Slashdot Mirror
HP Admits Selling Infected Flash-Floppy Drives
bergkamp writes "Hewlett-Packard has been selling USB-based hybrid flash-floppy drives that were pre-infected with malware, the company said last week in a security bulletin.
Dubbed "HP USB Floppy Drive Key," the device is a combination flash drive and compact floppy drive, and is designed to work with various models of HP's ProLiant Server line. HP sells two versions of the drive, one with 256MB of flash capacity, the other with 1GB of storage space.
A security analyst with the SANS Institute's Internet Storm Center (ISC) suspects that the infection originated at the factory, and was meant to target ProLiant servers. "I think it's naive to assume that these are not targeted attacks," said John Bambenek, who is also a researcher at the University of Illinois.
Both versions of the flash-floppy drive, confirmed HP in an April 3 advisory, may come with a pair of worms, although the company offered few details. It did not, for instance, say how many of the drives were infected, where in the supply chain the infections occurred or even when they were discovered."
The main purpose for having floppies in servers is because Windows requires them to install mass storage drivers during installation on hardware such as RAID arrays and SATA drives
Starbucks, Harbuckle of Breath.
Although still in a woeful overall state, Vista has one critical security difference from XP that helps here. By default in XP the device will autorun. By default in Vista it will ask you if you would like to autorun. So in Vista you can plug a new device when it asks you to autorun say No and then format the sucker. This default is something Microsoft should seriously back-port to XP.
Shh.
The speculation that it was deliberate activity does strike me a little strange:
If you are going to get your malcode onto this, why do something old and crufty when you could do something new.
IIRC, this is used for BIOS updating as well as windows driver schlepping. So why use old-n-crufty known malcode when you could get a clean rootkit (no existing signature) and install it that way.
Test your net with Netalyzr
I do not understand it. Do these USB drives are meant to come with software? I believe they are just formated. If such is the case, then they should use some non Windows machines such as Linux to format them with Windows filesystems. I fail to grasp how on a factory floor where drives only need to be formated, worms have an actual chance to jump on the drives. This can only happen if they are using web connected and unsecured Windows machines to format them.
Remember the year 2000? They promised us flying cars. They delivered the PT Cruiser...
Here's the HP HP security notice. This was discovered in January/February, according to HP, but not announced by them until April.
Where's the recall notice? HP should be recalling these items. Failure to do so immediately is willful negligence.
Here are the part numbers:
They're still for sale on Amazon, for example.
In a situation like this, HP should recall the product and reissue a replacement product with a new part number to distinguish old product from new product.
The malware has not necessary infected the factory. The flash disks probably comes with some software tools, and it might be these tools which got infected.
Could also have been a disgruntled worker.
What stops those who were able to put viruses in USB sticks from installing viruses in BIOSes directly in the factory?
I'm one of those people who doesn't really belong on slashdot due to my outrageously inadequate computer skills. I just appreciate the actually intelligent discussion devoid of complete morons that I couldn't find anywhere else. But question for the people who do belong here: how is deliberately infecting your own products even close to a good idea? I can't imagine this is going to get half the press it deserves, but if this somehow got out past computernerdland (no offense meant), wouldn't that turn millions of people off of buying HP? I feel like I'm missing something here.
Neither articles indicate that HP is planning on making changes at the factory floor level to prevent further infection. If their only response is to scan and clean it myself, then I might be motivated as a consumer to purchase my flash drives with a big "Gauranteed Fully Formatted" on the box. Plus, this seems REALLY sloppy to me. If HP is allowing this type of software to slip into flash drives, what other types of defects, errors, and all around laziness is going on with other products?
Made in China?
If you haven't made a developer cry, you've wasted a day.
Flash floppies that are pre-infected. That's just gross.
was developed in HP-China.
Has anyone seen a single thumbdrive that includes Flash storage and a Bluetooth antenna, all in one little (and hopefully cheap) device? Perfect would be a Bluetooth dongle with an SDIO, MemoryStick, or CompactFlash slot for detachable memory, but just some permanently bundled Flash on the Bluetooth would be good.
--
make install -not war
HP's recall supply chain will dump the recalled product to shady asset recovery firms and it will just end up on Ebay and not destroyed.
(Where do you think recalled Dell batteries went?)
Anonymous for a reason.
An intersesting things about this is that HP ships diagnostics CDs with their Proliants (PSP "Proliant Support Pack"). The offline hardware diagnostics CD can provide a lot of data, which needs to be provided to HP to get support (sometimes). The diagnostics software has the option to write the data to a USB device. I've tried 3 different types of USB drives and none of them were recognized by the software... I was told by HP support that the USB floppy drive that they provide would work.
Fortunately, we bitched enough to get better support and we don't run Windows so wouldn't be vulnerable to this particular problem.
I bring this up because there may be a number of people out there with Proliants who aquired these drives so that they can get data from HP diagnostics software
From the advisory:
If the optional HP USB Floppy Drive Key has been used in an environment without current (up-to-date) anti-virus software then the W32.Fakerecy or W32.SillyFDC virus may have spread to any mapped drives on the server. In this case HP recommends that the server and mapped drives are scanned with current (up-to-date) anti-virus software.Does HP actually think that a potentially worm-infected server should be a/v scanned and (possibly) cleaned, and that's the end of it? That's beyond dumb; any production server so exposed requires a bare-metal rebuild. In the absence of a tripwire-esque delta, you have no understanding of the state of the server installation after undergoing an infect/clean cycle, and there's no way that box should be left in production in that state.
[17] Leary, T., White, C., Wood, P. R., Bhabha, W. D., and Wirth, N. Lambda calculus considered harmful. In Proceedings
This doesn't surprise me. HP is also partnered with a company called Presto that says in a radio ad that computers are "Expensive (and) hard to use".
But it is not without precedent. I have heard of device driver floppies and CDs shipping with viruses and the like in the past... as long ago as 10 or more years in fact. The sad thing isn't that it happens. The sad thing is how telling it is of their product QA standards.
They should have clean and isolated systems in place for development and manufacture that isn't connected to the public internet in any way. Furthermore, anything that reaches the public should first be inspected through tight QA standards. The public expects that of high profile manufacturers... worse, the public presumes high QA standards.
This takes me back to a point I was attempting to make in another discussion about the differences that often exist between public expectations and what a company actually delivers. Often times the public never notices the difference, but some times, those differences slap people in the face rather rudely at inopportune times.
I'm not sure when it started to become more common practice to move away from fulfilling public consumer expectations occurred. But the public consumer isn't aware that this shift has occurred yet. But evidence of the quiet shift has been placed in every EULA as far back as anyone can remember that contains disclaimers that their product is suitable for any purpose at all. The laws of some countries and states of the U.S. do not permit the enforcement of some of these disclaimers, but it never stops them from trying to put it past the consumer just the same. But the ugly reality is that 'legal standards' trump quality standards every day that appears on the calendar.
How did they not catch this? Surely every 1000 of these, they pull one off the line and plug it into a computer to check that it actually works, right? Or every 10,000? Don't manufacturers do any kind of continuous QA of the actual product?
Wouldn't an alert from a virus scanner make someone think "that's not right..."?
So basically they didn't bother sparing 5 minutes once a day or week to check one of these things? Nice.
Stop the Slashdot Effect! Don't read the articles!
What is notably left out is: Who made them and in what country? What are normal HP quality controls? What is HP planning on changing to prevent this in the future?
China?
Perhaps it's a test run.
Not, of course, that that in any way absolves MS -- it's still shocking that floppies were sometimes needed for a server OS released a mere half decade ago! Although at least you could always install remotely over a network using RIS or WDS and avoid the issue entirely, which is I suppose what most enterprises probably do anyway.
What's purple and commutes? An Abelian grape.
Possibly; the big 3 do deliver support tools on customer facing media. I would gander the following guess: This is what you funk-tards get for outsourcing; keep it in house OR keep the Quality control persons on YOUR payroll. That way you can fire them when things run afoul. (Soapbox mode OFF)
... I'll have a Pan Galactic Gargle Blaster with a side of Plutonium Nyborg
Its simple , the infection happened when they outsourced to China to build the flash drives, and do not have a quality control set in the middle as it arrives into our country without delivering directly to store warehouses...problem and i speak from experience with the textiles importing industry based out of china, is that when you have no quality control in place to review this stuff, such as a drive verificator that you would plug all drives into before sending out, and letting that be in the hands of the Chinese, who are at the root of the cyber attack problem against the states right now, is that they could be putting anything on those drives and we don't check...
http://www.acronymfinder.com/af-query.asp?acronym=SANS
System Administration, Networking, and Security Institute (SANS)
Institute's Internet Storm Center (ISC)
http://isc.sans.org/diary.html?storyid=4247
http://www.acronymfinder.com/af-query.asp?Acronym=SAN&Find=find&string=exact
Storage Area Network (SAN)
http://en.wikipedia.org/wiki/SanDisk
SanDisk Corporation
http://japanese.about.com/blqow38.htm
from AnonymousCoward-san
http://babelfish.altavista.com/
sans acronymes le monde serait un meilleur endroit
I see a story about Hannaford Bros (supermarket chain in the Northeast U.S.) servers being pwned, sending credit card numbers all over. And they passed PCI, seeming to be secure enough for the card industry. Darn, pwnage is so sucky, especially when your SERVERS are compromised.
Now I see this story about HP accidentally selling branded keys with worms pre-installed. Darn, selling malware is so sucky, especially when you sell it to your favorite customers, for example server customers.
Any chance not just Hannaford, but other HP customers are nailed by this?
The takeaway from this episode, for those of you who aren't quite getting this:
- When you buy a USB key, be sure your machine(s) have functional antivirus and antispyware running,and it's updated.
- Look around for instructions on keeping stuff like USB keys from autorunning. Make it so.
- Format that rascal USB key immediately. Immediately. IMMEDIATELY.
- Don't buy USB keys cause they have cool software preloaded. Pointless to CHOOSE to risk infection. make the manufacturers pay for this by avoiding/refusing this crap. Just sell me a simple key, ok? Sheesh...
And trust no one and no thing.
Amazing, is all I can say. And yes, I wonder if these were manufactured and loaded in China. Bet they are.
We are in so much trouble. Mark my words, soon, 'Made in China' will really mean 'Pwned by China'. If ti doesn't already.
deleting the extra space after periods so i can stay relevant, yeah.
"This can only happen if they are using web connected and unsecured Windows machines to format them."
...so the ultimate fault is with capitalism :)
This shows a large degree of naivety to the issues.
The source of infection could equally be a rooted 'nix box or any other platform which had become compromised - even any other box anywhere in the organisation and then poor practice allowing it to compromise a machine in the factory not even connected to a network...although admittedly, such a multiplatform worm would be unlikely, but not impossible.
There is certainly no reason for an assumption that a 'nix box rather than any other platform would have prevented the problem - in fact a non-Windows box may have been _more_ insecure as all too many people falsly assume 'nix to be inherently "secure" and so take inadequte steps to remain (relatively) secure.
Good QC processes could have prevented this (say a separate scan/checksum process in a separate area of the factory to minimise the risk of an insider being able to compromise both stages), including physical security of the items following validation (tamper 'proof' seals etc as with food products/blister packs for medication)
- but these would add to manufacturing costs and would usually be unappreciated by consumers and so are inherently uncompetative practices.
See Honey, it's HP's fault that porn was on our computer! All 3 terrabytes of it...nasty bugs. *whistles innocently*
All you have to do is throw in the human element. The first factory worker that plugs his ipod or flash drive full of music into the computer he is using to test/verify/format these devices you are finished.
I've worked as a technician in an electronics manufacturer, the human element is a huge one to contend with.
What kind of idiot runs a workstation OS on a SERVER? Last time I looked, proper server operating systems didn't "autorun" things, especially w32 executables!
Most likely some employee was using the work equipment for his/her own project and accidentally infected the system. Deliberately targeted does seem unlikely.
Intron: the portion of DNA which expresses nothing useful.
Anyone who has ever installed an HP scanner or All-in-one knows that the consumerware/bloatware that HP deliberately installs is truly awful. The print monitor behaves strangely, faceless apps hang and get respawned without the existing processes being killed, all kinds of crap is installed that is difficult to remove, and et cetera. If you don't seek out and install the thin "enterprise driver," and find alternative helper apps, you wind up with all this junk.
So I don't see what the big deal with shipping some more malware is. It's HP. *shrug*
You're welcome, please leave a donation in the tip jar on your way out.
we will end no whine before its time
Product link
[AC while at work]
From the summary:
"I think it's naive to assume that these are not targeted attacks," said John Bambenek, who is also a researcher at the University of IllinoisI think it's also pretty naïve to assume that it is a targeted attack, as such an assumption shifts the blame enormously. While a targeted attack is arguably more dangerous and more worrisome for a certain group of people, such an attack could happen at any number of stages of fabrication, so the fabrication process itself isn't to blame. Reversely, if a random infection makes it to a device sold as a server accessory, that puts both fabrication and quality assurance at fault, the former allowing the infection, the latter for not detecting it. If that's what happens to enterprise products, one has to wonder how much crud gets through in consumer stuff.
After digging into what happened it was found that the duplication house where our disks were being duplicated had a QC station where each one was tested to verify a good recording. The operator of that station faced a brain-numbing job; insert disk, hit enter, remove disk, repeat. Of course, that job was filled by the production manager's son - who filled in his free minutes by playing a "free" copy of a game that he got from "someone" on the QC machine.
We had to recall all the packages and ship free disinfecting software to everyone who had bought one; fun times. The duplication house (grudgingly) paid the cost of cleaning up the mess, then we found a different duplication house to use in the future. This time we checked their procedures out a little more closely before signing up.
Something like this is probably what happened to HP. The factory where those drives were made had some worms / viruses loose on their network and when the new drives were plugged in for testing / formatting the malware automatically copied itself over. This would happen after the format / test was complete; the operator wouldn't even know it happened.
Sloppy security practices at the factory was most likely the "source" of the problem. They weren't evil, just stupid. But for HP to know about this and wait for 3 months before letting their customers know - that's criminal. At least it should be...
I'm not trying to diminish HP's responsibility for this mess, but if any server admin admitted that they had picked up one of these worms from any other vector, the commenters here would have spitted and roasted said admin for gross incompetence. Any systems vulnerable to this crap are likely to have much bigger problems in store.
You should use the Driver Packs on your XP Disk
http://driverpacks.net/DriverPacks/
Unattended Windows 2k3 installs with slipstreamed drivers (from DVD) and/or Windows Deployment Services.
I've never seen a "welcome to such and such" screen in over a year
----