New Devices Ship with Malware

There's a lesson to be learned here.

IBM and Lenovo recently issued an alert notifying users of the Storwize storage systems that USB flash drives provided to customers included something besides the initialization tool they may have been expecting. The alert warned users that some of the USB flash drives also contained malware.

Kevin Townsend of Security Week explains that the malware on the USB drives is old and would probably be recognized and neutralized by most up-to-date antivirus software. Since the Storwize storage systems are designed for business, individual users should not be affected. The alerts and Townsend's article provide additional information about how to recognize and neutralize the malware. However, as Townsend points out, it is not reassuring when malware is distributed by manufacturers. In this case, the problem has been easy to fix, but that may not always be true in the future.

Supporting Web Links

• IBM Storwize for Lenovo initialization USB drives contain malware
• Almost half of dropped USB sticks will get plugged in
• Malware: The Gift That Keeps on Giving
• Video: Malware alert — don’t plug in that USB stick you found on the street
• 6 Tools To Disable CD And USB Autorun On Microsoft Windows

Discussion Questions/Activities

1. While the problem discussed in this article primarily affects businesses and therefore may not apply to students, there have been a number of similar incidents involving infected USB flash drives. Have students heard about any of these problems? Do they scan new devices for malware before using them? Consider reviewing the “6 Tools To Disable CD And USB Autorun On Microsoft Windows” article in the Supporting Web Links section or show students how to disable AutoPlay from the Control Panel.
2. Divide students into small groups and ask each group to conduct a survey similar to the one referenced in the Supporting Web Links section (“Almost half of dropped USB sticks will get plugged in”). Students do not need to actually leave USB drives for people to find, but they should ask survey respondents about their experiences with lost and found USB drives. Students should create their own survey questions, but should consider asking if respondents have ever lost or found a USB drive. How do respondents protect the data on their USB drive? What would they do if they lost theirs? What would they do if they found a USB drive? Are respondents aware of the potential risks? Students should also obtain demographic data. Each group should compile and analyze their survey results and create a brief presentation to share with the class.
3. As an individual project, ask students to locate a recent example of an item that was received with malware. How was the malware discovered? How was the problem resolved? How could this have been avoided? What steps should consumers take to protect themselves from these scenarios? Students should write a brief summary explaining the issue and answering these questions.