Viruses, Worms and Thumbdrives

I'm really concerned about a tidal wave of virus infections on campus PCs with the increased use of USB thumbdrives. I'm giving this issue some real thought and trying to come up with some innovative solutions or methods to help us stem the flow of viruses and worms on campus systsms. This isn't a Chicken Little thing! No, my anti-psychotic meds haven't worn off and I'm not having those feelings of paranoia again! Really, this is big stuff! It's obvious that the Symantec Antivirus software running on our PCs is not catching the different viruses, trojan downloaders, and spyware -- PCs are getting infected.

Virus and worm/trojans infections have gotten so bad that the Pentagon and Department of Defense has banned the use of ALL external storage devices being connected to military computers everywhere until further notice! Of course, this isn't just a DoD issue: worms and nasty viruses can really hit home and your personal pocketbook. The Washington Post has this article about the Sinowal spyware infection that is harvesting large numbers (500,00) of bank credit cards and bank debit cards. What, you don't do banking at school? You do transfer files between home and school via a thumbdrive, right? The infected thumbdrive then gathers your financial info at home via a keylogger and reports back to its controller on the bot-net. You're now a statistic!

Here's info about one of the worms that has the military folks so freaked out! and here are a few links about this problem:

http://www.washingtonpost.com/wp-dyn/content/article/2008/11/21/AR2008112101575.html?sub=AR

http://blog.wired.com/defense/2008/11/army-bans-usb-d.html

http://www.foxnews.com/politics/2008/11/20/pentagon-cyber-siege-unprecedented-attack/

OK, so what do we do to protect PCs on campus? I'm mostly concerned about the classroom teachers' and the office staff PCs getting infected.  The amount of work required to clean PCs or make sure all their data is backed up to the server before re-imaging is potentially astronomical. All campus computer lab PCs can be wiped and re-imaged - I'm not trying to minimize the problem there--re-imaging labs is a huge task.

I'm recommending that teachers and staff no longer allow students to logon to their teacher/staff PC and/or allow students to use an outside storage device (USB thumbdrive, external hard drive, CD-ROM or DVD created elsewhere, or floppy drive on PCs equipped to use them) on teacher/staff PCs. If a student needs to print a paper, they need to go to one of the computer labs on campus, logon and print from there.

We really need to work together on this and safeguard our data and computing/network resources so we can continue to utilize technology as part of the educational process. I welcome your comments and suggestions.

Comments

One-in-Six USB Drives Infected at Cornell

The Department of Defense is fully justified in stopping the use of removeable media (USB thumb drives, CDs, and floppies) with DoD computers. Here's an article on Campus Technology [1] magazine's web site that describes this huge problem in much greater detail. Here's a notification from Cornell University and their response to the virus outbreak from USB devices [2] where they've found that one-in-six drives are infected with malware when they scanned students' thumb drives. The US-CERT has basic information article [3] about safely using USB thumb drives.

The biggest culprit in all of this? The U3 software (and the Windows AutoRun option) that comes pre-installed on many new thumb drives, namely the SanDisk brand. Here's a link [4] to a section of the U3 FAQ on how to turn off the AutoRun option with their software -- this is a must do if you don't un-install the U3 software completely from your thumb drive (which I strongly recommend!) Here's a link to download the special program [5] SanDisk provides to completely remove the U3 kludge from your thumb drive--please do this as soon as possible.

[1] http://www.campustechnology.com/articles/69777_2/

[2] http://www.cit.cornell.edu/security/alerts/usb-bot/

[3] http://www.us-cert.gov/cas/tips/ST08-001.html

[4] http://www.u3.com/support/#CQ2

[5] http://www.sandisk.com/Assets/u3/launchpadremoval.exe