Follow Slashdot stories on Twitter


Forgot your password?
Security Botnet Worms

Photo Kiosks Infecting Customers' USB Devices 288

The Risky Biz blog brings news that Big W, a subsidiary of Woolworths, has Windows-based Fuji photo kiosks in at least some of its stores that don't run antivirus software, and are therefore spreading infections, such as Trojan-Poison-36, via customers' USB storage devices. Here is the account of the original reporter. "It's not just the lack of AV that's the problem... it appears there's been zero thought put into the problem of malware spreading via these kiosks. Why not just treat customers' USB devices as read-only? Why allow the kiosks to write to them at all? It would be interesting to find out which company — Fuji, Big W, or even some other third party — is responsible for the maintenance of the machines. It would also be interesting to find out if there are any liability issues here for Big W in light of its boneheaded lack of security planning."
This discussion has been archived. No new comments can be posted.

Photo Kiosks Infecting Customers' USB Devices

Comments Filter:
  • by maweki ( 999634 ) on Tuesday July 06, 2010 @05:37AM (#32808148) Homepage
    Did they not learn this in programming school? Does not every programming tutorial and system administrator handbook start with this?
    The first thing I learned (fortunately not the hard way) was, that, nevermind the specs, input is allways malformed, user input doubly so...

    System Administration 101
    • by Z00L00K ( 682162 ) on Tuesday July 06, 2010 @06:49AM (#32808528) Homepage

      In addition to that - disable the autorun feature in the kiosks - that's probably the most likely reason why they are infected.

      U3 is also a culprit here.

      • by Fluffeh ( 1273756 ) on Tuesday July 06, 2010 @07:42AM (#32808812)
        I work at Woolworths (The parent company), and I really wonder if I start blowing my trumpet about this, will:
        a) Anyone in management have a clue what this means.
        b) Anyone be able to track down someone who can actually DO something about it.
        c) (sadly) whether anyone will actually care enough to make a change for the better.

        Tomorrow morning's agenda...
        • Re: (Score:2, Insightful)

          by maweki ( 999634 )
          d) I guess you will get fired for not complying to some company policy you have... (the smart money is on Rule 1 "don't speak up when knowing better than management")
        • Speak Up. (Score:3, Interesting)

          by dakameleon ( 1126377 )

          Speak Up. Somewhere along the chain, there will be a competent IT manager who knows what this means, and why it is important. If your organisation is good, that'll be from the CTO down, but worst-case you'll get to a "sergeant" kind of level where the manager still deals with the coalface.

          If that manager hasn't been notified already by this blog or by someone else reading slashdot, your speaking up will be appreciated. If it's been raised before, you can rest easier knowing there's someone competent around,

        • I work at Woolworths (The parent company), and I really wonder if I start blowing my trumpet about this, will:
          a) Anyone in management have a clue what this means.
          b) Anyone be able to track down someone who can actually DO something about it.
          c) (sadly) whether anyone will actually care enough to make a change for the better.

          d) you get terminated and prosecuted?
          As we say in the States: "He who smelt it dealt it."

      • Autorun, eh ? Wonder if we could get linux to autoinstall :-)
    • by erroneus ( 253617 ) on Tuesday July 06, 2010 @07:01AM (#32808592) Homepage

      No, they don't teach that any longer. I was up on my soap box on the issue and the general response was "but that just introduces bloat!" and was modded troll. I seriously couldn't believe what I was seeing. The fundamentals have been forgotten or ignored lately. It explains a lot. These same people were telling me that "regex" is better than the primitive methods I described for input validation -- the primitive methods I described were to be simple, compact and likely in assembler. I was like "what do you think a "regex" does? Magic? It does the very same thing I described but in a higher-level language. These people all believe in the magical black box.

      • by stephanruby ( 542433 ) on Tuesday July 06, 2010 @07:57AM (#32808890)

        These same people were telling me that "regex" is better than the primitive methods I described for input validation -- the primitive methods I described were to be simple, compact and likely in assembler.

        Let me guess: (1) the software in question was a blogging program much like wordpress (in other words, you must feel that the context of the situation wasn't relevant to your thesis and didn't even need to be shared with us), (2) the kids you were talking may have known about "premature optimization" but were far too young to explain that concept adequately to you, and (3) those same kids didn't know what an assembler was either, that's why they didn't make fun of you for pretending to know how to program in "assembler" instead of ***assembly***.

      • Re: (Score:3, Informative)

        by MikeBabcock ( 65886 )

        I have the same problem convincing people to just use 'const' in C programs where they don't expect to modify a value. Its an easy step and it lets the compiler catch a whole host of problems for you (not to mention do optimizations) but its too much typing for some people.

    • by xous ( 1009057 )
      Heh. This was never even mentioned in my college "Computer Analysis/Programmer" course. The whole thing was pretty much a joke from my POV. My favorite thing to do was break my teachers example applications with no code access. It was absolutely hilarious to school the teacher on data validation when that is what she was supposed to be teaching the class. I mean who the hell thinks poping up a a damned message box on the key up event that tests for '', 'abcdef...' (yes, I'm fucking serious her tests were
  • by ivucica ( 1001089 ) on Tuesday July 06, 2010 @05:40AM (#32808166) Homepage
    Windows autorun viruses: Annoying if you use Windows, easy to ignore if you don't.
    Vuvuzelas: Annoying if you watch soccer, easy to ignore if you don't.
    • A great analogy that doesn't involve cars! :)

    • Just like with STDs, you can still be a carrier even if you yourself don't suffer from the symptoms.

      And just like with STDs, infecting other people while claiming that you are "immune" kinda makes you a jerk.
      No pun intended.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        STDs: Annoying if don't read slashdot, easy to ignore if you do.

      • Not really, if people are deliberately careless its primarily their fault. Its more as though you gave the STD to someone who says "yes, I know you might be carrying it, but I cannot be bothered with precautions".

      • Or, actually, the kiosk owners/designers wouldn't need to worry if their specialty device ran, gasp, something else than Windows. This can be considered an appliance, not a computer, so even anti-Linux desktop zealots can't complain.
      • Re: (Score:3, Informative)

        I've heard this line before, usually as a justification from the IT staff as to why I need to put AV on my mac. Does this actually happen in the real world with any great frequency? I suppose it could if you were transporting windows executables around on your USB and copying them to your mac it could happen. But usually, I just copy office documents or other data files around. So I'm not convinced (unless of course your office or pdfs have something, but those usually show up in attachments in e-mail fr
  • by Errol backfiring ( 1280012 ) on Tuesday July 06, 2010 @05:41AM (#32808170) Journal
    I never encountered a USB stick with a read-only switch. Floppies had them (although they only "communicated" a read-only setting and could not enforce it). SD cards have them, but no USB stick I ever saw had one. Why? Such a switch on a digital device can really enforce the read-only setting.
    • by Lennie ( 16154 ) on Tuesday July 06, 2010 @05:44AM (#32808182)

      I have seen USB-sticks with a read-only switch, so they do exist.

    • by Tim C ( 15259 ) on Tuesday July 06, 2010 @05:49AM (#32808208)

      I've seen them, but that's not the point - the point is that the kiosk itself should be mounting the stick as read-only regardless of how the stick itself is configured. There should be absolutely no way for the kiosk to write to the stick; otherwise you risk an error (or something malicious, as in this case) wiping out the customer's data or (again, as in this case) potentially infecting their machine.

    • by LBt1st ( 709520 )
      You could use a USB stick that takes SD cards for memory.
    • by Lumpy ( 12016 )

      I have. Lots of brands will have a switch to disable the Write enable line on the Flash disk. you can add one to a stick if you are good with soldering.

      Problem is most photo kiosks I encounter has the USB ports utterly trashed. As well as the CF slot trashed.... Typically by clueless soccer moms smashing the thing in there.

      It's why I bring a SD card with the photos, the SD slot seems to be more robust and is typically less trashed. I find the Sams club Kiosks more trashed than the Costco ones.

    • by Lumpy ( 12016 )

      in fact.... here.... []

      Filtered for Write protect switch enabled.

  • Responsibility (Score:5, Interesting)

    by Anonymous Coward on Tuesday July 06, 2010 @05:51AM (#32808226)

    I would guess Fuji is responsible for these machines. I work for Target, and ALL equipment, kiosks included, in our Kodak labs are serviced by Kodak field techs.

    Incidentally, we are allowed to connect guests' media to the kiosks ONLY, never directly to any other lab workstation, because the kiosks are (or at least are supposed to be) far better locked down, including treating all media as read-only.

    • Re: (Score:3, Informative)

      by paulc0001 ( 173130 )

      The kiosks are manufactured by [] but are serviced by Fuji engineers. I would expect the disk image to come from Fuji so they would be responsible.

      • If Big W is collecting the money from the customers then they are liable for any injury the customers suffer. Collecting from their contractors is Big W's problem.

        All would be named in any lawsuits in any case.

    • And more importantly, the kiosks should also have autorun disabled.

  • Just burn a CD (Score:5, Informative)

    by Spy Handler ( 822350 ) on Tuesday July 06, 2010 @05:56AM (#32808252) Homepage Journal
    Just burn a CD and give it to them. Blank CDs cost like 10 cents each if you buy a spindle, and you don't have to worry about them losing your USB drive or infecting it.
    • by grumling ( 94709 )

      Or use Costco's uploader on their web site. You can even load up a printer profile in Photoshop or GIMP for you store's printer, and enlargement prices aren't too bad (at least compared to chemical process photolabs). Upload them tonight, pick up in the morning.

  • by jack2000 ( 1178961 ) on Tuesday July 06, 2010 @06:04AM (#32808292)
    More people need to know about this:
    You can make your usb stick immune to all autorun viruses. Simply make an empty autorun.inf file on the usb stick, set file permissions for username " everyone " to Full control: Deny all.
    Now noone can delete, write, rename that file and viruses aren't smart enough yet to take over control or delete permissions on the file. The file system on the stick would have to be ntfs. If the file system on it is fat32 you'll need to run from cmd
    convert Z: /FS:NTFS /X
    Where Z is the partition letter of your usb stick. You can also disable autorun on all partitions using TweakUI
    • by twisteddk ( 201366 ) on Tuesday July 06, 2010 @06:17AM (#32808364)

      And what makes you think that the Kiosk software can read a NTFS USB drive ?
      While I cannot speak for the specific types of machines mentioned in the article, I DO know that a lot of the local machines over here are using some funky Linux flavor (presumably to keep costs down), running off flash ROM. And they generally expect you to deliver the data in a FAT32 partition if you provide a USB drive.
      Then again, if the software is Linux, Then there usually isn't that much of a problem with viruses hopping from one device to the next, I'd wager.

      • Requiring people to use fat32 is a little barbaric. Why would anyone have to be forced to use a file system without file permissions or password encryption is beyond me.
        • I dont know. I would guess that it has to do with what they can make work in a machine that's only supposed to cost some hundred $. I'm guessing it's a way to cut costs not having to pay for a license to read/write to NTFS devices. Unless MS is starting to give away those licenses for free now ?

          • Unless MS is starting to give away those licenses for free now ?

            There's a crapload of filesystems better than NTFS that even Microsoft can use freely. Except, you know, that would 1. be an admission there is a world outside Microsoft, 2. lessen the stranglehold they work so hard to maintain, and 3. do something good for the customers, and they can't have anything like that.

        • by Bert64 ( 520050 ) <bert&slashdot,firenzee,com> on Tuesday July 06, 2010 @06:47AM (#32808514) Homepage

          Blame Microsoft...
          There are plenty of open royalty free filesystems out there, but MS refuse to implement them and want you to pay royalties to use their own filesystems instead, so people use fat32 because its the least patented of the few filesystems MS do bother to support.

          • No, not so much (Score:3, Interesting)

            by Sycraft-fu ( 314770 )

            MS does nothing to stop you from implementing any file system you like in Windows. In fact, they've got documentation on how to do it. It's called the Installable Filesystem Kit, which is part of their driver development kit. You can easily write your own file system drivers for Windows.

            As an example have a look at []. They've got an ext2 driver for Windows. Install it, and ext2 is a file system Windows understands and works with, just like any other. There are others too, there is a

            • Re: (Score:3, Insightful)

              It's not hate.

              Microsoft supporting a modern royalty free file system out of the box would make life easier for a _lot_ of people (even if most of those people have no idea that this is the case). Unfortunately Microsoft is not interested in being interoperable here, it's just not in their best interest.

              Stating the above is not hate, rather a rational conclusion. On the other hand, talking about how third parties can implement file systems on Windows is a red herring if the subject is real interoperability.

        • I kinda have to use FAT32 on USB disks (including a 250GB one - amusing that I have to use Linux to partition/format it), purely because I want to use them to play back video on a Playstation, so no NTFS support there.

        • Because it's universally supported by workstations and handheld computers. Because the cameras all support it. Because the stand alone printers all support it. Because it is universally supported -- maybe that's why.
        • by cbope ( 130292 )

          I've never bought or acquired a USB stick that wasn't FAT or FAT32 formatted. I've never seen one formatted NTFS. I suppose FAT/FAT32 is used since it is usable by just about every OS without reformatting.

          If you don't get what I am trying to say, imagine trying to give verbal instructions to Joe Sixpack how to format his new USB stick so he can use it in his Mack-in-tosh...

          All of my USB sticks are FAT/FAT32 but all my USB hard disks are NTFS, fwiw.

    • by ledow ( 319597 ) on Tuesday July 06, 2010 @07:17AM (#32808664) Homepage

      The word "pointless" comes to mind. First, any decent virus that *wants* to can just disable your protection immediately. Literally one line of code. I would be shocked if the virus-libraries that are out there don't already have a set of routines where you just pass it a filename that you *want* to write and it does all the fancy trickery to try to write to that file no matter what (e.g. mount the media, relax permissions, make the current user owner, overwrite the file entry entirely etc.) and then possibly even clean up any "changes" after it's done its job (e.g. restore permissions). Relying on the fact that you haven't seen a virus that knows how to change permissions on a file that stands between you and infection is *stupid*. Viruses, almost by definition, act with full administrator privileges by extremely cleverly executed buffer overruns and other attacks. You really think that a non-permissioned (but permissionable) file can't be accessed/changed automatically by something *TRYING* to write that file by an administrator privilege program written by the same person?

      Your "solution" is a temporary, ineffective workaround to stop a single USB device from having its autorun information changed if the "attacker" puts zero effort into it and doesn't use quite obvious and simple code to take account of *any* possible situation that one of it's victims may have (i.e. don't expect everyone to write-protect their autorun.inf, but do expect *every* write access to fail and keep trying different ways to get them to work). Saying that you're then "immune" to all autorun viruses is stretching it a bit. It's only as secure as the fact that the virus respects the disk as an NTFS structure, uses the standard NTFS routines to access it, is running as a user that can't modify the permissions (unlikely by that point) and doesn't bother to just blindly wipe permissions on any file it wants to write to. Also, NTFS USB sticks? Yeah, right. About as popular and readable in random machines as ext4 ones. And to be honest, just making it an ext2-disk with the ext2fs driver probably renders it MORE immune to autorun.inf creation/execution.

      The "solution" to this is to not have autorun enabled on your USB drives at all. WHY? What is the purpose? To save you a double-click. That's it. And it opens up arbitrary execution to any device that poses as a USB stick (even my 3G modem has writable USB storage, so I'd have to apply the same principle to this and every other device that I autorun - my phone, my 3g modem, my external hard drive, even ordinary USB devices are coming with "driver" partitions that install the drivers from an autorun partition on the device on first use). Or I could just switch autorun off. If the USB stick is compromised, then it's compromised. No amount of fancy permission-fixing will fix that and it's just as likely that a virus hunts down my JPG's and inserts some payload that crashes certain JPG-reading applications. Or just modifies the MBR so that if I leave it in it will autoboot and silently infect my PC. Or infect anything else executable / readable on the stick. It overwriting my autorun.inf is the LEAST of my worries and much more easily and permanently fixed by a built-in Windows option on a per-PC instead of per-stick basis.

      Don't let things automatically do stupid shit like auto-update and/or auto-run without you knowing what they're doing.
      The problem with viruses these days is not the viruses - it's the *stupid* and *ridiculous* attitude to an unknown third-party running arbitrary code on the machine that holds your banking details, etc. "Oh, I got a virus the other day but I think I cleaned it off", people running with viruses without realising for months, if not years, and people thinking that anti-virus does *anything*. Don't half-arse it. If you're smart enough to disable autorun, do that. If you think your USB sticks stand a risk of being infected, wipe them before you put them anywhere else (by inserting into an autorun-disabled or, better, Linux m

      • You're probably correct in that a determined virus writer won't be stopped by something like file permissions. However, the nature of publicly accessible computers dealing with everyone's removable storage means that the likelihood of someone with infected media using it is a near certainty. Will things like changing permissions and disabling autorun stop every virus out there? of course not. Will it stop half of them? Quite likely. Can other kiosk-side measures be implemented to reduce infection even furth

    • Make a _directory_ named autorun.inf, this works on FAT as well.
      Since 99.9% USB sticks use FAT -- and most devices don't understand anything else -- moving to NTFS (or a more sane filesystem) is usually not an option.

    • And congrats, your stick no longer works in secondary devices like televisions, video game consoles, printers and other devices that only know FAT-32, all of which are handy when you have a USB stick of photos.

  • by ewrong ( 1053160 ) on Tuesday July 06, 2010 @06:09AM (#32808322)
    "Customers USB Devices Infecting Photo Kiosks".
  • Yeah, so? (Score:5, Interesting)

    by Anonymous Coward on Tuesday July 06, 2010 @06:23AM (#32808386)
    I used to work on similar kiosks a few years back, those also had no AV, but usually that wasn't a problem.
    They ran a hardened win2k, no network services, autorun disabled, afair execution for all drives but C: disabled.
    So how the f* would they get infected in the first place?
    Lazy techs, at least that was the #1 cause for troubles for back then, everything from re-enabling services to installing 3rd party RA software with no/weak passwords...
  • by ciaran_o_riordan ( 662132 ) on Tuesday July 06, 2010 @06:26AM (#32808398) Homepage

    The kiosk situation is generally lousy.

    Do they keep a copy of all my pics?

    They make a copy (they have to, to display thumbnails), but is it temporary or permanent ("To improve the quality of our service...").

    There should be a law prohibiting the keeping of copies without express permission, and they shouldn't be allowed to make unrelated functionality dependent on the user agreeing to let them keep a copy.

    Copyright law might work here, but I imagine the kiosk companies have found a way around that. Maybe there's a "Terms of user" stick on the back of the machine mentioning that they keep copies, etc.

    • I know BigW keep them for up to a week - stuck disk in all the thumbnails up and I asked - how long do you keep them? Up to a week as customers often come back. Can you delete them for me now? No.

      I haven't been back there to have photo's printed. and any shop - i grab just the pics I want printed and put them on an sd card and put that in.

      Why feed the Beast more than it needs to? If we don't make the data available, the Beast can't eat it.

      • That's what I do too, and it reduces the problem for us, but I usually think about these issues from the point of view of what's necessary to protect my less-technical family and friends.

    • by brunes69 ( 86786 )

      Er, why do you think they make a copy to display thumbs? Your home PC does not have to do this.

      • It at least has to copy them into volatile memory (RAM). Whether it makes a copy on a hard disk is an implementation issue, but the user can't know the implementation, so we can't make assumptions about it not making such copies.

    • I used to work in a photo store. On the Kodak Picturemaker we used to use, the admin interface required a password not only to print, but also to recall previous orders. Also, the machine only saved orders for one day.

      Of course, that machine was based on a Sun SPARCstation. It's been a while since I've worked retail.

  • by pinkushun ( 1467193 ) on Tuesday July 06, 2010 @06:29AM (#32808416) Journal

    A couple times I have seen an ATM that has crashed, BSOD or shows a windows logon screen -- And we're supposed to trust our money with these tin can openers? WTF?!

    • Re: (Score:3, Informative)

      by Voyager529 ( 1363959 )

      The difference between an ATM and a photo kiosk is that the only forms of input into the system are the debit card (which is programmed by the bank) and the keypad or touch screen input. Users don't bring in their own infected media to use with it.

      Also, the odds are extremely good that at some point, your financial data will involve a Windows terminal. If it makes you feel any better, there are some pretty tight regulations as to how heavily locked down bank systems have to be. Even if you see a bank teller

  • Read-only (Score:2, Informative)

    by Tuan121 ( 1715852 )
    Just a guess, but when you are selecting pictures at the kiosk you can probably also do some options such as red-eye reduction, rotating etc. I would imagine most people who do that at a kiosk would like those changes saved on the original picture on their USB drive instead of having to repeat the process at home where they might not even know how to do it.

    So there is a reason for not mounting it as read-only.
  • Poor design.. (Score:5, Interesting)

    by Bert64 ( 520050 ) <bert&slashdot,firenzee,com> on Tuesday July 06, 2010 @06:39AM (#32808466) Homepage

    Why run windows on these kiosks? An embedded OS would be more suitable and cheaper...

    Why execute anything thats stored on the usb sticks? That's just colossally stupid, i could understand if some malware was getting onto the devices by exploiting a bug in the jpeg parser or similar, but executing any code on an inserted device is just ridiculous.
    Why is the inserted media not mounted read only? These kiosks only need to print photos, they don't need to write to the media.
    Why is the system drive writable?
    Why is the kiosk software running as a privileged user?

    The idea of installing antivirus on them is a stupid one, it will increase the cost, require the kiosks to be updated somehow (either necessitating frequent engineer visits or require a network connection), and no antivirus detects everything (i often do incident response when a customer system has been compromised, in every single case there has been some kind of av product installed and it failed to detect the compromise even tho in most cases the malware installed is well known to other av products).

    Also an av product may detect a false positive on a customer's media device and delete their data which could open the kiosk vendor up to potential liability.

    Instead, run an embedded linux on these systems...
    the frontend software is custom written anyway so could just be written for linux instead without too much difficulty..
    less to go wrong since such an os could be stripped to its bare minimum
    less cost - there would be no per unit licensing costs..
    mount any customer supplied media readonly and noexec.
    boot the os from readonly flash so the os cannot be tampered with and any problems a reboot will restore it to default/clean settings
    use ram for temporary storage (or a small disk which is reformatted at boot if more storage is required) so after a power cycle, anything left on there is gone
    if any persistent storage is required (eg for logs) use a remote syslog server, a receipt printer, or a small disk mounted noexec
    use something like an internal readonly compact flash card for the os, when an engineer has to upgrade all he needs to is swap the card out.

    • Re: (Score:3, Informative)

      Why execute anything thats stored on the usb sticks?

      Quite simple, because Microsoft had a policy to make any data format executable. Yes, images also. And XML, off course. And CSS, even though the standard explicitly warned against that. In Microsoft's own words, to "make developers smile".

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      "Why run windows on these kiosks? An embedded OS would be more suitable and cheaper..."

      Because, while the embedded OS would be less expensive, the development costs would be far higher. Windows devs are a dime-a-dozen, not so much with true embedded developers-especially ones that have experience and know what they are doing

      Why execute anything thats stored on the usb sticks? That's just colossally stupid, i could understand if some malware was getting onto the devices by exploiting a bug in the jpeg parser

    • Re: (Score:2, Informative)

      by Anonymous Coward
      1) They probably run Embedded Windows. All the features at half the price and no need to deal with activation keys. Simple drive image.
      2) These Kiosks usually use some flavor of a professional level printer. These printers don't have embedded drivers.the professional level require drivers. Cost to write those drivers offset the OS savings cost.
      3) The service people paid to administer these machines are more comfortable with Windows - as stated earlier, these are 10 year old products and the linux/embedd
    • Re: (Score:2, Informative)

      by Com2Kid ( 142006 )

      Why run windows on these kiosks? An embedded OS would be more suitable and cheaper...

      Most likely to dramatically cut development costs. With standard off the shelf x86 parts you can use whatever development environment and language is most convenient, and you can take advantage of the ever decreasing prices of x86 hardware.

      In contrast embedded stuff, while better suited for some situations, is a much bigger pain to get off the ground initially, and pricing tends to stay pretty stable.

      Not running as a privi

    • > Why run windows on these kiosks?

      Because they are oblivious to the very existence of any other possibility.

    • by Lumpy ( 12016 )

      No it's not. a Windows dev is a dime a dozen. A linux, QNX or other embedded systems Dev is far more expensive.

      They dont want robust, they want cheap; and windows + a cheap outsourced dev = greater profit.

    • reused / windows 9x based software is runing the systems? some of them also have scanners want to bet they are ones that only have windows drivers for?

      I think they run on windows embedded and likely don't get the windows updates installed on them.

      also they need to networked to the printers at the photo lab.

  • I still do not understand how people dare to deploy Windows on non-attended machines. Severe tweaking to the OS is necessary to accomplish this task successfully, at a point you would be probably violating the license you are paying for. I bet everybody reading this has seen a 'funny' dialog or information box popping up on kiosks, information screens, ATMs, etc. not to mention BSODs. A photo kiosk is the typical application for which Windows is an overkill.
  • by dev_eddie ( 827800 ) on Tuesday July 06, 2010 @07:11AM (#32808638)

    I did own an Agfa Photo Kiosk. It didn't have an AV by default and it ran "Windows XP embedded edition" that prevented me from installing an AV (installers didn't allow me to do an install.). I saved a raw image of the hard disk for safety and allowed it to infect customers. It was a security nightmare. Viruses had their way into the machine, but AV software didn't. Autorun was a requirement for the kiosk software to process photos and could not be disabled.

  • by ArsenneLupin ( 766289 ) on Tuesday July 06, 2010 @07:44AM (#32808824)
    1. download random pic [] from Internet.
    2. put it on stick, along with Virus
    3. infect kiosk
    4. from now on, kiosks substitutes customers photos with "random internet pic" from step 1 somewhere between the time the order has been validated, and when it will be printed.
    5. ...
    6. Sit back and watch the fun as customer comes back to pick up his photos...
  • For crying out loud - even floppies had read-only tabs. Who the f*** designs removable digital storages device without one?

    I mean, that way people'd be able to secure themselves against this sort of thing, right?

    So why have I never seen any USB drives that are made so that when a particular (physical) switch on it was toggled, the data on it is not modifiable by any computer it might be plugged into? It seems to me in light of this that it's a concept whose time may have likely come.

    • > So why have I never seen any USB drives that are made so that when a
      > particular (physical) switch on it was toggled, the data on it is not
      > modifiable by any computer it might be plugged into?

      Because such a switch would cost money. That would mean the drive would cost more. As no significant number of people would see any reason to pay extra for the switch the product would not be widely available.

  • I'm asking this out of curiosity, as I really don't have any experience with this type of thing: How do you ensure that USB devices are read-only? Is it a hardware thing? Because if it is a software thing, then it is doomed to being circumvented by the malware. Of course, that brings up the question as to how the malware got on the machine in the first place - I imagine from autorun being on by default. Some system integrator did a lousy job setting the machines up, for sure. But the question remains - how
  • every USB stick (make that all removable media) should be like these: []

    • Notes price, now knows why nobody buys them.
      • I have a few cheap-ass SanDisk drives that are almost 10 years old, and those have write-protect switches on them. The switches are recessed into the case and you need a paperclip to flip them, but they're there. Very handy for getting anti-malware stuff onto an infected machine without risking spreading the infection.

        Surely someone's still making drives that have this capability, without all the encryption features and shit that drive up the price to ridiculous levels.


  • The myth that computers all have viruses is a sad joke. This is Microsoft's fault, plain and simple. The people who set up these kiosks have a right to expect that a computer can run virus-free. There ought to be a class action against Microsoft. Their products ought to be removed from the market for how dangerous they are. Windows is a fucking Pinto.

    • Theoretically Windows has all the features needed to protect a Kiosk. You can mount an USB drive read only. You can remove admin rights from the default account so the software read only switch can't be changed. Have you ever looked through the list of privileges you can fine tune any security need between guest user and full admin? Make good old VMS privileges look simple. It is all there. Just no one uses it.


  • We have a camera store close to the main station in Stuttgart (Germany) which has the same issue, or it did the last time I went there. The instance you plug your USB device in it will get infected by the photo printer. Not sure what it is supposed to do but when I try to run the file at home it won't work. Maybe I am doing something wrong .... $ wine yomamma.exe .... ohh well.

    The staff is totally clueless when it comes to computers and management does not give a shit so I bet the machine is still infected

Karl's version of Parkinson's Law: Work expands to exceed the time alloted it.