August 26, 2008
In This Issue
Tech Talk

The Rise of Digital Storage Malware

During the holiday season of 2007, there were many reports of consumers purchasing various digital portable devices such as MP3 players, USB Thumb drives, memory cards and digital photo frames that came prepackaged with extra presents that no one put on their holiday wish list. As many users plugged these brand-new devices into their home and work computers; unbeknownst to them, some were silently installing particularly nasty rootkits and other pieces of malware that compromised their machines.

By early 2008, the amount of infections escalated as well as the range and sources of these infected devices. Eventually this resulted in several companies pulling products off the shelves and offering a recall on the devices in order to protect their customers.

The exact source of the malware infection was never revealed to the public in any of the cases. Vendors merely cited that their products became “contaminated during the manufacturing process”. This vague statement leaves plenty for the imagination as to how these devices became infected. Consider the following chart which illustrates a typical manufacturing process:



The embedded malware can literally be inserted at any point during this process. Take into consideration any of the following scenarios:

1. A malicious company decides to embed the malware during the product design and development level and is programmed directly into the software install process of the device. Since the entire company is corrupt the Quality Assurance of the product is completely dismissed and the company sells the trojanized product on the internet or to various resellers. As the products begin infecting users, the company disappears and sells the locations of the infected machines to other malicious users.

2. A malicious internal employee working in the QA process or in the packaging stage decides to infect several products after they are scanned. They switch out clean devices with infected devices and the products are shipped out and eventually arrive on store shelves.

3. A customer buys a product and intentionally/accidentally infects the device via their home or work computer. Dissatisfied with the product in one shape or form, the customer returns the product complete with packaging back to the store. The retail store decides to sell the product for a discount (such as an open-box-deal), and a new customer purchases the infected device.

4. A reseller purchases bulk unsold devices from another company and decides to rebrand the item. These devices are (accidentally) infected by an internal machine during the reimaging of the installation software and this slips by the QA process. These infected products are resold on the market and in turn infect customers.

Although these scenarios represent only a few possibilities on how these devices were infected, the real situation is that this problem is not going away. Recently it appears these attacks are back on the rise, with digital photo frames and memory sticks being reportedly infected once again. As the holiday season gets closer and closer, consumers, suppliers and IT administrators should likely prepare for these types of attacks. Consider the following mitigation and threat assessments for your home or company:

As a consumer:

How often do you purchase PC peripherals that connect to your home or work computer? – This includes any of the following devices: USB thumb or jump drives, Cell phones, Memory cards or sticks, Web cameras, handheld video game units, digital photo devices, GPS units, USB powered cubical toys, USB or firewire wireless adaptors, MP3 or portable media players. The more of these items you purchase the more likely you will encounter an infected device. Keep in mind these devices were purchased from a wide range of vendors and retailers, including very popular and trusted brands.

Does the connecting computer have an updated peripheral-scanning Anti-Virus Software? – Virus scanners are the first perimeter of defense for most users, and many of them support scanning devices as they are plugged in automatically. If you are unsure that your AV software supports these features, consult your product documentation and confirm you are up to date with the latest signature definitions and updates.

Does your computer have Autoplay and Autorun.INF features disabled? – Most malware taking advantage of hitching rides with PC peripherals are attempting to exploit Autoplay or Autorun features within Microsoft Windows. These functions can be disabled through the use of tools or registry modifications and reduce the risk of malicious software automatically compromising your machine.

As an IT Administrator, in addition to the above strategies:

How are you securing USB devices? – Do you regulate what users can or cannot connect to their machines using 3rd party software? You can disable USB devices via group policies or you can use 3rd party software like MyUSBOnly or Sanctuary Device Control in order to allow only certain USB devices to be connected. This will force USB devices to be brought to you for inspection prior to having users install them. This ultimately will allow you to scan them before malware can slip onto your network.

Manufacturers and Retail Businesses:

Is it time to revaluate your Product Return and QA Policies? - Are returned products currently being wiped clean and scanned for virus prior to resale? This should be performed on every device that can store data in order to protect your past and future customers. Also ensure that your Anti-Virus Software is fully updated when you are scanning these devices during QA procedures.

By following the above strategies users and administrators alike will be able to successfully identify and mitigate potentially harmful scenarios that could be introduced by these portable malware devices. Implementing these strategies sooner will also help ease users into becoming more aware of these threats and adapting to heightened security policies in time to be safe for the holiday season of 2008.

Source: Greg Linares, Research Engineer

News & Articles
The following articles represent the opinions of their respective authors. They do not necessarily represent the opinions of eEye Digital Security.

SC Magazine: Group Test- Vulnerability Assessment
"SC Magazine reviews the eEye Retina Security Management Appliance as a Best Buy providing solid performance, good value and a venerable pedigree." Full Article

Blink 4.0 Video Review
"David Strom performs a video reviews eEye's Blink Professional 4.0" Full Article

What is the best Antivirus Software for Vista
"Computer Forensics puts eEye Digital Securities anti-virus software to the test in this real life review." Full Article

2008 CRN Emerging Vendors: Creating A Ruckus
"Upstart vendors make names for themselves in the channel" Full Article

Reader Q&A

Q: What is the likelihood that the black-list will be replaced by the white-list in the near future?

A: eEye Research has seen white-list "AV" used in a few circumstances in very sensitive environments with some success. Of course, these tightly maintained networks typically have little to none of the usability that most enterprise or corporate network users are used to. Of course, that's not to say that it's *impossible* for these "loose" networks to adopt a white-list system, but when users are used to the freedom that they currently have within their networks to install applications, it will be difficult to reverse that mentality.
Technology-wise, it is still a young technology. While some vendors have good ideas for providing this service, with the large amount of applications in the wild as well as the many different builds, it is a very intimidating task to think that you would be able to index all of the *good* files correctly. We predict that this will become more common in some environments, but will require a paradigm shift of mentality for users before it could be adopted as well as black-list functionality. From a geeky perspective it only makes sense; execution and adoption however are an entirely different situation.

Have a question you would like answered? Send it to versa@eEye.com, and win an eEye t-shirt if we select your question for an upcoming newsletter.

Announcements

eEye Receives top Rating and Earns ‘Best Buy’ Title in Security Product Shoot-Out
SC Magazine awardes Retina Security Management Appliance 5-star award for Vulnerability Assessment Group Test Full Article

eEye To Offer 25% Discount Channel Conversion Incentive to Entice Symantec Partners
eEye to offer a 25% discount to former Symantec resellers who join the eEye Partner Program or change a Symantec renewal opportunity into an eEye purchase Full Article

eEye Rises to “Positive” in Key Analyst Ranking by Gartner
eEye Digital Security Receives "Positive" Ranking in Gartner Vulnerability Assessment MarketScope Report Full Article

eEye Digital Security Named a CRN Emerging Tech Vendor
eEye has been selected by Everything Channel as a CRN Emerging Tech vendor for its line of endpoint protection and enterprise vulnerability assessment tools and services. Full Article

Etcetera

Stay Up-to-Date with eEye Research
eEye Research has seen some staggering results from the recent influx in Blink Personal/Neighborhood Watch users. This data is offering eEye Research a distinct insight into host-based vulnerability and attack trends to offer enhanced protection into Blink. Keep an eye on the eEye Research Portal http://research.eeye.com/ for future projects that have arisen because of the mass use of Blink Personal including Neighborhood Watch reports and attack trends. More

Vulnerability Expert Forums
The monthly Vulnerability Expert Forum focuses on recently announced critical vulnerabilities - from Microsoft and other software vendors. eEye's Internet security experts will describe the actions necessary to protect your systems from the threats that target these vulnerabilities. More

HOW TO SUBSCRIBE
To subscribe to this and other eEye newsletters, please visit: http://www.eeye.com/html/resources/newsletters/subscribe.html

FEEDBACK
The eEye newsletter staff welcomes any comments, questions or suggestions from our readers. We hope that you will not hesitate to contact us with any feedback you may have. Send all feedback to versa@eeye.com.

DISCLAIMER
The information within this newsletter may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk.

NOTICE
Permission is hereby granted for the redistribution of this newsletter electronically. It is not to be edited in any way without the express consent of eEye. If you wish to reprint the whole or any part of this newsletter in any other medium excluding electronic medium, please email versa@eeye.com for permission.