Memory Cards of 3,000 Phones Infected By Malware 63
itwbennett sends us a few links from IT World tracing a story about infected microSD cards in Vodaphone-supplied mobile phones. "The original report came on March 8 after an employee of Panda Security plugged a newly ordered HTC Magic phone from Vodafone into a Windows computer, where it triggered an alert from the antivirus software. Further inspection of the phone found the device's 8GB microSD memory card was infected with a client for the now-defunct Mariposa botnet, the Conficker worm, and a password stealer for the Lineage game. At that point it was at thought to be an issue with a specific refurbished phone. On Wednesday another phone surfaced with traces of the Mariposa botnet. And now Vodafone is saying that as many as 3,000 HTC Magic phones may be affected."
Smart phones? (Score:5, Interesting)
Honest Question (Score:3, Interesting)
Re:Cleary the worst example of pre-installed softw (Score:3, Interesting)
Why would an SD card come anywhere near a PC during the manufacturing process? Aren't they fabricated in large batches, not unlike RAM or CPUs? The only part of the process that I would think might involve a PC would be the formating at the end. Yet it seems like they'd have a dedicated hardware device that formats multiple chips at a time.
It's a Windows malware, right? (Score:1, Interesting)
From TFA:
With the first phone, the Mariposa botnet code automatically ran and attempted to infect a computer. Mariposa was at one time one of the largest botnets, but security researchers were able to shut it down in December after disabling its command-and-control servers
It's a Windows malware, right? So a "Windows" computer connect to the phones sdcard and attempts to autorun whatever on it.
I don't see how the malware can somehow activated and affect Android Linux O/S running on ARM chip inside a user-mode VM.
Do botnets have legs now?
Re:Cleary the worst example of pre-installed softw (Score:3, Interesting)
The only real question is whether the hardware interface between the commodity PC components and the large number of SD cards is something fairly custom, or basically just a whole lot of USB SD card readers mounted in some sort of frame. A specialized interface could probably be quite useful in a heavily automated situation, particularly if it consisted of some sort of contact array that could connect to an entire tray of cards in one robotic motion; but if you are using human labor for this step, the ability to build a large array of ports for under $10/port, easily swapping out any whose contacts wear out, is probably pretty attractive.
Probably incidental (Score:5, Interesting)
In the one case I'm familiar with, which was at another company, the infection was traced to a single PC on the production floor that was just *packed* with malware. Apparently, it had been re-purposed from somebody's desk to the QA station when production capacity was expanded.
This was at a reputable, top-tier contract manufacturing company.
Re:what s the safest cellphones? (Score:3, Interesting)
I just want a cellphone that allows, well, you know, to call people.
What would be the simplest, easiest, cellphone with the least functionality (no bluetooth, no Java, no appstore, no memory card) that would fit me?
You know, one with ten numbers and a "call" and a "hang up" button?
You say you want "simplest and easiest". Think deeply about what you're trying to do. Do you actually want to talk to a "number", or do you really intend to talk to a specific person? This is a real question, and not intended to be a smart-assed comment.
Most people assume a simple phone is one that dials numbers, but that's because we've been trained by 80 years of technological limits that have forced us to abstract human conversations behind strings of digits. With new phones that have contact lists, you don't need the numbers other than for initial input into the machine. You set the number once (or save it if they call you first) and never dial the digits again.
That leads directly to a repeat of the first question: do you want to hunt through a contact list, or do you still just want to talk to someone? Again, we've been trained by the limits of our recent cell phone technology to accept 2=ABC, 3=DEF, etc. But that sucks for searching. Arrow-up and arrow-down are frustrating for average numbers of contacts, and the experience gets worse the more people you know.
If you honestly want to just talk to someone, you should really be asking for a phone with voice recognition dialing. Motorola, Nokia, Apple, Sony Ericsson all have phones that can voice dial without training based on the names you've entered in the contact list, and I'm sure there are many others out there. Pushing the "call" button and saying "Call John Smith" is about as simple and easy and clear and direct as it gets. You should look into that, rather than constraining your requirements with limits that no longer need to exist.