Slashdot Mirror
Trojan Found In New HDs Sold In Taiwan
GSGKT writes "About 1,800 brand new 300-GB or 500-GB external hard drives made for Maxtor in Thailand were found to have trojan horse malwares pre-installed (autorun.inf and ghost.pif). When the HD is in use, these forward information on the disk to two websites in Beijing, China: www.nice8.org or www.we168.org. The article implies that authorities believe the Chinese government is behind the trojans. A later article pins down the point of infection to a subcontractor company in China. A couple of months back the Register was reporting on pre-installed malware detected on Maxtor disks sold in the Netherlands. This earlier report was downplayed by a Seagate spokesman." The more recent Taipei Times article says that Seagate admits the problem on its Web site, but a search there turns up nothing.
Lead in paint, malware in HD's same thing really
Make SELinux enforcing again!
Anyone who doesn't wipe a new drive first off is just begging for this sort of thing. Secondly, I guess it's a new competition for Chinese manufacturers to see what's the worst secret addition to a product sent overseas. Lead in toys, GHB in toys, phone-homes on HDD's... what's next killer bees in new TV's... really. Consumerism bites!!
I got a catholic block.
Most PCs ship without professionally produced malware installed. While everyone might *wish* that their PC came with such software, only a small percentage of customers are actually lucky enough to get their malware free of charge. Mac users, don't feel bad that your system won't come with it. You get iLife. :-)
it's the most corrupt mainstream country in the world right now, so what do you expect?
...that I'm really glad I switched to Linux. :)
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
I mean, so what if there's a trojan that steals my identity and turns my computer into a botnet node? So what the materials it's comprised of let off poisons that will kill me and my whole family? I saved $6 on this baby!
Is this a news report or a trailer for a motion picture?
While the open source movement has done a great deal toward making software understandable, at some point, people have to trust their computers. However, this used to be a great deal easier, because engineers had a good idea of what could be done with a particular amount of circuitry.
The increasing level of integration means that hardware is more and more of a black box. While this has led to huge savings in cost and performance boosts, we've paid for it by being unable to debug the hardware, and unsure of what's really going on inside.
While the case in the article talks specifically about a trojan horse installed normally on the drive -- and thus something that should have been remedied by a good formatting job -- who knows what could happen once we have vulnerabilities embedded directly into the hardware. One could certainly imagine a trojan that was hard-coded in the firmward and kept moving itself around the disc after attempts to delete it.
It's also seems fishy that much sensitive information (of relevance to a foreign government) could be obtained from randomly putting trojans on hard drives... Isn't it possible that this was an unintentional infection from some disk-handling or testing machine along the line?
--
Educational microcontroller kits for the digital generation.
By the way, it isn't a trojan. A trojan is software that convinces the user to install it by looking like something else that the user might want to install. While this may certainly qualify as malware, it isn't a trojan.
Do they have some mechanism for surviving the intial format or is this a complete hoax? Even assuming the drive is installed in a Windows computer, isn't the first step always to format the drive? I've added lots of drives to Windows machines and it never occured to me to try to access them without formatting them. Do these come preformatted?
As to the reference about these drives being used for government databases, certainly they would be reformatted when added to a RAID, wouldn't they? Even if preformatted for non-RAID use I don't suppose it would be possible to use them in a RAID without formatting first and what database would ever be on a non-RAID device?
maybe a format of the drive when its purchased will fix. Or because its malware does this mean its going to be embedded into the hardware? It goes to show that we can't even rely on our hardware now without some big "brother" sending information back.
Look Forge | Free Classifieds Buy and Sell http://www.lookforge.com/
Please add to your host files:
127.0.0.1 www.nice8.org
127.0.0.1 www.we168.org
Yeah my new computer shipped with malware installed to...Windows Vista.
-Fill the suckers with Linux distros or something, then..
(Yeah, big chance of it uploading 'everything,' anyway. - ANYTHING, maybe, not every..)
A horse can't be sick, you know, even if he wants to.
The summary doesn't state who is at risk here. For all I know, these could be hard drives for servers. I suppose the files autorun.inf and ghost.pif hint that it's targeting Windows. Would this also be a security issue if someone attempted to execure those files within Wine or Parallels?
Taiwan or Thailand? Two completely different places.
Looks like a "typo" tag to me.
Those of us who think they know everything annoy those of us who do.
Comment removed based on user account deletion
Wine doesn't support autorun so it is safe. Parallels will be affected assuming it doesn't disable autorun in the host OS, which most VM software does.
Comment removed based on user account deletion
So this is not a hoax, after all.
I was surprised when Seagate bought them. Maxtor was always a 'eh..' kind of disk manufacturer and Seagate has always been one of my favourite in terms of quality. Sorry Seagate but I'm not buying Maxtor disks ever.
I once bought a computer with Windows preinstalled.
If you mod this up, your slashdot background will turn into a beautiful sunset!
Default Windows settings would run the trojan once you plugged the drive in. To avoid this you either have to hold shift for an indeterminate amount of time while plugging the drive in, which can be difficult or impossible. With such a drive you're likely to use a more inaccessible port because you likely won't be needing to unplug it much. The only other alternative is to disable autorun for removable drives. This option is not available in the standard GUI and third party tools (or TweakUI) are needed.
Comment removed based on user account deletion
They figured it was a time saving feature that would save bandwidth for the buyer having the Trojans preinstalled.
Something physical brought behind your defenses that attacks you un-awares.
Bah, right after I posted my comment I realized I wasn't thinking straight. Time for bed I guess. Ignore parent and imagine I typed this instead:
Default Windows settings would mount the drive and immediately parse autorun.inf. I'm not sure about running the trojan, but I think MS totally disabled the run part of autorun in Vista and maybe an XP update (instead you get a dialog which shows the autorun action as one of several options you can take including nothing, or opening the drive in explorer).
This is not a trojan in the software sense, and I'm not sure it is in the classical sense, either. I think you have to take intent into consideration. The software was not knowingly placed on the drive by the manufacturer; it was slipped in by a contractor somewhere down the line. From the end user's perspective I guess there really isn't any difference (drive goes in, computer gets fucked), but the manufacturer was not trying to dupe their customers.
Please add to your host files:
127.0.0.1 www.nice8.org
127.0.0.1 www.we168.org
Be sure to put them in the upstream router. Autorun may compromise the system.. DUH it's a trojan. Since the affected drives are portable drives, it is very important to disable autorun as well as block the sites upstream of the compromised machine.
The truth shall set you free!
Why oh why does Microsoft still automatically run software off any disk that's inserted into your PC? Surely decades of floppy-carried virii should have convinced them of what a frigging stupid idea that is?
So if the Chinese government is willing to do this with just hard drives, it makes me wonder what they are putting on Lenovos.
Perhaps the EU can take up their case.
Have gnu, will travel.
Try putting this in your autorun.inf:
[autorun]
shell\silly=You're silly
shell\silly\command=calc.exe
shell=silly
now remove and reinsert the USB device. Hmm.. nothing happens.. how strange. Go to My Computer and double click on I: (or whatever your drive is mapped to) and what happens? Yeah, calc.exe is run. Thanks Microsoft.
You may now flame away.
How we know is more important than what we know.
"The only other alternative is to disable autorun for removable drives. "
Or... chassis it into an external FW/USB/SATA enclosure, cabled to a Mac & either reformat it for OS X & use... or wipe it and format it for a windows box.
There is a simple solution to problems like this. Whenever you purchase a new (or used?) hard drive, write zeroes to the whole darn thing and then format it with your filesystem of choice. Badda bing batta boom.
What happens when they put malware in the BIOS on your motherboards.
How will you know? How will you get rid of it, (I know flash the
BIOS, but maybe the BIOS doesn't want to be flashed.)
There's talk that the next war will be a cyberwar. I guess that's
better than the other kind, but these are some of the ways to do it
I'd say.
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
The article doesn't state it but this seems to be the worm W32.Drom. Symantec rates the threat as Very Low with 0-49 total infections. Take that with however many grains of salt you wish.
http://www.we168.org/Data/a.txt
By "Trojans Found In New HDs Sold In Taiwan", I thought they meant condoms.
(OK, who's the comedian? My catchpas is "durable".)
The Autorun capabilities are restricted to CD-ROM drives and fixed disk drives.
Is MS also going to tell us how this is a feature on HDs? I can see it in CDs. I could even see it in USB drives. But in hard disks? Where's the point in an autorun feature on a hard drive?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Why would the Chinese government do something so obvious? And the drives were sold in Taiwan? Given the relationship between the Chinese and the Taiwanese... it seems more like this was _meant_ to be found in order to destabilize the Taiwan economy more than to do any sort of real information gathering... if the Chinese government wanted to gather information I'm sure they could and would be far more covert than this... and compared to the other systems they surely have in place this is nothing.....
This is not as simple as it seems I think but instead is meant to be discovered in order to produce reactions similar to many of the posts I have read so far
Just a guess tho, but there's more going on here than is in this story
127.0.0.1 is MY computer! Say that again and I sue you for slander, I'm not spreading malware!
(The scary part is that I'm not so convinced I couldn't find a judge who wouldn't allow that suit...)
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
where do i get one of these!
i'll install it in a computer with 5 tb of porn!
that should keep them busy for awhile.
I format the disk, install linux, no problem - I"ve never seen any malware ;)
From TFA:
A spokesman for Seagate, which recently acquired Maxtor,
said the company was investigating Kaspersky's findings.
"This scenario seems unlikely because the 3200 does not
have any software preloaded on the drive so there is not
an opportunity for a virus to be loaded," he said. Yes
the drive is formatted but I have never heard of a virus
that lives in the master boot record."
Master boot record is the original hiding places of virii, kapiche?
a) sloppy manufacturing picks up loose malware b) deliberate infection by teenage haxor, perhaps for prestige, perhaps for cash c) deliberate, by botnet agent d) deliberate, by government agent e) deliberate, by aliens, illuminati, JFK, and cmdr taco - Found for sale only in Taiwan so far / aimed at Taiwan? Only 1800 drives reported infected, 300 sold. Infection reported to be found initially by consumers. Doesn't sound particularly sophisticated to me. My bet is on (a).
Is this how we attract the teenagers to technology now? Include a free condom? ;)
this nation, under God, shall have a new birth of freedom. -- Lincoln, Gettysburg Address
American businesses that outsource to China are no better than spies and traitors themselves.
I realize you are merely repeating a popular but false meme so please do not think I am being harsh with you personally, it's the meme that I am being harsh with.
The notion that corporations are to blame for outsourcing to China is beyond naive. We the consumers, not the corporation are to blame! We have essentially forced corporations to outsource by our consideration of virtually nothing beyond price. Business is a Darwinian process. That first corporation that experimented with outsourcing was *rewarded* by consumers rather than punished. Corporations had little choice, jump on the outsourcing bandwagon or go out of business.
If you do not like outsourcing look at the labeling on packaging. Sometimes this requires a little extra effort. I needed a set of screwdrivers and in the regular tools section everything at the local Home Depot was an import. I accidentally found some manufactured in the USA elsewhere in a "professional tools" section. Maybe its not too late.
In Australia we get a lot of professional tools from the USA. They end up managing telecommunications and other technology companies. I ask you citizens of the United States for the good of the reputation of your country to keep those managers who are complete tools within your borders, cut off their cocaine supply and put them to work sweeping floors somewhere where they can not do much damage with their remaining brain cells.
For 99% of the windows users out there, the second the drive is plugged in, it's going to autorun the virus. Sure, they can format it after that, but it's already too late. So how exactly do you expect them to wipe this drive? Oh, let me guess, consumers should know better than leave the default windows autorun settings *right*.
Lots of external hard drives come with free "backup" software pre-installed!
I do recall the chinese government... er... a *private* chinese firm wanting to buy seagate. Why not??? What could possibly go wrong?!?
the computers of QC guys are infected.
So now you need a Linux PC to format all HDDs before plugging them into Windoze machines. As machines become more complex, the consequences of incompetence become larger as well. Long ago, pre-formatted Floppy disks contained pre-installed viruses, so this is nothing new, the media is just larger.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Am I missing something here? One of the links to the Taipei Times quotes a spokesman from Seagate saying "Yes, the drive is formatted, but I have never heard of a virus that lives in the master boot record." Wow, that's reassuring.
... please.
Damn, I already moderated this topic. Now I'll have to log in with my sock puppet to comment.
So I guess Thailand must be a new province of China.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
To the person that posted the story ...
Thailand and Taiwan are two distinctly different countries. Taiwan is the country that is a part of China, Thailand is not. I think you meant to state "HDs made in Taiwan".
Just a clarification.
Eric Buckley http://www.scgdomains.com
[Troll]
That's the problem with Windows. It doesn't Just Work(tm). You have to know these cryptic menus to edit databases just to keep your new USB drive from running whatever application happens to be on it. Maybe one day Microsoft could start doing some real usability testing and get Windows to be as easy for a new user as Linux.
[/Troll]
Agreed.
A horse can't be sick, you know, even if he wants to.
...Ahy wait a minute...that's ME you're pointing all that traffic at!!!
Wait, you meant a good purpose...in that case, no, there isn't any.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Somehow, I think alot of manufacturing that's been moved over to China is about to be brought back home. As I indicated the other day in my post here, over-reliance on China is less of an economic issue and more one of national security.
Lead in toys is bad, but the fact that this is happening indicates how little control we have over stuff manufactured over there. Intentional? Perhaps, but if so, it's quite stupid on the part of the Chinese. They should continue to produce quality crap for rock-bottom prices so that we trust their stuff, rather than the state of near-paranoia we're in now. Their goods are scrutinized more than ever, and the rapidly falling dollar means that we are becoming more and more competitive on the open marketplace internationally.
Really, the problem here is that the United States has bought the "free trade" Kool-aide, but the Chinese haven't - and have locked their currency to ours. As long as this is the case, we're really dealing with an unleveled playing field.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
A harddrive that after being inserted automatically asks users to install Linux to save self from these kinds of security risks.
You've no idea how many people I run across that "go to the disk and run setup" is too complex for. Also, back when it was added (Windows 95) this kind of stuff wasn't a concern. However they've changed it with Vista. There is still autorun functionality, but you have to enable it. By default it asks what you want to do, and does not run anything.
didn't work.
2 good examples is that Xerox made special copiers that were sold to USSR. They would break down after a certain time, and require a service call. Turned out that the copier was holding a copy in memory of all that it saw and the service guy was off-loading it, and resetting it. Likewise, America made special chips that went into pipeline controller chips that were sold to USSR and caused a major problem with their pipeline.
The truth is, that that this code almost certainly went in with knowledge by the Chinese gov. They are simply using OUR AMERICAN hardware to spy on the west. Smart move on their part, bad for the west.
I prefer the "u" in honour as it seems to be missing these days.
According to Donald Kerr, a deputy director of national intelligence, "There is something fundamentally different from the government having information about you than private parties. We shouldn't have to give people the choice between taking advantage of modern communication tools and sacrificing their privacy."
autorun.inf and ghost.pif, yeah, right. Who still uses windows, AND has autorun enabled?
Answer : Everyone. Even geeks give up configuring Windows to that point after one hundred reinstalls. Or they give up on Windows already... Okay, "who does not reformat new HDs before use?"
Who buys Maxtor HDs anyway? Never had one that even lasted till the end of warranty, used 8 of those in under two years. And there are not enough hours in one year to make up for the order of magnitude between announced and effective MTBF. (168*52 = way less than "tens of thousands of hours".)
Not that I excuse them for dataraping their customers. The exec that ordered that should be put to a very slow and painful death. With the Maxtor engineering team. (If there even IS one.)
Making laws based on opinions that stem up from false informations leads to witch hunts.
> It's a windows GUI tool.
Not for XP Home or other crippled MS products...
MSS: (NoDriveTypeAutoRun) Disable Autorun for all drives (recommended) DWORD 0xFF
from http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch10n.mspx
and http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch03.mspx
just FYI
I think many folks in Taiwan would have an issue with this statement.
A quick history lesson. The aborignal people of taiwan are actually connected to the other oceania aborignes (e.g. native of the other islands like the philippines, malaysia, and indonesia). The mainland Ming and Qing dynasties (pre-cursors to modern china) never really considered the island as part of their "middle kingdom".
Meanwhile, the Dutch that colonized the island which they called Formosa (which is now Taiwan) to use as their base to trade with Japan. This was managed by the Dutch East India Company (Spain briefly tried to hone in on the island, but were driven out by the Dutch).
Eventually, the conflicts that led to the formation of modern china, spilled over to the island. Koxinga, a Ming dynasty warlord/general/rebel (born in japan to a mother who was japanese and a Ming dynasty general) overthrew the dutch on Formosa to establish a base for Ming dynasty rebels that wanted to re-take over the Qing dynasty. This event has historically been cited by the chinese as their historic claim over the island, but it seems no more valid than the Dutch claim which is basically moot (since as we know possesion is more than 9/10 of international law).
Of course the Japanese eventually defeated the Chinese in the Sino-Japanese war and the Qing ceded Taiwan to Japan as part of the Treaty of Shimonoseki. Japan basically occupied Taiwan until the end of WWII.
During the resolution of WWII and the Japanese surrender, basically, Japan was forced to give up all the territories that it gained all the way back from the end of WWI from the Republic of China which included the island of Formosa. The decision of who the territories should fall to were left up for the final Treaty of Peace with Japan which left the decision to the winners of WWII in the Pacific (basically the US, the UK and Soviet Union and the ROC).
Of course after WWII, this was all complicated as the Republic of China which was generally considered the KMT government at the time was overthrown by the People's Republic of China (Mao, etc) and the KMT government retreated and occupied Taiwan for many years claiming that they were still the KMT/ROC. That and the beginnings of the cold war power struggles led to the controversial Treaty of San Francisco which officially ended WWII in the pacific required that Japan cede Taiwan to one of the "winners" which due to a complicated set of circumstances, the ROC or the PRC were never specified (since they weren't invited to be part of the treaty because of the civil war at the time there was no agreement on who the government was).
In fact with some stretching, it's possible to conclude that the Treaty of San Francisco actually leaves Taiwan as an occupied territory of the United States (sort of like berlin was occupied by 4 powers at the end of the war in europe).
So it's actually debatable that Taiwan is even a country and if it is, if it is actually part of China or an independent country in it's own right...
This silly problem only affects windoze lusers. What a surprise.
That link was tops!
I once bought a computer with Linux preinstalled.
Condoms make excellent tile covers.
Engineering is the art of compromise.
Japan is not trying to destroy the west, since they are basically part of the west. China, OTH, is waiting patiently for their tech to come close to ours.
Windows knows better than you do what should be done with a new drive. And if it doesn't, that's your tough schist. After all, you're not foolish enough to believe you actually own your computer once you've put Windows on it and connected to the Wild Wild Web? Your friendly global software megalomaniac "owns" it, and some pimply-faced teenager from East Slobodnia pwns it. Don't like that? Use another system....
seriously - autorun (for ANY media - optical or other) should be one of those times when Windows puts up a dialog saying "I'm about to run the autostart program from this drive you just connected. Yes/No/Format?" Any "security" system worth its weight in used toilet paper should do that for you.
There was a point in history when the US of A did overflights of russia for 'recon' with the bombers, the same aircraft that would fly over russia in the outbreak of a war were send on 'recon' missions. Talk about bloody insane, what if a russian commander had taken it for an assault? How is he supposed to know what is in the bomb bay.
Countries pull these stunts to see how far they can go, compared to sending nuclear bombers on recon flights this one is harmless, but it does tell the chinese a lot about the west. We need their stuff, we cannot stop it, we cannot say, no more HD's not made in the west.
The US learned that the USSR at the time had no way to stop these aircraft (one of the reasons russia became so obsessed with interception tech was these flights, every US aircraft shotdown over vietnam with SAM's was the result of these probe missions, remember that incident where russia showdown a korean airliner? The US had a very long history of probing soviet airspace with civilian aircraft, that time some innocents learned just how far the US could go.). China has learned just what they can pull.
After all what is the US going to do, the western economy needs China, it would require a massive change of police to do anything about this. So China now knows that they can get away with it. Even if the chinese goverment did not do it, they still know this.
It seems a simple test to see just how deeply the western economy now depends on chinese products.
frankly I think it is far simpler, someone paid someone to put this on, and someone did. All these lead paint stories are nothing more then someone trying to increase his income. Ages ago I worked in a warehouse for glasses (sunglasses and regular frames), these things cost nothing but sell for a small fortune. Every now and then a small truck would arrive and load things, nothing abnormal except that the guy never bothered with a loading bill. The deal was simple, orders were frequently wrong, so with some carefull mis-management there was always surplus stock, this guy could sell those goods, all you had to do was make sure that whenhe arrived they were close enough by the door. In exachange, you would get a bonus, you didn't ask where it came from and they didn't tell you.
Apparently head office got a bit suspicious after a while and ordered a complete inventory count, the week before that we had a burglary. We didn't know what had been stolen, but luckily we had that inventory check coming up, so we would be able to tell the police then.
The "burglary" was almost idiotic, the way they entered they would have had to been acrobats to get anything out, they had forced open a door that had been blocked off by a shelving unit. They would have had to wriggle under the door, climb over the shelving, climb down and do that several times to get anything. All under the eyes of camera's. Can you say 'setup'?
But hey, it paid badly and the 'bonus' easily was half my salary, while to me the risk was at most undeclared income. Same I think here, someone offered some guy at the 'install crap software on the HD' department to install a little bit extra, and they took it.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Part of the problem is that 'Quality' is synonymous with 'all the right paperwork in place' and not with the actual 'quality' of the product. Without going down the slippery path of trying to objectively define quality in a way that works (see 'Zen and the Art of Motor Cycle Maintenance' to see how stuffed up you can get trying to sort that out), there has to be some kind of adaptation of ISO Quality Certifications that includes the product and not just the process and procedures.
This works perfectly, with just one small problem...
All burn software I've used so far (Sonic, Nero, Isoburn) will NOT recognize a multi session DVD as having data on it if you've disabled autorun in this manner.
It cost me a lot of headaches to finally find out what was going on, since the DVDs were all reported as 'unformatted, empty' (depending on whether it was a R or RW), but not actually writable (however it was formattable if it was an RW)
So there's some underlying logic there which probably disables the preread necessary for multisession discs (I'm assuming this would work the same for CDs, although I haven't tried that)
This is my personal experience and my inquest into why this happened, so YMMV. Win XP Home SP 2.
Coz eternity my friend, is a long *ing time.
"the trojans are for the hard dicks" got a little misunderstood down the assembly line?
If it had simple been a MBR type virus, that could have snuck on board during the process that formats the drives. This is how other infections have taken place, the machine that produced the finished image is infected and so the image gets infected.
If it had been a virus in one of the apps that come with some external drives, that could have gone a similar route.
But how the hell does one accidently come up with a virus/trojan/malware that accidently happens to be exactly what you need to infect a clean HD? If you read the description this piece of malware was designed to be used in this manner, it is not just a random infection.
I did spot one error in the story, that could be attributed to idiot journalists, about the claim the 500gb maxtor disks are typically used by goverments to store databases and such. Yeah, right. Store critical databases on a maxtor disk? Then the story goes on to contradict itself by claiming the disks were sold via stores, goverments do NOT hop to the closest store for their hardware. The disks in questions are cheapo consumer models, not destined for places like goverment at all.
It seems an odd case, but frankly I seen odder cases, perhaps it was just an attempt by someone to see if they could, or maybe it was test run. I don't really think it was a secret chinese job, unless they simply wanted to see if it was possible. The reason it uploaded to a chinese site is most likely simply that it is simple to host a site there.
Wasn't there a story about the RBN moving to china?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Comment removed based on user account deletion
Comment removed based on user account deletion
rol of the internet to countries like china?
how long before "they" start adding stuff like this malware at the microcode level? could this even be happening now? i mean how long were those little yellow dots being printed by thousands of printers before it was discovered?
Marcin
What if Chinese Govermment is really behind this? Let's play a little mind game..
You put in some malware to spy on your own citizens. You want total control, and you are getting good funding by the goverment and you have silent acceptance from the big manufacturers. Just another trick to add more level of control to already complex scheme they have in China.
Now, let's think that some guy made a mistake. No, he didn't put the spycrap there by mistake. It was there because Chinese Goverment wanted it there. His mistake was simple, he shipped the hard drives to abroad. Those hard drives were for domestic sale in China.
So my theory is, that like google is forced to limit search results in China, hard drive manufacturers are forced to put in this crap. When it accidentally ends up somewhere else than China, it is downplaying time. Or just stay quiet. You can always blame some virus writers and hackers for it, right?
Maybe he's not the fugly bastard mutant looking freak you are. Ever thought of that? No, probably not. When you eventually figure out that people who are attractive have every right to be proud of themselves, whereas you do not apparently because you are some reject, then you might have made a true discovery for yourself.
DBAN any new drive. Problem solved.
by wiping the drive? Think again. All these drives have embedded firmware. It would be real easy for a motivated entity to put malware in the drive firmware in such a way that it would be almost undetectable and un-eraseable. Maybe this is the Chinese Government's payback for the backdoors Embedded in Microsofts Windows by the US Government.
ghost.pif virus was rampant, at least in China, in May and June. Maybe it's "Made in China", such as Red Code is "Made in US". So the hard drive data is sent to Beijing website.
The chance is that the Chinese Contractor, if it exists, has virus infected, so when it is processing the HDs, the HDs got infected.
First of all, Windows sucks.
Second of all, some people is not professional when processing the HDs.
Sig only.
Virii is not a word.
occultae nullus est respectus musicae - originally a Greek proverb
"seriously - autorun (for ANY media - optical or other) should be one of those times when Windows puts up a dialog saying "I'm about to run the autostart program from this drive you just connected. Yes/No/Format?" Any "security" system worth its weight in used toilet paper should do that for you.
Windows does this already. The first time you connect a drive or insert a CD/DVD, Windows first tries to determine the type of media (pictures, videos, data files, etc.) and presents a prompt asking you what you would like to do - Play the movie, open the pictures in preview, launch your mp3 player, etc. - and the users are the one who decides what Windows does. There is also a checkbox for "Always take this action" with that type of media, and as long as you don't check this (or, select "Always prompt me" and select "Always do this") Windows will not automatically do anything.
"But this one goes to 11!"
This story reminded me that I need to buy condoms. Thanks, Slashdot!
seriously - autorun (for ANY media - optical or other) should be one of those times when Windows puts up a dialog saying "I'm about to run the autostart program from this drive you just connected. Yes/No/Format?" Any "security" system worth its weight in used toilet paper should do that for you.
I'd rather see Windows put up a dialog saying "I'm about to run the autostart program from this drive you just connected, and it's infected with a virus. There's nothing you can do to stop me! Hahaha!!! Sucker! Should have bought the Windows Vista Super-Mega-Ultimate Edition instead of being cheap and getting the basic version!"
This was over 5 years ago. Web pages were downloading SLOWWWWLLLY with this router. I looked into it, and discovered that the throughput was normal, but the latency was horrendous. Furthermore, it was only the DNS that had high latency. No matter what settings I put in, the thing was trying to route all of my DNS requests to a some machine that I tracerouted to China. Someone trying to set up man-in-the-middle attacks, maybe?
People can stop buying goods made in China. You can also go to http://www.petitiononline.com/Taiwan/petition.html and sign the petition to have the U.S. government officially recognize Taiwan.
So what does the data from the virus look like? If somebody can post it I can probably whip up some happy little javascripts and perl scripts to send them all kinds of fun data.
"Hey, there is that pesky 127.0.0.1 again.
He is attacking again! The last time I sent him a ping of death my computer crashed!
Ill just..."
This one is for real! (I kid you not) Reminds me of an old Mad Joke:
"When I woke up, I saw 10 eyes starin at me, so I emptyed my gun, and when I woke up in the morin, I only had my pinkie toes left."
"The tainted portable hard disc uploads any information saved on the computer automatically and without the owner's knowledge to www.nice8.org and www.we168.org, the bureau said."
How realistic is this.. really? They must have some serious bandwidth to be receiving Terrabytes of information from around the world to one single IP.
Besides, if this was really happening on a grand scale, wouldn't internet traffic spike more dramatically than any botnet sending simple emails?
Mod parent up. I was just going to post the same fact - Vista will actually ask you what you want to do, and to my knowledge it has not once run anything without my explicitly requesting it do so.
:)
Me and my 3.8ghz Q6600 system is quite liking Vista.
ISO certified == THX certified
If the malware is on a sector of the disk normally skipped during ordinary reformatting, then a reformat might not get it.
Also, who says this is the Chinese government trying to collect intel on other governments? It could just be some officials somewhere looking for ways to clean out other people's bank accounts. Or a test run for future acts of IT warfare. What better way to demoralize citizens of your enemy's country than to suck their bank accounts dry? What a burden that would place on your enemy's resources!
My vote goes for the crooks in the cogs of a bureaucracy using a clever way to get rich while using their government agency to mask their nefarious ways.