Infosec: Vendors rapped over sloppy security

Infosec Europe 2008

An antivirus firm has called for the introduction of an ISO-type certificate to guarantee that security procedures have been adhered to during the manufacturing of electronic devices.

ESET said at the Infosec security show in London that electronic devices are still vulnerable to malware during the production stage.

A variety of gadget and component makers, including TomTom, Maxtor, Mocmex and HP, have released goods over the past year that gave the user far more than they paid for with a free gift of malware.

"There are several ways that this growing threat could be countered that do not rely on users having up-to-date security," said Andrew Lee, chief research officer at ESET.

• INFOSEC VIDEO: Interview with Ed Gibson, chief security advisor at Microsoft UK

Lee highlighted the autorun feature, which he dubbed 'auto-infect', which allows a specific program to run automatically from storage devices like USB keys. The feature has become a highly efficient way for hackers to compromise computers.

Vendors should make the "intelligent security decision" to disable this feature, according to Lee, which would prevent a lot of devices from being compromised.

Alternatively users should at least be warned about the potential security risks before allowing these programs to be executed.

ESET also suggested that value-added resellers can introduce malware inadvertently when creating their own custom media and branded devices.

"Virus scanning should simply be a sanity check," said Lee, adding that vendors should use multiple scanners and perform random quality checks before releasing the finished product.

"Introducing some sort of certification would at least give users assurance that a reasonable level of precaution has been taken," he concluded.