Slashdot Mirror
25% of Worms Spread Via USB
An anonymous reader writes "In 2010, 25 percent of new worms have been specifically designed to spread through USB storage devices connected to computers, according to PandaLabs. This distribution technique is highly effective. With survey responses from more than 10,470 companies across 20 countries, it was revealed that approximately 48 percent of SMBs (with up to 1,000 computers) admit to having been infected by some type of malware over the last year. As further proof, 27 percent confirmed that the source of the infection was a USB device connected to a computer."
Since pretty much everything is connected with USB these days, is this any kind of surprise? Were there any worms spread using a serial port?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Hm, software vendors put enormous effort into preventing attacks over the Internet. Did anyone really think that virus writers were not going to find new attack vectors?
Palm trees and 8
Only 25%?
"No matter how cynical you get, it is impossible to keep up." -- Lily Tomlin
someone should teach people to wash their hands properly before handling them IMHO.
It's only going to surprise people who thought nobody would be stupid enough to enable autorun by default in a consumer OS.
No sig today...
The basic technique used is as follows: Windows uses the Autorun.inf file on these drives or devices to know which action to take whenever they are connected to a computer. This file, which is on the root directory of the device, offers the option to automatically run part of the content on the device when it connects to a computer.
By modifying Autorun.inf with specific commands, cyber-crooks can enable malware stored on the USB drive to run automatically when the device connects to a computer, thus immediately infecting the computer in question.
I just did a little googling, and it appears you can easily shut it off.
From CNET:
Why does MS insist on lax security? Autorun should be off by default, not on. This is just plain stupid. It's not a bug, it's a design error. CNET adds that if you're running XP, TweakUI will work.
And, it looks to me like TFA is a slashvertisement. Its bottom line:
At least it's free.
Free Martian Whores!
Trojan Hacker edition significantly lowers the chance of UTD's (usb transmitted diseases)
Windows has always refused to autorun USB devices for me. CDs I had to stab it repeatedly in the face to get left alone, but USB drives I put considerable effort into and all I got was this stupid pop-up dialog "WHAT DO YOU WANT TO DO? VIEW PICTURES?"
Support my political activism on Patreon.
That is why I spray all of my USB ports with VOTiVO.
Autorun is ridiculous. It's about as smart as automatically eating any medication you come across.
captcha: automata
First thing I do with any USB ...
Create a directory called "autorun.inf", then attrib +R +S +H +A on it.
I've found this pretty effective, as unless the virus is running with admin privileges, it can't overwrite the directory with a file of the same name.
Also, it's easy to detect if you *do* later contract a virus, as you can verify if the autorun.inf is a directory or a file from DOS before clicking on the options popup.
15 years ago it was floppies. I worked then at a Government installation that was found to be massively infected - by floppies. Same vector, different medium.
Seriously, why are people so silly to leave this on.
In my company so many PC were infected this way, with folks passing around USB keys. I think I was the only one who had autorun off and scanned every time anything USB is plugged in.
Hell, we even infected our customers because of that crap.
My former company banned both. When you inserted a floppy, the computer refused to read it. And when a USB was inserted, security showed up to scan your PC.
It was also impossible to install any software, unless it was a simple *.exe program that sat on your desktop. Anything as elaborate as firefox was impossible to install.
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
This is a perfect example:
http://www.youtube.com/watch?v=MgS5I0mWCrQ
My wife was using her laptop in the library once, and a guy came up to her and asked if he could test his USB drive in her computer. She got a weird vibe from him, so she said no. He got insistent, and she still said no. Instead of asking anyone else, or using the library's computers, he left. I've always figured he was trying to do something nefarious.
Way back in the day it was infected floppy disks. Given people now use USB drives like we used to use floppy disks, it only makes sense that malware would (once again) use them as a distribution method.
Wasn't Michelangelo (sp?) transmitted via infected floppy disks back in the late '80s/early '90s? SneakerNet will never really die. The media just changes.
CUR ALLOC 20195.....5804M
Autorun is completely evil. You're an idiot if you don't disable it as soon as you unbox your computer. That is all.
I agree with this 100%, the amount of times I plug my USB Stick into my Linux box and have the virus scan freak out is amazing. Then again it's always nice to know that my usb is effecting me.
If you're running Windows 7 it appears that you're ok. But what took MS so long to fix this gaping hole?
Free Martian Whores!
There are still a few USB drives out there with hardware write protect switches, but they're hard to find and you'll probably have to order online. I have what may at this point be the best listing available at http://www.fencepost.net/2010/03/usb-flash-drives-with-hardware-write-protection/, culled from a variety of searches, message boards, and one German computer magazine (c't) which has its own listing.
In the US, the most likely drives to find in stores if you're looking are a couple of Imation models (Pivot and Clip), plus lingering supplies of the older Swivel models (the swivel isn't all that sturdy, pockets will beat it up over time). I've not seen these widely in stores, but you may find the Clip in college bookstores - I suspect that's their target for the style.
fencepost
just a little off
If you get it from the store, and its in a blister pack, they're pretty much guaranteed to be secure.
/* MAGIC THEATRE
ENTRANCE NOT FOR EVERYBODY
MADMEN ONLY */
I seem to recall being able to insert a floppy disk, type "dir a:", and get a virus under MS DOS. You probably don't need autorun turned on to get infected.
Off the top of my head, a buffer overflow in the code that reads and displays embedded icons would be a juicy target, along with the file system parsing code.
-Mysteryvortex
Like the parent said. Remember in the old days, you'd have instructions like "Insert disk, click start->run, type "D:\setup.exe", press enter". Anyone who had more than one cd-rom drive or hd would have to work out for themselves what drive letter they should type -- that's assuming they even knew what a drive letter was!
25%? Seems kind of low, for a type of social engineering "exploit", the ubiquity of USB devices, ease of use vs security conundrum, etc. Now tell us the source of the malware on the device, and then we might have a story - from the factory, favorite uncle's p0rn server, etc.
It also means 75% of worms are spread via other means.
So what's the real story??
Suppose something was written to spread via both the Internet and USB autorun? The more vectors, the stronger it would be.
We don't need yet another new programming language. Let's just pick an existing language and fix its flaws.
47.8% of all statistics are made up on the spot!
I once heard that the easiest way to conduct industrial espionage was to make a virus that would make a back door to the security systems, load it onto a USB thumb drive, casually walk to the outside smoking area of the company building you wish to infect, have a smoke, covertly drop the USB thumb drive somewhere in the area. For extra points, take a generic thumb drive and put the company logo on the side for authenticity. 10$ says some idiot will pick it up and plug it into his system when he gets back to his office to see what is on it, or who it might belong to. Bypassing all firewalls and security (at least initially).
Now remotely connect to your hearts content and start downloading.
Autorun is one of Microsoft's more frustrating contributions to the world.
But what is still more idiotic, is how user-unfriendly the path is to shutting it off. Microsoft's very own page on the issue...
http://support.microsoft.com/kb/967715
-FL
... had already died from a Concrete Donkey.
My own experience with USB viruses was pretty thankfully not horrible, but annoying and disheartening. I brought a USB key full of pictures to a local store to have them printed, and when I got back home and put the stick in I was infected. Nothing serious, and easily detected and cleaned, but still annoying. I called the store to let them know, and asked to speak to someone in IT. After I while I talked briefly to a tech, let him know what I experienced, and suggested they turn autorun off, as it wasn't necessary. Shame on me, because two weeks later I went to print more pictures from USB, and yet again my key was infected. This time I had turn off autorun for USB (different and harder to turn off than for CD I found) and found the infection before it spread to my desktop. No I have what another user suggested in a directory named autorun.inf with all the flags on (system file, read-only, etc). Works for me. What I wondered about at the time is what one can do when you know of a virus vector, have informed that infected party, and they take no steps to prevent it. Are there places out there where knowing you have a virus, know you're spreading it, and don't do anything is illegal?
It's 25 percent of new Windows worms. Approximately 48 percent of Windows SMBs (with up to 1,000 computers) admit to having been infected by some type of malware over the last year. Linux and MacOS SMBs are still save and will be save.
I would say Dell was right:
"6) Ubuntu is safer than Microsoft Windows: The vast majority of viruses and spyware written by hackers are not designed to target and attack Linux." from http://www.theregister.co.uk/2010/06/14/dell_ubuntu_windows_security/
http://www.mueller-public.de - My site http://www.anr-institute.com/ - Advanced Natural Research Institute
Still allergic to identifying Windows malware as Windows malware, I see. It's not "computers" that are affected, it's "Windows computers."
I shouldn't be plugging the dog or the cat into the USB port.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Actually that's evidence, not proof.
SMBs? Huh? Does that even make sense?
Why doesn't the gene pool have a life guard?
How is this "news for nerds"? Do real nerds still run Windows?
I don't read your sig. Why are you reading mine?
Having been badly hit with a worm we did hire a security consultant, and the thing that was tickling me is how comes the worm wasn t hit by on access scan. His response was that as we were infected by a usb key (we re sure of this), there s something specific about usb which makes it so that on it the on access scan won t work, or at least wont work in time, if there s autorun on a computer the worm can be run, go to memory (it bypassed oas), steal some credentials, spread via network, save itself on computer drives with your credentials so it can survive a reboot. From there attach itself to critical windows services that can t be unloaded, attach itself to antiviruses so they don t see it. Spread some more.....
Certainly auto run is an issue here, but the bigger issue that typically these drives may have installation files and write access.
Unlike program files or the various write protected folders on Linux these guys will be wide open.
If I've already gotten malware on your box and I see a nice little fully writeable USB key or external drive I'm going to look for an .exe or other executable to infect. Hell maybe even write a .JPEG, .PDF, .SWF, or any other non exe that could have an attack depending on what box it gets plugged into and loaded up.
If I find it I can just write into her like back in the day. Unlike floppies there isn't some kind of boot sector generally.
Floppies where about either getting your snippet of code into a .exe or onto the boot sector. Then praying the user left the disk in ( or forcing a restart while it was still in ). If you got into an .exe hoping the user gave it to a friend who used it.
Also, are these worms? Sounds more like your traditional STD type virus versus air born.
So even with Macs you could write out an HTML file with a known attack for Safari and see if they give it to a friend. Ultimately OSs need some sort of virus software to at least detect weird behavior like this.
Horsesh*t. I do PM / UX at a website whose users are SMBs. Most of my life is spent talking to SMB owners: interviewing them, usability testing with them, dealing with customer support issues, etc. While these people are, in general, certainly not dumb, most of them (1) have a limited idea of how to use their computers (they're too busy and they often outsource IT functions, even if only to the Geek Squad) (2) have a limited understanding of what 'malware' is (3) would have no way of knowing that the malware came from a USB device and were probably just making that up (4) were probably using sketchy cheap malware-infested software they downloaded from the internet rather than paying for a reliable package since they tend to be very cost-conscious and (5) were probably trying to explain why there's all that pr0n stashed on their hard drives.
In other words, self-reporting by "SMBs" (owners? IT people? who?) about malware incidents in the past year is likely a complete line of bull poo concocted by a PR firm trying to be a "thought leader" and getting people to their blog post / website (our firm does this, although we at least make them be reasonably methodologically rigorous).
My company has also conducted surveys of SMBs, both for UX / Product reasons and PR "thought leader" reasons. You can buy a DB / mailing list of vetted business owner / mananger / C-level email addresses for conducting research like this. That list can in fact include owners / managers / IT people at what you think of when someone says "SMB" i.e. a small business with a few employees up to I think 1,000 employees. That list could also include a whole bunch of sole proprietors of companies like "Angela's Passion Parties" or "JayBob's Babysitting and Handywork". We don't know anything about who responded to this survey or whether they were actually the people who had to deal with the problem.
USB autoplay is hugely helpful for a great many people. Don't be so credulous of this story and start attacking what has been a great advancement in personal computing that's saved a lot of normal people a lot of frustration with their peripherals.
Move along, nothing to see here.
25% eh. Sounds like bullshit to me. Ought to sound like bullshit to you too. Think about it a minute. What this is is another press release trying to get a company's name in the press. Shame on /.ters for believing such nonsense.
I think I'll put something like "FORMAT C: /X /Y" in an autorun.inf file of all my removable devices. That'll learn 'em!
--Udo.
Microsoft isn't a nobody and they enabled autopwn, I mean autorun by default.
Realize the 25% number is the number of viruses. It does not necessarily mean that 25% of worm infections are caused via USB.
Currently hooked on AMP
..and here I thought they just liked the taste of my corn, squash and tomatoes..learn new stuff ever' day.... /me heads to the farm n feed for USB spray.....
what about USB keyboards? as more systems drop ps2 you will need to have usb ports.
Many of the USB devices ARRIVE infected. So, if Intel were to re-open the plant in Colorado Springs, have it do USB flash drives, and then sell them to the DOD and most groups in the gov. as well as in EU, with all bits accounted for. It would be a bit more expensive, BUT it is an opportunity to re-create manufacturing in the USA/West while securing the computers.
I prefer the "u" in honour as it seems to be missing these days.
One thing I noticed when visiting a large European organisation for the first time over 15 years ago was that the Windows PC on the most critical network did have floppy drives but with a special lump of plastic locked in so that the casual user could not insert a floppy but tech. support could.
The same place now has standard Windows PCs with USB ports but they not physically disabled.
the stores don't own / do tech work on the Photo kiosks it's out side independent contractors / sub contractors.
This is a Windows-only problem. Solution here.
Import the following to registry:
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:blahenterrandomlettershere"
It will cause windows to ignore anything inside autorun.inf by replacing the content with non-existing entry ie. null.
Delete this branch from registry:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
It will wipe away any cached mountpoints and their autorun information.
Disclaimer: This will disable the USB autorun related vector for malicious code as well as any other mounted media or network resource. 'Autoplay' and all its features will still function the way you set them. This fix will break anything that depends on code inside autorun.inf ie. say goodbye to nice 'automatic installation', drive media renaming or placing nice icons to itself etc. Mostly useless stuff. Some special usb-sticks with software features built on autorun might not work anymore. Sad.
www.tribalnetworks.org - helping tribal people around the world to own their own means of high-tech communications
Wow. The instructions for disabling Autorun are hideous: http://support.microsoft.com/kb/967715. Is this really how one disables it?
This one looks slightly less hideous: http://www.us-cert.gov/cas/techalerts/TA09-020A.html.
I apologize in advance for the noob question.
"Crude and slow, clansman. Your attack was no better than that of a clumsy child."