Slashdot Mirror
State Governments Warned of Malware-Laden CD Sent Via Snail Mail From China (krebsonsecurity.com)
Security reporter Brian Krebs writes: Several U.S. state and local government agencies have reported receiving strange letters via snail mail that include malware-laden compact discs (CDs) apparently sent from China, KrebsOnSecurity has learned. This particular ruse, while crude and simplistic, preys on the curiosity of recipients who may be enticed into popping the CD into a computer. According to a non-public alert shared with state and local government agencies by the Multi-State Information Sharing and Analysis Center (MS-ISAC), the scam arrives in a Chinese postmarked envelope and includes a "confusingly worded typed letter with occasional Chinese characters."
I would have to schlep upstairs to the only computer I have that has a CD drive.
What's worse is that it's running windows, so it would be pwned instantly.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Sounds like one.
Did the CD say "AOL" on it?
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
in both the title and summary.
Too many people have caught on to dropping infected USB drives in parking lots? https://www.schneier.com/blog/...
Can't we just say they were from Russia?
You create a VM in Virtual Box or KVM, you install Windows on it and open the disk in the VM on Linux, now you're fine. It's not hard to get around something this simplistic.
Man finds CD. Asks a random person. "What is this?". "It's a CD.", they reply. "What do I do with it?" "You Play it." "With What?" "A CD Player"
4 hours later, man arrives at Best Buy and asks geek squad where he can purchase a CD player. He leaves with a $1500 laptop and an external drive.
3 hours later he manages to boot into Windows 10. He places the CD into the drive as instructed. After 4 more hours he is able to get into File Explorer. He clicks on all the files but keeps getting errors. Realizing something was wrong, he calls the help line. The number was included in the readme.txt.
The support technician spoke English, but had a heavy accent. It was a back and forth process but after about 3 and a half weeks they had everything squared away. When the updated CD arrived to his house, they remoted into his computer and installed it for him just to make sure there were no hiccups.
The man came away refreshed. He would definitely do business with them again. In fact, he was so satisfied with the experience he shared the CD with everyone he met (but never used the laptop again).
The green classification of this means it wasn't supposed to be shared on publicly accessible channels. Whoever shared this, wasn't following the guidelines.
Does anything good come from China? (Besides some products that are made there under the supervision of western managers.)
In other news.....
Governement agencies in 2018 still haven't managed to roll out a "Disable Autoplay" policy. Meanwhile the public remained motionless, sound asleep.
I once bought a Chinese USB drive which contained a virus. It was new and unpacked, from transend or some other brand, rubber case. Found it after manual mounting under Linux.