NOW READ THIS
("Security Advisory")
Submitted by: Bill Hickey
NCVA List Master
NRT-0464 HP Admits Selling Infected Flash-Floppy Drives:
Hewlett-Packard Company has been selling USB-based hybrid flash-floppy drives that were pre-infected
with malware, the comapny said last week in a security bulletin. Dubbed the HP USB Floppy Drive Key,
the device is a combination flash drive and compact floppy drive and is designed to work with various
models of HP's ProLiant Server line. HP sells two versions of the drive, one with 256 MB of flash
capacity and the other with 1 GB of storage space. A security analyst at the SANS Institute's Internet
Storm Center (ISC) suspects that the infection originated at the factory and was meant to target
ProLiant servers. HP confirmed in an 03APR advisory that both versions of the flash-floppy drive
might come with a pair of worms, although the company offered few details. It did not say how many
of the drives were infected, where in the supply chain the infections occurred or even when they
were discovered. If a compromised drive is plugged into a USB port on any machine on the network,
the worms may spread "to any mapped drives on the server," HP's alert said. Up-to-date antivirus
software should detect the malware, but HP did not specify which of the many available programs would
find and then delete the worms.
(ComputerWorld 07APR08)