1-in-4 worms spread through infected USB devices
Flash drive attack vector remains popular, says security company
Computerworld - Hard on the heels of a report that a USB drive was used to compromise U.S. military networks in 2008, a security company today claimed that 25% of all new worms are designed to spread through the portable storage devices.
"Much of the malware in circulation has been designed to distribute through these devices," said Luis Corrons, the technical director of PandaLabs, the research arm of Panda Security, in a statement Thursday. "Not only does it copy itself to these gadgets, but it also runs automatically when a USB device is connected to a computer, infecting the system practically transparently to the user."
While a quarter of all 2010's worms rely on USB devices to spread to other PCs, a recent Panda survey of more than 10,000 small- and medium-sized firms found that 27% of those victimized by a malware infection in the last year reported that the attack had originated with infected USB hardware, primarily flash drives.
Other devices that connect to PCs via USB, including smartphones, cameras and music players, also are a threat, added Corrons. "All these devices have memory cards or internal memories and therefore it is very easy for your cell phone, say, to be carrying a virus without your knowledge," he said.
The Stuxnet worm was one of the year's high-profile threats that relied on USB drives. In July, Stuxnet targeted PCs running software that managed large-scale industrial control systems in major manufacturing and utility companies by exploiting a then-unpatched vulnerability in Windows's shortcut files.
When users viewed the contents of an infected USB drive with a file manager like Windows Explorer, Stuxnet loaded itself onto the PC.
The USB infection vector isn't new. Two years ago, the Conficker worm made headlines worldwide after it spread using flash drives, among other avenues.
Earlier this week, U.S Deputy Defense Secretary William Lynn revealed that the U.S. Central Command's (CENTCOM) network was compromised after an infected USB drive was plugged into one of the network's PCs. CENTCOM is the military's joint regional command responsible for the Middle East, including Iraq and Afghanistan.
After Conficker's appearance, Microsoft patched Windows to fix a bug that prevented users from disabling "AutoRun," the mechanism that hackers used to automatically infect PCs when USB drives were plugged in. The company also changed AutoRun's behavior in Windows 7 to stymie such attacks.
Today, Corrons touted "USB Vaccine," a utility he said completely disables AutoRun. The tool can be downloaded from Panda's Web site; although USB Vaccine is free, users must provide their name, phone number and e-mail address before downloading.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is email@example.com.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts