Retro worm sniffs out USB drives

A worm has been discovered using a method of infection so old-fashioned it was last seen in the early 1990s – it specifically targets removable media.

In this case, the format in question is the ubiquitous USB drive rather than the floppy disk boot sector of old, but the effect is much the same for what Sophos has dubbed the ‘SillyFD-AA’ worm. Once on a USB storage stick, it can bypass expensive and sophisticated gateway security, running itself automatically when an infected drive is next plugged into a PC or laptop.

In principle, the worm can target any type of removable drive so the company that uncovered the worm, Sophos, advises users to disable the autorun function of windows to stop the worm from executing without user intervention.

The worm itself tracks removable drives on any system by intercepting Windows API calls, and can even create a special version of the autorun.inf file that Windows uses for autorun settings to ensure it freedom of infection. In addition, the worm cheekily edits the title of the Internet Explorer window bar to say "Hacked by 1BYTE".

The worm’s main function appears to be to spread itself in a way that mocks the security regime of most companies. Few companies check removable drives for malware infection, making the generally reasonable assumption that such infection nowadays comes via email or the web. The writer of this particular worm has obvious noticed that removable media have, once again, become a blind spot in corporate security.

"With USB keys becoming so cheap, they are increasingly being given away at tradeshows and in direct mailshots.,” said Sophos’s security guru, Graham Cluley. “With a significant rise in financially motivated malware it could be an obvious backdoor into a company for criminals bent on targeting a specific business with their malicious code."

Cluley also suggested that naïve intention probably lay behind this worm.

"In this example, changing the title of the Internet Explorer browser… indicates that this particular variant of the worm has not been written with completely clandestine intentions. A more savvy internet criminal would have not made it so obvious that the PC has been broken into, but silently steal from the PC without leaving such an obvious clue," he said.

In recent times, USB drives have become corporate enemy number one. They can be used to steal data without attracting attention, to host malware of various sorts, and ruin the best-laid but unsuspecting compliance regimes.