Slashdot Mirror
Photo Kiosks Infecting Customers' USB Devices
The Risky Biz blog brings news that Big W, a subsidiary of Woolworths, has Windows-based Fuji photo kiosks in at least some of its stores that don't run antivirus software, and are therefore spreading infections, such as Trojan-Poison-36, via customers' USB storage devices. Here is the account of the original reporter. "It's not just the lack of AV that's the problem... it appears there's been zero thought put into the problem of malware spreading via these kiosks. Why not just treat customers' USB devices as read-only? Why allow the kiosks to write to them at all? It would be interesting to find out which company — Fuji, Big W, or even some other third party — is responsible for the maintenance of the machines. It would also be interesting to find out if there are any liability issues here for Big W in light of its boneheaded lack of security planning."
I would guess Fuji is responsible for these machines. I work for Target, and ALL equipment, kiosks included, in our Kodak labs are serviced by Kodak field techs.
Incidentally, we are allowed to connect guests' media to the kiosks ONLY, never directly to any other lab workstation, because the kiosks are (or at least are supposed to be) far better locked down, including treating all media as read-only.
"Customers USB Devices Infecting Photo Kiosks".
And what makes you think that the Kiosk software can read a NTFS USB drive ?
While I cannot speak for the specific types of machines mentioned in the article, I DO know that a lot of the local machines over here are using some funky Linux flavor (presumably to keep costs down), running off flash ROM. And they generally expect you to deliver the data in a FAT32 partition if you provide a USB drive.
Then again, if the software is Linux, Then there usually isn't that much of a problem with viruses hopping from one device to the next, I'd wager.
--- To err is human... Am I more human than most ?
I used to work on similar kiosks a few years back, those also had no AV, but usually that wasn't a problem.
They ran a hardened win2k, no network services, autorun disabled, afair execution for all drives but C: disabled.
So how the f* would they get infected in the first place?
Lazy techs, at least that was the #1 cause for troubles for back then, everything from re-enabling services to installing 3rd party RA software with no/weak passwords...
The kiosk situation is generally lousy.
Do they keep a copy of all my pics?
They make a copy (they have to, to display thumbnails), but is it temporary or permanent ("To improve the quality of our service...").
There should be a law prohibiting the keeping of copies without express permission, and they shouldn't be allowed to make unrelated functionality dependent on the user agreeing to let them keep a copy.
Copyright law might work here, but I imagine the kiosk companies have found a way around that. Maybe there's a "Terms of user" stick on the back of the machine mentioning that they keep copies, etc.
Expert in software patents or patent law? Contribute to the ESP wiki!
Why run windows on these kiosks? An embedded OS would be more suitable and cheaper...
Why execute anything thats stored on the usb sticks? That's just colossally stupid, i could understand if some malware was getting onto the devices by exploiting a bug in the jpeg parser or similar, but executing any code on an inserted device is just ridiculous.
Why is the inserted media not mounted read only? These kiosks only need to print photos, they don't need to write to the media.
Why is the system drive writable?
Why is the kiosk software running as a privileged user?
The idea of installing antivirus on them is a stupid one, it will increase the cost, require the kiosks to be updated somehow (either necessitating frequent engineer visits or require a network connection), and no antivirus detects everything (i often do incident response when a customer system has been compromised, in every single case there has been some kind of av product installed and it failed to detect the compromise even tho in most cases the malware installed is well known to other av products).
Also an av product may detect a false positive on a customer's media device and delete their data which could open the kiosk vendor up to potential liability.
Instead, run an embedded linux on these systems...
the frontend software is custom written anyway so could just be written for linux instead without too much difficulty..
less to go wrong since such an os could be stripped to its bare minimum
less cost - there would be no per unit licensing costs..
mount any customer supplied media readonly and noexec.
boot the os from readonly flash so the os cannot be tampered with and any problems a reboot will restore it to default/clean settings
use ram for temporary storage (or a small disk which is reformatted at boot if more storage is required) so after a power cycle, anything left on there is gone
if any persistent storage is required (eg for logs) use a remote syslog server, a receipt printer, or a small disk mounted noexec
use something like an internal readonly compact flash card for the os, when an engineer has to upgrade all he needs to is swap the card out.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Blame Microsoft...
There are plenty of open royalty free filesystems out there, but MS refuse to implement them and want you to pay royalties to use their own filesystems instead, so people use fat32 because its the least patented of the few filesystems MS do bother to support.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
No, they don't teach that any longer. I was up on my soap box on the issue and the general response was "but that just introduces bloat!" and was modded troll. I seriously couldn't believe what I was seeing. The fundamentals have been forgotten or ignored lately. It explains a lot. These same people were telling me that "regex" is better than the primitive methods I described for input validation -- the primitive methods I described were to be simple, compact and likely in assembler. I was like "what do you think a "regex" does? Magic? It does the very same thing I described but in a higher-level language. These people all believe in the magical black box.