HP Proliant USB key riddled with worms
Streuth
Agentless Backup is Not a Myth
HP Australia has warned that optional USB keys shipped with some of its Proliant servers are infected by malware.
A batch of 256MB and 1GB USB keys that ship with the servers are infected by the Fakerecy and SillyFDC viruses, it warns. The keys are involved in installing optional floppy-disc drives. It's unclear how many infected USB sticks were distributed.
Fakerecy and SillyFDC are both low-risk worms that spread by copying themselves onto removable media. The malware likely got onto Proliant USB disks via an infected machine in a factory rather than as some part of a targeted attack.
The incident isn't very threatening for at least a couple of reasons. For one thing the malware simply isn't potent enough to do anything useful from the point of view of hackers. Secondly, it's hard to believe that anything but a very small minority of shops would need to support floppy discs on Proliant servers, thereby risking exposure.
Nonetheless the incident illustrates the growing use of USB drives as a vector for viral infection. Previous incidents of infected devices coming out of the factory have cropped up infrequently over the last few months. To date these incidents have involved digital photo frames and the like.
Up to date anti-virus software would detect both the viruses involved in the Proliant USB attack. But that may not help in cases where security software is installed onto servers after floppy disc support is added. Disabling autorun thwarts both the Fakerecy and SillyFDC worms and may be the better option.
HP's advisory, via local security clearing house AUSCert, can be found here. The SANS Institutes's Internet Storm Centre has advice on avoiding USB malware-related peril here. @reg;
COMMENTS
@Greg Williams
Easier than that. Just put a file on them referenced by autorun.inf which is called "DriverInstall.exe", purports to be installing drivers for the USB stick (most numpties don't know they're not required) and most people will happily wave it past UAC or XP's warning messages.
@ Webster
Truly random and bizarre as always.
Perhaps you and Morely Dotes should start up a blog together, or maybe a militia?
Well... there's a potential new tactic...
For someone wanting to spread a trojan, start a botnet etc...
Buy a pile of USB sticks on the cheap, load em up with the malware, and sell them even cheaper on FleaBay... make a bit of a loss but if, as many of them are, they're doing it for a profit in the long run, then it's just an investment.
Just put some nice 'demo' files on the sticks...
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
