• 48% of SMBs worldwide are infected every year. A third of these infections are caused by worms that spread on USB devices
  • This is just one of the findings of the Second International SMB Security Barometer, which surveyed 10,470 companies across Europe, Latin America and North America

According to PandaLabs, in 2010, 25% of new worms have been specifically designed to spread through USB storage devices connected to computers. These types of threats can copy themselves to any device capable of storing information: cell phones, external hard drives, DVDs, flash memories, MP3/4 players, etc.

The data gathered suggests that this distribution technique is highly effective, as according to the Second International SMB Security Barometer, published by Panda Security -which surveyed 10,470 companies across 20 countries-, some 48% of SMBs (with up to 1,000 computers) admit to having been infected by some type of malware over the last year. Specifically, 27% confirmed that the source of the infection was a USB device connected to a computer.

According to Luis Corrons, Technical Director of PandaLabs, “At present, much of the malware in circulation has been designed to distribute through these devices. Not only does it copy itself to these gadgets, but it also runs automatically when a USB device is connected to a computer, infecting the system practically transparently to the user. This has been the case with many infections we have seen this year, such as the distribution of the Mariposa and Vodafone botnets”.

So far, these types of infection are still outnumbered by those that spread via email, but it is a growing trend. “There are now so many devices on the market that can be connected via USB to a computer: digital cameras, cell phones, MP3 or MP4 players…” –adds Corrons–. “Obviously this is very convenient for users, yet all these devices have memory cards or internal memories and therefore it is very easy for your cell phone, say, to be carrying a virus without your knowledge”.

How does it work?

There is an increasing amount of malware which, like the dangerous Conficker worm, spreads via removable devices and drives such as memory sticks, MP3 players, digital cameras, etc. The basic technique used is as follows. Windows uses the Autorun.inf file on these drives or devices to know which action to take whenever they are connected to a computer. This file, which is on the root directory of the device, offers the option to automatically run part of the content on the device when it connects to a computer. This feature is being used by cyber-crooks to spread viruses, through the modification of Autorun.inf with commands so that malware stored on the USB drive, for example, is run automatically when the device connects to a computer. This will immediately infect the computer in question.

To prevent this, Panda Security has developed Panda USB Vaccine, a free product which offers a double layer of preventive protection, disabling the AutoRun feature on computers as well as on USB drives and other devices.

“This is a very useful tool as there is no simple way of disabling the AutoRun feature in Windows. This tool makes it simple for users, offering a high level of security against infections through removable drives and devices”, explains Luis Corrons, Technical Director of PandaLabs.

Download Panda USB Vaccine free.