CSIRTUK advisories

ID: 3623
Date: 30/05/2008

---

Title: 3623 - Malware Installed on Removable Media
Platform level affected:Operating System
Hardware components affected:Other
Specific operating systems components affected: Other
Net-enabled software: Other
Security software:Other
Other software: Other
Remediation Summary:Special Event. Be on your guard at this time.
Adversity source: Unknown
Attack Vector: Malware
Virulence: Unknown
Warning Status: Active
Potential Damage: Unknown
Possible Duration: Open Ended
Availability of fix: Future
Type of fix: None
Source: CSIRTUK
Abstract: CSIRTUK have been made aware of an increase in malware (often referred to as computer virus) pre-installed on peripherals and removable media. This advisory raises awareness of the growing threat.

 

Peripherals and External Media

 

There have recently been reports of devices purchased from high street retailers infected with malware; CSIRTUK therefore recommends exercising caution when connecting peripherals and/or installing removable media to a computer.  The reported devices are believed to have become infected with malware during the manufacturing process and there is no evidence of a targeted attack.  The more likely cause of contamination is opportunist hackers and poor housekeeping by the manufacturers concerned.

 

Risk

 

Whenever peripherals are connected and/or removable media is installed in to a computer it is possible that malware, if stored on that media, could execute and infect the host computer.  A malware infection can manifest itself as data theft, denial of service, keyboard logger installation etc.

 

Affected Products

 

Peripherals and removable media (for the purpose of this advisory) can take many forms and include, but is not limited to:

 

CD-Rom (and variants CD-RW etc.)

USB Memory

Digital Cameras

Memory Cards (SD, MMC, xD etc.)

DVD-Rom (and variants DVD-RAM etc.)

Portable Media Players (Audio and Video)

External Hard Disk Drives

Mobile Phones

All devices with flash memory

Digital Photo Frames

 

All products, including vendor sealed new products, should be treated with caution.

 

Mitigation

 

All peripherals and removable media, whether purchased from a reputable retailer or supplied by a trusted source, should as a matter of course be interrogated for the presence of malware.  Consideration should also be given as to whether the "AutoRun" (also known as AutoPlay) feature needs to be enabled in an Operating System.  Restricting the administrative privileges of user accounts can also help reduce the risks of malware infection.

 

Individuals and organisations are advised to deploy and update Anti Virus and Firewall applications as well as installing all security patches issued by vendors.  Operating System vendor websites should be consulted for further information on user accounts and how to disable the "AutoRun" feature.

This advisory contains information released by the original author. Some of the information may have changed since it was released. If the issue affects you, it may be prudent to retrieve the advisory from the site of the original source to ensure that you receive the most current information concerning that problem. Reference to any specific commercial product, process, or service by trade name, trademark manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI.

The views and opinions of authors expressed within this notice shall not be used for advertising or product endorsement purposes. CPNI shall not accept responsibility for any errors or omissions contained within this advisory. In particular, they shall not be liable for any loss or damage whatsoever, arising from or in connection with the usage of information contained within this advisory.

CSIRTUK is a member of the Forum of Incident Response and Security Teams (FIRST) and has contacts with other international Incident Response Teams (IRTs) in order to foster cooperation and coordination in incident prevention, to prompt rapid reaction to incidents, and to promote information sharing amongst its members and the community at large.