Eighties throwback worm spreads via memory sticks
Danger USB
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Miscreants have created a strain of malware which uses memory sticks as a vector for infection.
The SillyFD-AA worm spreads by copying itself from infected machines onto removable drives such as USB memory sticks before automatically running when the device is next connected to a computer.
The malware, which is also capable of spreading through shared floppy discs, creates a hidden file called autorun.inf that ensures the malware is activated the next time infected media is plugged into a Windows PC.
Infected machines are easily recognised. The title of Internet Explorer windows on infected Windows machines is changed to include the phrase "Hacked by 1BYTE". In both its mode of infection and its lack of profit-driven motive, the SillyFD-AA worm is a throwback to the days when viruses were written for kudos rather than as part of some money-making scheme.
Net security firm Sophos predicted that the growing use of USB drives in direct mailshots and as freebies at trade shows would make them a growing vector for attack.
"With a significant rise in financially motivated malware it could be an obvious backdoor into a company for criminals bent on targeting a specific business with their malicious code," Sophos senior technology consultant Graham Cluley warned.
Firms should disable the autorun facility of Windows so removable devices such as USB keys and CD ROMs do not automatically launch when they are attached to a PC. In addition, any storage device should be checked for viruses and other malware before use. ®
COMMENTS
The naughties way of protecting against eighties throwback usb viruses
After reading all of the comments above and the original statement from Graham Clueley @ Sophos ref USB Virus risks....the one key point that everybody has conveniently overlooked, is the "Pro-active" approach to USB device security. I personally have depolyed thousands of seats of the Securewave Sanctuary Device and Appliacation Control solution that fixes exactly this issue ! And as far as I am aware is the only product of its kind. To draw an anolgy, why would you allow "any" device the opportunity to autorun in your corporate environment, rather than those that are "authorised".
After all...when I go shopping, I dont take a list of all of the products that I dont want to buy, but rather a list of all the items that I DO want to buy. The whitelist approach is the only way to fix this issue. Wake up Readers !!
Get a grip from both sides
As the previous posters have written, the risk of infecting networks via USB devices, or CDs, or floppy disks is not new. What has changed is that the storage capacity of these portable devices has increased exponentially. So, as well being able to download massive amounts of sensitive data, executable code can be launched from the device. It's a two pronged attack that needs an integrated solution: i.e. endpoint security software that can block or tightly regulate USB use AND control the applications that are able to run on the network, preferably with the ability to audit whatever is being downloaded and uploaded via USB ports.
Whatever the Windows equivalent is
Sorry my learned friend, but you obviously work on an OS with far greater security capabilities than Windows, and you're on top of it too. Windows simply does not have the equivalent functionality. It expects (and often demands) that you be root to do almost anything - including start your browser.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
