Security → Re: How does malware get onto OEM and promotional hardware??

List of commercial products that included malware
»rationallyparanoid.com/a ··· ist.html

quote:

---

2010

Dell PowerEdge Server Motherboards:

Olympus Stylus Tough 6010 digital camera:

Samsung S8500 Wave smartphones:

Energizer DUO USB Battery Charger Software:

Vodafone HTC Magic:

2009

M&A Companion Touch Notebook:

ComputerBild Magazine: The cover CD-ROM

2008

Samsung SPF Digital Photo Frames:

Asus Eee Box desktop computer:

Insignia Digital Photo Frames:

HP USB keys for Proliant servers:

2007

Maxtor Basics Personal Storage 3200 hard drives:

TomTom GO 910 satnav:

2006

McDonalds promotional MP3 players:

Apple iPods: Some Video iPods

HP printer drivers for Officejet g85 All-in-One printer:

2005

Sony BMG music CD rootkit:

2000

HP printer drivers:

---

Again, how does this keep happening??

Same way bugs happen: sloppy people using sloppy processes.

(You could fix it with better people or better processes; take your pick).

Bugs arent intentional things though. Someone embedding a virus on a motherboard is intentional.

Because there is money, don't you think?

I don't know that's true. Couldn't it just come along for the ride from a development machine?

I develop software. If I were stupid enough to develop on an infected machine and my employer were stupid enough to distribute binaries built on my machine (rather than having an official build process, for example), we could accidentally ship malware.

I assume firmware's the same. It's just that copy-to-web is replaced by burn-to-ROM.

But, like I say, I don't actually know the vector.

Read the page as I did not include the details due to size.

Bottom line it happens because people (humans) are involved and processes that should be in place are not being observed or are not in place in the first place.

Happens during the replication process. When someone pays, anything can be added or altered.
Same way win7 was available for sale before official release.