The risk of information security breaches due to USB storage device malfunctions.
(Baonghean.vn) - On October 17, 2014, the Department of Information and Communications of Nghe An province issued Official Letter No. 1475/STT&TT-CNTT regarding the warning of information security risks from faulty USB storage devices. The content of the letter is as follows:
Implementing Official Letter No. 204/VNCERT-KTHT dated October 10, 2014, from the Vietnam Computer Emergency Response Center (VNCERT) regarding the warning of information security risks from USB storage device vulnerabilities. This vulnerability allows hackers to install malware into the USB device's firmware. When the USB is connected to a computer, the malware will infiltrate the computer and steal passwords, escalate privileges, open backdoors, or illegally update the BIOS...
Because the malware is embedded in the software that controls the USB device, it is very difficult to detect and remove using common anti-malware tools. Currently, several USB devices with this vulnerability have been found on the market, including:
- Patriot 8GB Supersonic Xpress
- Kingston DataTraveler 3.0 T111 8GB
- Silicon power marvel M60 64GB
- Toshiba TransMemory-MXTM Black 16GB
- Patriot Stellar 64GB Phison
Meanwhile, security experts worldwide still lack effective methods to check for and detect USB devices that have been infected with malware.
Recently, virus infections via USB drives have been quite common in government agencies in Nghe An province. To minimize the risk of information insecurity through USB devices, the Department of Information and Communications proposes the following:
1. Leaders of provincial departments, agencies, and branches; People's Committees of districts, cities, and towns; and political and social organizations in Nghe An province are urged to promptly direct their officials and functional units to implement the following:
- Do not connect USB devices to critical computers that need protection, especially those storing confidential documents; users can use official email or other external storage devices as alternatives if necessary.
- Do not buy or use USB drives that are counterfeit or of unknown origin on the market.
- Install antivirus software on the unit's computers to protect against viruses spread via USB drives.
- When connecting a USB device to a computer, be wary of any interfaces that appear requesting account credentials, passwords, or other personal information.
- Minimize lending or sharing USB storage devices.
2. The IT Center – Provincial Party Committee Office is requested to inform grassroots Party organizations so that they are aware of and implement this.
3. Assignment: The Nghe An Provincial Electronic Information Portal will post the warning information on the Nghe An Provincial Electronic Information Portal; the Nghe An Information Technology and Communications Center will research solutions to support units in resolving the issue when requested.
If you suspect or detect a USB device containing malware, please contact: Incident Response Team - Nghe An Information Technology and Communications Center, phone number: 0383.500.027; or Mr. Tran Tuan Anh, System Engineering Department - VNCERT Center, phone number: 043.640.4424, email:[email protected].
Phan Nguyen Hao
