: (Score:3)
Re: (Score:3, Informative)
In addition, it's nice to have the autorun. Having a dialog asking permission is a nice balance I find.
Re:Security improvements (Score:5, Funny)
Re: (Score:3, Informative)
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"
We're deploying that here to stop Autorun viruses that can start via just opening the drive (or right-clicking on Explore, etc.). Nasty things enabled by a Windows design flaw reminiscent of Outlook Express 4 opening attachments automatically.
Re:Security improvements (Score:4, Informative)
Re: (Score:2)
Or you could just hold down Shift...
Oops, Switchfoot nearly got sued by Sony for mentioning that...
Re: (Score:2)
I agree it should come disabled! but then, bill was trying to play catchup with the mac. remember, the mac had been polling floppies so that the user could just insert the floppy and not have to click an 'open' box (oh, so much work for poor mac users!).
that must be the reason why MS thought 'auto media detect' was a good idea.
but its the dumbest idea from a security POV. just another illustrati
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Right, I use Win98. The occassionally having to reboot (every 28 days or so) is made up for by the fact that I know I won't every get bothered with 'updates' again.
Re: (Score:1)
Supposed to turn off autorun for all possible drive types, an
Re: (Score:1)
Re: (Score:2)
Maybe that's true if you have the User Account Control incessant popups enabled. If you turn that off, then it will autorun USB storage devices just like XP, which is stupid. There is no good reason to autorun R/W media. I would argue there's no good reason to autorun read-only media either, but it's definitely true for R/W.
I accidentally infected my PC with what appeared to be a factory-installed worm
Strange (as insider activity?) (Score:4, Insightful)
If you are going to get your malcode onto this, why do something old and crufty when you could do something new.
IIRC, this is used for BIOS updating as well as windows driver schlepping. So why use old-n-crufty known malcode when you could get a clean rootkit (no existing signature) and install it that way.
Re: (Score:2)
Re: (Score:2)
More than likely, it was some low-payed worked who was given a few weeks wages by someone looking for a quick buck, not some super-skilled haxor out for world domination.
Re: (Score:1)
Re: (Score:2)
Most likely it's a crime of opportunity. Like stealing a car that had the keys left in it.
Software on these drives? Use Linux to format. (Score:4, Insightful)
Re: (Score:2)
Could also have been a disgruntled worker.
Re:Software on these drives? RANT!! (Score:1)
Re: (Score:2, Interesting)
All you have to do is throw in the human element. The first factory worker that plugs his ipod or flash drive full of music into the computer he is using to test/verify/format these devices you are finished.
I've worked as a technician in an electronics manufacturer, the human element is a huge one to contend with.
Re: (Score:2)
So where's the recall? (Score:5, Informative)
Here's the HP HP security notice. [hp.com] This was discovered in January/February, according to HP, but not announced by them until April.
Where's the recall notice? HP should be recalling these items. Failure to do so immediately is willful negligence.
Here are the part numbers:
They're still for sale on Amazon [amazon.com], for example.
In a situation like this, HP should recall the product and reissue a replacement product with a new part number to distinguish old product from new product.
Because... (Score:5, Interesting)
(Where do you think recalled Dell batteries went?)
Anonymous for a reason.
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Here's the HP
HP security notice. [hp.com] This was discovered in January/February, according to HP, but not announced by them until April.
Where's the recall notice? HP should be recalling these items. Failure to do so immediately is willful negligence.
Here are the part numbers:
They're still for sale on Amazon [amazon.com], for example.
In a situation like this, HP should recall the product and reissue a replacement product with a new part number to distinguish old product from new product.
Is it a 100% Infection Rate? Is it a specific site that's infecting them? A specific QA tester's machine? Is it Possible for them to just replace the ones that are out but unsold, reformat the returned ones, and reship them?
These are important questions that I would be willing to wager HP's asking themselves in private.
What about BIOSes? (Score:1, Informative)
Dear Smart People, (Score:2, Funny)
Re: (Score:2, Funny)
Re:Dear Smart People, (Score:5, Informative)
Corporate Response Missing (Score:4, Insightful)
Let me guess (Score:3)
Re: (Score:1)
Your hybrid flash drive is protected from high energy EM radiation by a healthy and brightly coloured coating of heavy lead paint!
Flash/BluetoothThumbdrive? (Score:1, Offtopic)
Proliant diag. CDs don't recognize other drives... (Score:2, Informative)
Fortunately, we
Advisory's recommendion is braindead (Score:5, Interesting)
From the advisory:
Does HP actually think that a potentially worm-infected server should be a/v scanned and (possibly) cleaned, and that's the end of it? That's beyond dumb; any production server so exposed requires a bare-metal rebuild. In the absence of a tripwire-esque delta, you have no understanding of the state of the server installation after undergoing an infect/clean cycle, and there's no way that box should be left in production in that state.
Doesn't suprise me (Score:2)
This is an ugly situation (Score:4, Interesting)
They should have clean and isolated systems in place for development and manufacture that isn't connected to the public internet in any way. Furthermore, anything that reaches the public should first be inspected through tight QA standards. The public expects that of high profile manufacturers... worse, the public presumes high QA standards.
This takes me back to a point I was attempting to make in another discussion about the differences that often exist between public expectations and what a company actually delivers. Often times the public never notices the difference, but some times, those differences slap people in the face rather rudely at inopportune times.
I'm not sure when it started to become more common practice to move away from fulfilling public consumer expectations occurred. But the public consumer isn't aware that this shift has occurred yet. But evidence of the quiet shift has been placed in every EULA as far back as anyone can remember that contains disclaimers that their product is suitable for any purpose at all. The laws of some countries and states of the U.S. do not permit the enforcement of some of these disclaimers, but it never stops them from trying to put it past the consumer just the same. But the ugly reality is that 'legal standards' trump quality standards every day that appears on the calendar.
How does it happen? (Score:2)
How did they not catch this? Surely every 1000 of these, they pull one off the line and plug it into a computer to check that it actually works, right? Or every 10,000? Don't manufacturers do any kind of continuous QA of the actual product?
Wouldn't an alert from a virus scanner make someone think "that's not right..."?
So basically they didn't bother sparing 5 minutes once a day or week to check one of these things? Nice.
Who made them? What country? What are HP QCs? (Score:5, Insightful)
china... (Score:3, Interesting)
Coincidence? (Score:4, Insightful)
Now I see this story about HP accidentally selling branded keys with worms pre-installed. Darn, selling malware is so sucky, especially when you sell it to your favorite customers, for example server customers.
Any chance not just Hannaford, but other HP customers are nailed by this?
The takeaway from this episode, for those of you who aren't quite getting this:
- When you buy a USB key, be sure your machine(s) have functional antivirus and antispyware running,and it's updated.
- Look around for instructions on keeping stuff like USB keys from autorunning. Make it so.
- Format that rascal USB key immediately. Immediately. IMMEDIATELY.
- Don't buy USB keys cause they have cool software preloaded. Pointless to CHOOSE to risk infection. make the manufacturers pay for this by avoiding/refusing this crap. Just sell me a simple key, ok? Sheesh...
And trust no one and no thing.
Amazing, is all I can say. And yes, I wonder if these were manufactured and loaded in China. Bet they are.
We are in so much trouble. Mark my words, soon, 'Made in China' will really mean 'Pwned by China'. If ti doesn't already.
Re: (Score:2)
Re: (Score:2)
And I haven't fried anything with a bad USB-whatever in my career. I may live a sheltered life, but usually USB ports survive really bad stuff plugged into them, with spectacular exceptions I'm sure.
It's just not prudent to believe your new storage media is clean as whistle. Even hard drives.
Re: (Score:1)
Re: (Score:3, Insightful)
Surprisingly, much of the software Hannaford settled on using is jut plain Windows. They did use some Sun for certain things, but the store servers were almost all Windows.
I'm unaware of any settlement software available for *nix. There must be some, but I haven't look so hard for it. And Hannaford isn't unique in the industry for using Windows.
It wasn't long ago that Blockbuster used Alpha-based servers at the stores, running customized SCO SysV. nasty, but it worked really well.
Re: (Score:1, Interesting)
So when your laptop is at home, you go on the internet, get infected. Then you dial into the VPN or bring your laptop back to work.
HP also has a culture of keeping bad news quiet. Got to find the leakers! Who let that information out to the public?!?
I personally witnessed a major worm outbreak at HP some years ago. Of course, it was never disclosed publicly.
People who think tha
It wasn't me...it was the one armed HP server! (Score:2, Funny)
But it's a server... (Score:2, Informative)
HP software is malware *anyway* (Score:5, Informative)
So I don't see what the big deal with shipping some more malware is. It's HP. *shrug*
"pre-infected" means not infected (Score:1)
Re: (Score:1)
While we're talking naïvety (Score:4, Insightful)
From the summary:
I think it's also pretty naïve to assume that it is a targeted attack, as such an assumption shifts the blame enormously. While a targeted attack is arguably more dangerous and more worrisome for a certain group of people, such an attack could happen at any number of stages of fabrication, so the fabrication process itself isn't to blame. Reversely, if a random infection makes it to a device sold as a server accessory, that puts both fabrication and quality assurance at fault, the former allowing the infection, the latter for not detecting it. If that's what happens to enterprise products, one has to wonder how much crud gets through in consumer stuff.
I've seen this kind of thing before (Score:3, Informative)
After digging into what happened it was found that the duplication house where our disks were being duplicated had a QC station where each one was tested to verify a good recording. The operator of that station faced a brain-numbing job; insert disk, hit enter, remove disk, repeat. Of course, that job was filled by the production manager's son - who filled in his free minutes by playing a "free" copy of a game that he got from "someone" on the QC machine.
We had to recall all the packages and ship free disinfecting software to everyone who had bought one; fun times. The duplication house (grudgingly) paid the cost of cleaning up the mess, then we found a different duplication house to use in the future. This time we checked their procedures out a little more closely before signing up.
Something like this is probably what happened to HP. The factory where those drives were made had some worms / viruses loose on their network and when the new drives were plugged in for testing / formatting the malware automatically copied itself over. This would happen after the format / test was complete; the operator wouldn't even know it happened.
Sloppy security practices at the factory was most likely the "source" of the problem. They weren't evil, just stupid. But for HP to know about this and wait for 3 months before letting their customers know - that's criminal. At least it should be...
HP loaded the gun, but who pulled the trigger? (Score:1)