1-in-4 worms spread through infected USB devices

[Firefox]

1-in-4 worms spread through infected USB devices

Hard on the heels of a report that a USB drive was used to compromise U.S. military networks in 2008, a security company today claimed that 25% of all new worms are designed to spread through the portable storage devices.

"Much of the malware in circulation has been designed to distribute through these devices," said Luis Corrons, the technical director of PandaLabs, the research arm of Panda Security, in a statement Thursday. "Not only does it copy itself to these gadgets, but it also runs automatically when a USB device is connected to a computer, infecting the system practically transparently to the user."

While a quarter of all 2010's worms rely on USB devices to spread to other PCs, a recent Panda survey of more than 10,000 small- and medium-sized firms found that 27% of those victimized by a malware infection in the last year reported that the attack had originated with infected USB hardware, primarily flash drives.

Other devices that connect to PCs via USB, including smartphones, cameras and music players, also are a threat, added Corrons. "All these devices have memory cards or internal memories and therefore it is very easy for your cell phone, say, to be carrying a virus without your knowledge," he said.

The Stuxnet worm was one of the year's high-profile threats that relied on USB drives. In July, Stuxnet targeted PCs running software that managed large-scale industrial control systems in major manufacturing and utility companies by exploiting a then-unpatched vulnerability in Windows's shortcut files.

When users viewed the contents of an infected USB drive with a file manager like Windows Explorer, Stuxnet loaded itself onto the PC.

Microsoft issued an emergency "out-of-band" security update on Aug. 2 to plug the shortcut hole.

The USB infection vector isn't new. Two years ago, the Conficker worm made headlines worldwide after it spread using flash drives, among other avenues.

Earlier this week, U.S Deputy Defense Secretary William Lynn revealed that the U.S. Central Command's (CENTCOM) network was compromised after an infected USB drive was plugged into one of the network's PCs. CENTCOM is the military's joint regional command responsible for the Middle East, including Iraq and Afghanistan.

After Conficker's appearance, Microsoft patched Windows to fix a bug that prevented users from disabling "AutoRun," the mechanism that hackers used to automatically infect PCs when USB drives were plugged in. The company also changed AutoRun's behavior in Windows 7 to stymie such attacks.

Today, Corrons touted "USB Vaccine," a utility he said completely disables AutoRun. The tool can be downloaded from Panda's Web site; although USB Vaccine is free, users must provide their name, phone number and e-mail address before downloading.

[Marcus]

...users must provide their name, phone number and e-mail address before downloading.

Not keen on that. Won't be doing that anytime soon.

Informative piece though, Firefox. Thanks for posting it.

[mountaintree16]

This is one reason why auto run shouldn't even exist, in my opinion.

I'm not keen on that either, Marcus. Bleh.

[Firefox]

I am not keen to that myself, I was just quoting what the article stated....

[Marcus]

I know you were, Firefox.

I know.

Take care, fella.

[mountaintree16]

Oh I know An email address is understandable maybe, but a name and phone number? Ehh.

[Marcus]

Oh I know An email address is understandable maybe, but a name and phone number? Ehh.

Not overly keen on providing an email addy either; smells of future potential customer-harvesting to me.

[Firefox]

I have a special email addy I use for just this kind of stuff....

[mountaintree16]

Eh, me either really.

Smells of future potential customer-harvesting to me.

Yeah, you're probably right. Why else would they want all of that...

[mountaintree16]

Oh okay.

[sho-dan]

Edit/

[YoKenny1]

I installed Panda USB Vaccine 1.0.1.4 on my XP Pro system from:

http://download.cnet.com/Panda-USB-Vaccine/3000-2239_4-10909938.html

That is the download recomended from the Panda site:

http://research.pandasecurity.com/panda-usb-and-autorun-vaccine

It never asked for my name, phone number and e-mail address before downloading nor on installation.

I tested it on 2 of my USB Flash drives and it works well.

Edit: I see sho-dan and I posted at the same time and I have been using sUBs Flash-Disinfector for a long time.

Edited August 31, 2010 by YoKenny1

[mountaintree16]

Thanks guys

[Haider]

Hello sho-dan: Normally this is what I do with all my external drives and USBs:

1. Format them NTFS
   
2. Create a blank read-only Autorun.inf file
   
3. Place the above file in read-only Autorun.inf folder
   

So far this has helped me, besides I've applied MS-KB967715

[YoKenny1]

Why I never format USB Flash drives as NTFS

Fix and Format USB Flash Drives Jun 17 2006

http://gladiator-antivirus.com/forum/index.php?showtopic=38966

If you do you can not eject the Flash Drive safely!

Read what peple have to say

After pulling a USB stick out during boot of a PC, before Windoze had started, I found it was no longer readable. OK, no biggie, only non-critical data was lost. However I could NOT re-format the drive, Windows would fail at the task. I feard the stick was dead until I formatted it in a few seconds as a FAT drive using Linux!