Original URL: http://www.theregister.co.uk/2010/08/03/infected_motherboards/

Dell does factory fresh virus infections?

Something new to be frightened about!

By Dan Olds, Gabriel Consulting

Posted in HPC, 3rd August 2010 09:41 GMT

How the hell does a virus-infected set of motherboards find their way into the supply chain of a major system vendor? The vendor delivering the bad boards was Dell, and they’re blaming a slipshod supplier and ‘human error’. Yeah – human error. You can read all about it here and here.

The virus in question was a variant of an easily disinfected worm that was festering in the flash memory on the boards. Dell has removed all of the motherboards from their supply chain and rushed replacements to affected customers. That’s good, but it doesn’t make the fact that this happened in the first place any less deplorable.

To me, this situation brings up a range of disturbing scenarios. First, it proves that malware and other nasty, hidden code can be embedded in factory-fresh products and delivered to unsuspecting customers. This is akin to finding a pile of steaming dog crap when you unwrap your Quarter Pounder. Actually, it’s worse than that – the dog pile is pretty easy to detect in most (but not all) takeout dishes and, while certainly disturbing, you probably won’t end up eating it. A virus or Trojan is different.

It’s fortunate that the virus used was easy to detect. What concerns me is that there are vastly more insidious things that can be done along these lines. Why couldn’t some super-villain plant code in a new system that would lie low until a certain set of conditions are met?

For example: it’s dormant until a particular USB key is inserted into the machine; then it comes to life and opens up all sorts of back doors to the system. This same super-villain would have a low-level minion physically inside the data center with instructions to put the key into server x, wait a few minutes, and then pull the key out. Then the minion would casually walk out the door with gigabytes of confidential data and a big, big smirk.

Admittedly, this wouldn’t be easy to pull off. The bad guy would have to make sure that a particular component lands in the right data center, and that he has an insider in position to execute the plan. (The bad guy or bad gal, that is; I want to be fair, and women can be very evil in their own right.)

But how hard would it be if you had a lot of money behind you – or the resources of an entire government (even a small one)? The targets of these types of schemes won’t be confined to top-secret defense labs; there are plenty of juicy databases in commercial and industrial companies.

One of the people I most respect in the industry gave me the following example of just how harmful these types of exploits could prove to be. Those who know their Star Wars history will recall that then-Chancellor Palpatine used a similar technique to become Emperor. His infamous Order 66 was implanted into the clone army and, at the right moment, they slaughtered their Jedi leaders. Blood flowed red and deep that day, and it became known as The Great Jedi Purge.

(I would hyperlink all of these little factoids, but I can’t stand even to copy and paste the wiki links to this crap. As for my pal, he’s not a Star Wars geek – but he is the father of two boys who watched the movies enough to wear out the DVDs, so he picked up the story via osmosis.)

In conclusion: we need to be concerned about the safety of high tech supply chains and wary of vendors. And ambitious chancellors… and clone programming too, I guess. As for me, I’m off to see if I can get Norton to run on our new microwave.