Risk
5/28/2010
01:56 PM
50%
50%

IBM Distributes Malware At Security Conference

Promotional USB thumb drives carried an unintended freebie: a keystroke-monitoring Windows worm.

Call it a stealth attack: Attendees at this month's AusCERT information security conference in Australia received an apologetic e-mail last week from IBM warning them that gratis promotional USB thumb drives the company distributed came installed with an unintended freebie: malware.

"At the AusCERT conference this week, you may have collected a complimentary USB key from the IBM booth," IBM's chief technologist in Australia, Glenn Wightwick, wrote to attendees. "Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected."

It warned recipients to not use the drives, and requested their return to a postage-free address.

IBM didn't name the malware in question, noting only that it "is contained in the setup.exe and "autorun.ini" files, had been around since at least 2008, and could be detected "by the majority of antivirus products" on the market.

It warned that the malware would automatically run, and advised anyone who had actually plugged in the offending thumb drive to "contact your IT administrator for assessment, remediation and removal."

According to Graham Cluley at Sophos, the drives contained two different pieces of malware: The setup file is known as LibHack-A, and refers to "often otherwise legitimate applications that have been altered to load a malicious library file with a .dat extension," said Cluley on the Sophos blog. Thankfully, a crucial component is missing, which means it doesn't work.

But that's not true for the other piece of malware, a keystroke-monitoring Windows worm known as Agent-FWF. "Hardly the kind of code a security researcher would want running on their computer," said Cluley.

What can other companies do to ensure that their USB thumb drives aren't delivering hidden extras to conference-goers and potential customers? For starters, while auto-run features may seem mandatory to ensure that thumb-drive recipients receive your marketing message, avoid them.

"Auto-run files seem like a good idea because they force the user to view your pre-loaded information but you do, as IBM have discovered, run a very small risk with auto-run files of introducing malware," Phil Battison, director at memory stick vendor USB2U, said in a statement. Better, he said, to stick to just data files, such as Word documents, Excel spreadsheets, PowerPoint decks, or PDFs.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.