Risk
5/28/2010
01:56 PM
50%
50%

IBM Distributes Malware At Security Conference

Promotional USB thumb drives carried an unintended freebie: a keystroke-monitoring Windows worm.

Call it a stealth attack: Attendees at this month's AusCERT information security conference in Australia received an apologetic e-mail last week from IBM warning them that gratis promotional USB thumb drives the company distributed came installed with an unintended freebie: malware.

"At the AusCERT conference this week, you may have collected a complimentary USB key from the IBM booth," IBM's chief technologist in Australia, Glenn Wightwick, wrote to attendees. "Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected."

It warned recipients to not use the drives, and requested their return to a postage-free address.

IBM didn't name the malware in question, noting only that it "is contained in the setup.exe and "autorun.ini" files, had been around since at least 2008, and could be detected "by the majority of antivirus products" on the market.

It warned that the malware would automatically run, and advised anyone who had actually plugged in the offending thumb drive to "contact your IT administrator for assessment, remediation and removal."

According to Graham Cluley at Sophos, the drives contained two different pieces of malware: The setup file is known as LibHack-A, and refers to "often otherwise legitimate applications that have been altered to load a malicious library file with a .dat extension," said Cluley on the Sophos blog. Thankfully, a crucial component is missing, which means it doesn't work.

But that's not true for the other piece of malware, a keystroke-monitoring Windows worm known as Agent-FWF. "Hardly the kind of code a security researcher would want running on their computer," said Cluley.

What can other companies do to ensure that their USB thumb drives aren't delivering hidden extras to conference-goers and potential customers? For starters, while auto-run features may seem mandatory to ensure that thumb-drive recipients receive your marketing message, avoid them.

"Auto-run files seem like a good idea because they force the user to view your pre-loaded information but you do, as IBM have discovered, run a very small risk with auto-run files of introducing malware," Phil Battison, director at memory stick vendor USB2U, said in a statement. Better, he said, to stick to just data files, such as Word documents, Excel spreadsheets, PowerPoint decks, or PDFs.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.