Slashdot Mirror
Malware Distribution Through Physical Media a Growing Concern
twitter brings us a story about the increasing number of digital devices reaching consumers with malware already installed. In this case, digital photo frames from three different Sam's Club stores were found to contain the same type of malicious code. We discussed a similar problem with iPods a while back, as well as a more recent situation with Maxtor hard drives. Quoting the Register:
"While a compromise at the manufacturer is the most likely scenario, ISC's Sachs also pointed to retailers as a possible point of infection. Returned products, which could have been infected by the consumer, are frequently put back on the shelf, if they are in sale-able condition, and attackers could take advantage of a store's poor digital hygiene, he said. 'Trying to (infect a product) all the way back at the factory — getting it through all the checks and balances — would be pretty hard to do,' he said. 'But doing it at the store, where there might be loose return policies, and (where) they put it back on the shelf - you are not going to get a million infections, but you might get a person from an investment bank next door.'"
and it wants its headline back.
(yes I know this is a different story than back then, but it's the same headline)
I bet that most people would have NO idea that this could possibly happen.
These days, it's really only a problem if you use Windows. Those of us using Linux, *BSD, Solaris, Mac OS X, and other non-Windows operating systems have little to worry about.
Now, someday this may start to affect other, non-Windows operating systems. But in many ways I don't think it will be as much of an issue, because many of the alternative OSes have a far more sensible security model than that of Windows. So what easily causes problems with Windows has little to no effect on Solaris, Linux or OpenBSD.
Trying to (infect a product) all the way back at the factory - getting it through all the checks and balances
... well. This whole scenario is hardly surprising.
Apparently this guy has never worked in a production firmware environment before: there are fewer checks and balances than you might think, especially because embedded-system guys generally don't have much awareness of Windows malware issues. Unfortunately, more and more embedded devices are being plugged into desktop machines, and with auto-run enabled
The higher the technology, the sharper that two-edged sword.
I've always said that autoexecuting stuff on any media inserted was the stupidest feature ever created. It's just asking for viruses to be installed. Actually strike that. It's the second stupidest thing. The stupidest thing is Windows being configured by default to restart for updates after the user doesn't respond for some very short amount of time.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
"Digital Photo Frames" is a polite term for "Pornograph". The whole point of these devices os to view the pr0n on your USB key - why else would you want one?
Sent from my ASR33 using ASCII
I'd seriously doubt that malware distributors would focus on returned products as a vector for infection. The value of a pwned PC is simply too low to justify the labor of buying a product, infecting it, and returning it in hopes that it will infect another machine.
Rather, I suspect infection at or near the source -- slipping malware into the firmware or shipped software that goes with the device. At that point in the software delivery chain, a single act of infection can be distributed to tens or hundreds of thousands of machines. I could also imagine targeting highly promiscuous machines (e.g. WiFi routers) that have a high chance of being in contact with other promiscuous machines (i.e. other routers or laptops).
Although I'm sure some people get their grins by infecting one machine at time, the malware industry is more about collecting the largest quantity of machines at the lowest possible cost.
Two wrongs don't make a right, but three lefts do.
It's really amazing that people can get infected by a returned item... do they still ship drivers in floppy disks? Everything is in read-only media these days, except for media itself (i.e. a "new" hard disk). So people buy a drive, it has a file and run it?
As usual, it's a matter of user education.
The cases mentioned were just the accidents. What about deliberate malware installations, such as those done by Sony and Sears?
It is dangerous to be right when the government is wrong.
I bought a new 80386 (maybe a 486 - I forget) motherboard a long time ago and it had a 5 1/4 floppy disk included with the board drivers software. It was also infected with the Michaelangelo virus. I never knew it until I saw a message on the FIDOnet BBS from some idiot in Bulgaria talking about how his virus was coming and it was going to kill everyone's computers.
I downloaded a free copy of McAffee and it found the virus on my computer as well as every floppy that I had inserted since then that wasn't write protected. McAfee's software offered to clean it but all it did was wipe out the MBR making it where I had to reformat and reinstall everything.
I told a friend at school who had just bought a similar motherboard. He broke the seal on his driver disk, scanned it, and found the virus there too. It was coming from the factory infected.
That was a lesson I will never forget and it happened almost 20 years ago.
My ism, it's full of beliefs.
"Trying to (infect a product) all the way back at the factory - getting it through all the checks and balances -- would be pretty hard to do"
No, it isn't anymore. Somebody in marketing had the bright (read: revenue-producing) idea of loading up a new storage device (which should be blank, damnit) with a bunch of advertising crap. Combine this with Windows' oh-so-helpful autolaunch features. Frankly I'm surprised it took this long to become a problem.
I long for the days when you could buy an UNFORMATTED device. The OS would tell you it's unformatted, so you formatted it. Done.
The pervasiveness of the malware problem contributes to this
Our shop had one shrink wrapped package that had malware included and when this was tracked down the vendor didn't know they had become infected and were distributing shrink-wrapped malware
this underscores the importance of putting a stop to malware
the fundamental error is at the concept level: it is wrong to think it is OK to run your programs on someone else' computer without their knowledge or permission
to invert this properly back to the other end of the pole it is wrong to think that a computer should run anything and everything that anyone sends to it which is what is going on with the promiscuous Ms Window
and so this is a concept that has to change
programming changes have to be proper documented, authenticated and approved before they are applied. and this should apply to everything from cell phones to computers
ya think ya wanna argue with this? don't bother: the security mess we got on our hands say all that needs to be said. the concept of promiscuous remote updates has caused nothing but trouble. It's a concept that is a disaster and that has to be corrected, PDQ
NO SIGNATURE? NO EXECUTE.has been distributing malware over physical media for years, in the form of floppy disks and CDs that install the AOL "service" on your computer... and through our own postal service, no less!
My Pet's first year birthday?
Nice try; according to TFA, Digital Photo Frames are small flat-panel displays for displaying digital images. TFA didn't specify, but it was implied that they were sold by mainstream retailers.
I bought a digital photo frame from Microcenter that was infected. I can't recall what the specific trojan was, but it was fairly benign in so far as it just replicated itself. As I recall it was a fairly old trojan and not very sophisticated... but none the less, it was on the brand new frame that was still sealed in the original factory stuff.
I told Microcenter about it and they were like "Huh." Didn't ask anything more, nor did they remove the frames or check them. I was somewhat pressed for time, so I didn't try going up the chain of management to get someone to acknowledge that there was a problem.
It's a good thing I found it though, since it was a gift for my technologicallly illiterate parents. I had taken it out of the package to load pictures up on it. If I had just given it to them directly, I'm not sure what would have happened. AVG caught it when it was plugged in via USB, so probably nothing drastic, except a phone call from my Dad asking me what the pop-up box meant.
Digital devices reaching consumers with malware already installed?
Computers have been shipping with Microsoft products preinstalled for some time, I believe.
I work in manufacturing in China, and I would not be surprised in the least to find a worker who accepted a shockingly small bribe to place malware directly into factory produced firmware. Not saying that's what happened, but I sure wouldn't be surprised if it did. I also would not be surprised to discover that a worker's Windows PC transferred its infection to the master used for production.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Once upon a time I managed a software product testing team. Part of our standard flow for all release candidate CD's was to get fresh signatures and virus scan as both step one and also with refreshed signatures as the last step (2 or 3 weeks later) of declaring a release candidate ready for release. We *still* shipped a CD with malware once, a virus that was too new to show up in the signature files from the scanning software company. Lukily, it was a beta that went to less than 100 customers, and it was a relatively benign Word macro virus. Still, I had to explain to a Vice President how we did virus scanning for releases.
As a result of this, we started using virus scanners from three different manufacturers. As a software vendor, the risk of shipping a nasty virus to your best customers is very real, no matter how hard you try to prevent it.
Sophia, Bulgaria was the home of the Dark Avenger one of the most notorious virus authors in history. He was quite active during the 80386/80486 time period. Some interesting reading about what is known of him can be found in these links: http://en.wikipedia.org/wiki/Dark_Avenger http://www.research.ibm.com/antivirus/SciPapers/Gordon/Avenger.html http://www.wired.com/wired/archive/5.11/heartof.html http://findarticles.com/p/articles/mi_m1511/is_n2_v14/ai_13381563/pg_9
-- I'd give my right arm to be ambidextrous
It's branded as an eMotion device (model DF-EM7), but it looks identical to the ADS product.
My question - because here at /., I'm not all that relatively geeky - is how would this spread? It accepts photos direct from the computer via a USB 2.0 cable or via memory card. Assuming I'm not stupid enough to plug the thing directly into my computer, am I safe? Will the trojan infect the memory card for subsequent infection of my hard drive (of my Windows machines, not my Mac, right?)?
Also, is there a way for me to use my Mac to explore the contents of the frame to look for the malware? What would it look like if I can? Is there any way to detect whether or not I have an infected frame?
"Even for Slashdot, that was a very obscure reference!" - Anonymous Coward
I almost got some malware from autorun off a thumb drive, fortunately the anti-virus recognized it and stopped it from running. When that happened, I looked for a surefire way to turn off autorun (and autoplay) but all I found was a bunch of registry edits that may or may not (according to different accounts) turn off autorun/autoplay. Why is there no global option in a Windows control panel for that?
Something like this came up before: http://hardware.slashdot.org/article.pl?sid=07/11/11/2246246
Motherboards are mostly made in various Asian countries now, aren't they? How paranoid is it to imagine the Chinese deciding to infect motherboards with spyware?
Lest you think I've got my tinfoil hat on, check out some thoughts of Ken Thompson (which I found in the discussion from the "Trojan Found In New HDs" link I provided, at least I think that's where I got it from.) http://cm.bell-labs.com/who/ken/trust.html
In theory, theory and practice are the same; in practice they're different. (Yogi Berra & A. Einstein)
It's like a saying I have heard - buyer beware; Now even more so, for purchased media products. It would pay for the buyer to scan for virus and malware that may be present
All ipods install Quicktime on your computer, and quicktime is DEFINITELY malware. Apple should be ashamed.
1) Right before the equipment is put in the box it should have its memory reset to factory condition AND have the firmware compared to what it should be.
This will offer some protection against factory sabatoge.
2) Any time a unit is returned it should be reset to factory condition.
This will take care of shoppers who buy, infect, and return merchandise.
The device should have a "firmware freshness" indicator that says this is the 1st, 2nd, or 3rd or more boot since a factory reset. When you buy the product it should be at the 1st or, if the store checked after resetting, 2nd boot. If it's more than that when you unbox it you should reset it before using or take it back for an exchange or refund.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
1) Right before the equipment is put in the box it should have its memory reset to factory condition AND have the firmware compared to what it should be.
This will offer some protection against factory sabatoge.
No it won't - if the "factory sabotage" consisted of (deliberately or accidentally) having malware as part of "what [the firmware] should be".
2) Any time a unit is returned it should be reset to factory condition.
This will take care of shoppers who buy, infect, and return merchandise.
And how is a reailer supposed to do this? Do you know of ANY product that comes with a (true) "reflash to factory status" utility that doesn't depend on what's in the device itself - let alone a cross-industry standard for this? (And you can't trust the media returned with the device, either. If it's writable it also needs "resetting" - and if it's read-only it needs replacing with a fresh copy.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
YUP! They're sold by Wal-Mart, Target, Meijer, Circuit City, Best Buy, etc.
Incidentally, Target sends ALL of their electronic devices back to the factory, just in case. CD players, iPods, USB drives, PS2 controllers. Everything.
Bought a Westinghouse 8" frame from a local retailer, Canada Computers.
... as soon as I plugged it in, NAV went nuts reporting two different trojans installed on two different .EXE files.
When I got it home I plugged it in in order to "preload" it with photos as a gift for somebody
I contacted both Canada Computers and Westinghouse about it, but both seemed more concerned with fingerpointing and denial than actually addressing the fact I'd just bought a frame from them with fucking viruses preinstalled.
And if we needed evidence of early forms of physical media malware spread, we need not look any further than Windows ME. Surely it qualifies as malware!
Bearded Dragon
Erm - a single script file can easily update thousands of different configuration files on any platform. And for all the world-famous Windows user-friendlyness, I'll take editing some bizarre Linux scripts where key=value over trying to remember hexadecimal codes for Internet Explorer registry entries :-)
Lets not overlook the dangers of having a single, unrebuildable registry for all the system settings... What happens when it gets hosed? I seem to remember that Windows 95 used to keep two copies of the registry around and could rebuild it if you deleted it. Windows XP seems to have lost that ability - I have no idea if Vista has recovered it.
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
There was a time when blank meant unformatted. A preformatted disk isn't blank - it contains formatting information (and a partition table if it is a hard drive). And a boot sector. Companies started providing preformatted disks because of the brain dead way MS operating systems format disks.
Verifying media...
Partition Whole Drive? (Y/N) Y
Verifying media...
Format Drive? (Y/N) Y
Verifying media...
The best part is - he actually tried it. And it got out. Someone else at the lab (who didn't know) distributed his hacked binary to some UNIX customers.
And somebody modded you Insightful? Or did you mod yourself? Hmmm...
I've seen some pharmacy and Kodak branded photo CDs do some nasty stuff to registrys relating to CD/DVD burners. That counts as malware, doesn't it? If anyone knows of a fix, it'd be appreciated.
If you use Linux, it means nothing to you (unless you run WINE or a Windows virtual machine). I always wipe the HDs I use. And I only buy media devices that I know will work with Linux.
--
Linux on the desktop has been a reality for me since 1997
-"...bad old ideas look confusingly fresh when they are packaged as technology" - Jaron Lanier (Digital Maoism on Edge.o
Returned a mouse back in sept/oct to a store and went back there for the first time about a week ago. Said mouse was sitting back on the shelf with the other opened one which was there at the time I purchased mine. Not hard to believe that hd's and other infectable devices would return to the marketplace.
> HOW TO SECURE Windows 2000/XP/Server 2003 & even VISTA + make it "fun" to do:
:)
> http://www.security-forums.com/viewtopic.php?t=50567&sid=c8b24a76a3974ec9bef2bed38c4b64d4 [security-forums.com]
> * Windows CAN be secured very well, with a bit of effort, for years of security, even online,
> for years into the distance if you try what's in that URL above!
There are linux distros with shorter install documentation than that. Wouldn't it be better to use an operating system that did *NOT*, by default, autoexecute autorun files on every Sony CD and every USB key and every external USB drive and every USB digital picture frame immediately upon connection???
And while we're at it, why is it that...
- in linux, I set up USB mass storage drivers *ONCE* in the kernel, and all USB keys and external drives just work, whereas
- in Windows, every USB key from every different manufacturer requires me to download and install a driver from the internet in order to access the USB key???
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
That's just your experience. In mine, it's not always true.
I once bought a USB card reader. Worked with Windows, but only when you install some drivers. Later I tried to use it with my Debian installation -- no such luck. So I bought another card reader of which it was known it could support Linux, and guess what, no drivers needed for either Linux or Windows.
Yea, I was wondering myself... I thought he was just "trying to be funny" but, somehow? I think the guy actually MEANT what he satd here above... someone's been misnforming him, & badly, imo @ least!
APK
"There are linux distros with shorter install documentation than that" - by knorthern knight (513660) on Monday January 14, @01:42AM (#22031884) AND, if you look on that page? I posted LINUX scores (albeit, running under VMWare, which some folks say makes you LESS secure (BSD man Theo DeRaadt iirc in fact, pretty respectable in this field despite his having a temper, & even Bruce Schneier said "justified anger has its place" mind you, in regard to Mr. D's temper which many felt was "righteous indignation" rather than tantrums)...
The scores are by default, around the 46.xxx mark (same as Windows XP really, almost to the decimal point)...
----
"Wouldn't it be better to use an operating system that did *NOT*, by default, autoexecute autorun files on every Sony CD and every USB key and every external USB drive and every USB digital picture frame immediately upon connection???" - ----
"And while we're at it, why is it that...
- in linux, I set up USB mass storage drivers *ONCE* in the kernel, and all USB keys and external drives just work, whereas
- in Windows, every USB key from every different manufacturer requires me to download and install a driver from the internet in order to access the USB key???" - That's odd, I don't see that here @ home on Windows Server 2003 SP 2 (my home rig) & XP SP #2 (my work rig) & with several diff. ones tried in BOTH over time in fact!
(Same with the ones my colleagues use, & I have plugged theirs into my XP work rig too & they are DIFF. than my own (one of those TITANIUM jobbies is what my colleagues like vs. mine (PNY & some other type from some other generic OEM))
So, my turn:
Why does Linux have so much less software (for various purposes) than Windows does, & support less peripherals for purpose than Windows does?
I'll tell you why, in a nutshell - MONEY TALK$!
Sure - The infamous "they" say, "talk's cheap", but... not when money does the talking.
Money gets highly skilled developers working, under the "harsh taskmaster's whip", of mgt. in a software publishing house, & that of VENTURE CAPITALISTS investing in said projects...
Thus, since Windows IS THE MOST USED? It gets the MOST development & support for the MOST peripherals, simply because of the economic incentive for developers to bulid on it & for companies to invest in, because the market surface area is larger than any other platform out there.
(FOSS is nice, don't get me wrong - but, I'd wager Win32/64 IS where the monetary reward is, & THAT, feeds your family!)
APK
P.S.=> USB peripheral support is NOT a "strong area" for LINUX!
(& certainly NOT by comparison to the support for it which Windows gets for drivers & specifically for the USB peripherals out there today))
Proof of that statement (somewhat, we can debate specifics if you like, later)?
Well, GOOGLE this:
"USB" and "Linux problem"
apk
It was about four years ago but we received an infected build from a major hardware manufacturer.
We bought several hundred computers and provided the laptop image to the manufacturer after we'd installed our standard suite of applications. The major hardware manufacturer certified the build and started imaging machines - we had about a hundred of them in house before the first ones got stood up and tripped virus scanners as soon as they were powered up.
The image we sent the manufacturer was virus-free but the preloaded machines we received with that image were not. Major hardware manufacturer had to do a fair bit of tapdancing and machine-replacing to make things right.
we see things not as as they are, but as we are.
-- anais nin
Because of piracy, burning, and file-sharing we're now have to jump through hoops to exchange/return defective CDs/games/movies (and in some cases even sealed media we flat out don't want)
I imagine if stories like this start hitting the mainstream we won't be able to return ANY sort of electronic/computerized device. And gee, Sam's Club and "loose return policies" in the same sentence? Go figure.
If a customer brings back an opened device, policy should be to send it back to the manufacturer. That nips that in a hurry.
While autorun is quite obviously profoundly dumb, it's also possible to create devices which do not use autorun feature and also exploit the OS directly over USB. I've discussed this a bit in my section on the "attack surface", currently here:
http://www.subspacefield.org/security/security_concepts.html#tth_sEc4.1
I'm going to incorporate these Microsoft vulnerabilities (centered around autorun) as well, to single it out...
Here's Bruce Schneier's article on a similar incident:
http://www.schneier.com/blog/archives/2006/06/hacking_compute.html
Not quite,
;)
These are photo display devices you can buy at your favorite retailer to load a memory card or usb device to display your digital pictures on.
I'm sure you could peruse your pr0n collection on one, but don't take it to work
Jeruvy