A Panda Security report found 48 percent of midmarket businesses worldwide are infected every year; one-third of these infections are caused by worms that spread on USB devices.
Security firm Panda Security's anti-malware laboratory PandaLabs has
discovered that in 2010, 25 percent of new worms have been specifically
designed to spread through USB storage devices connected to computers.
These threats can copy themselves to any device capable of
storing information such as cell phones, external hard drives, DVDs,
flash memories and MP3 players.
The data from Panda's Second International SMB Security Barometer
suggests that this distribution technique is highly effective. With
survey responses from more than 10,470 companies across 20 countries,
it was revealed that approximately 48 percent of SMBs (small and midsize
businesses) with up to 1,000 computers admit to having been
infected by some type of malware over the last year. As further proof,
27 percent confirmed that the source of the infection was a USB device
connected to a computer.
According to PandaLabs technical director Luis Corrons, much of the
malware in present circulation has been designed to distribute through
these devices. "Not only does it copy itself to these gadgets, but it
also runs automatically when a USB device is connected to a computer,
infecting the system practically transparently to the user," he said.
"This has been the case with many infections we have seen this year,
such as the distribution of the Mariposa and Vodafone botnets."
So far, Corrons said, these infections are still outnumbered
by those that spread via e-mail, but it is a growing trend. "There are
now so many devices on the market that can be connected via USB to a
computer: digital cameras, cell phones, MP3 or MP4 players," he
explained. "This is clearly very convenient for users, but since all
these devices have memory cards or internal memory, it is feasible that
your cell phone could be carrying a virus without your knowledge."
Corrons said there is an increasing amount of malware, which like the
dangerous Conficker worm, spreads via removable devices and drives such
as memory sticks, MP3 players and digital cameras. Panda's report
outlined the basic technique used: Windows uses the Autorun.inf file on
these drives or devices to know which action to take whenever they are
connected to a computer. This file, which is on the root directory of
the device, offers the option to automatically run part of the content
on the device when it connects to a computer. By modifying Autorun.inf
with specific commands, cyber-crooks can enable malware stored on the
USB drive to run automatically when the device connects to a computer,
thus immediately infecting the computer in question.
In light of this, the company has developed a USB Vaccine, a free
product which offers a double layer of preventive protection, disabling
the AutoRun feature on computers as well as on USB drives and other
devices. "Since there is no simple way of disabling the AutoRun feature
in Windows, this is a very useful tool that makes protection simple for
users and offers a high level of security against infections through
removable drives and devices," Corrons said.