How Devices Get Exploited

Manchester City Council in England banned USB sticks from its offices in 2009. Someone had most likely carried a worm called Conficker in on one that February, and it spread through the council's Windows computers. Staff couldn't send email, the system that processes traffic fines went offline, and benefit claims backed up. The council later put the cost at about 1.5 million pounds.

Conficker first appeared in November 2008, a version from late December added two more ways in, and over the next few months it reached millions of computers around the world. By then it had the three ways onto a computer shown below, and each one depended on something the computer's owner could have changed. As you read the figure, find the setting or habit that would have closed each way in.

On October 23, 2008, Microsoft released an emergency fix for a flaw in a Windows service that shares files and printers. On most Windows computers of the time, any computer that could reach the service could send it a specially built request and run its own code on the machine. Conficker used that flaw a month later. A computer with the fix installed was safe from this route. Months later, many still didn't have it.

The service was listening on an open port, a numbered doorway that a program on the computer keeps open for incoming connections. A computer that didn't need to share files with the network could have kept that port closed, and a firewall could have dropped requests to it from computers that had no reason to send them.

Once Conficker was on one computer in a network, it looked for others and tried to open ADMIN$, a hidden shared folder that Windows sets up on every computer. To open it, it needed an administrator's password, so it tried a list it carried of more than 200 common choices, such as password, admin, and 12345. A computer whose administrator account used something on that list was taken over even if it had every fix installed.

Conficker also copied itself onto any USB drive plugged into a computer it had taken over, along with a small file telling Windows what to offer when the drive was plugged in. On a computer with autorun turned on, plugging that drive into the next computer brought up a box whose harmless-looking choice, Open folder to view files, ran the worm. The person carrying the drive from one office to the next was the route, and Manchester banned the drives for that reason.

From the December version on, Conficker shut down Windows' automatic updates and its security services on each computer it took over, and blocked the websites of antivirus companies and Microsoft's update service, so the owner couldn't easily download a tool to remove it. A computer whose anti-malware already recognized Conficker could stop it on the way in; one with none, or with protection it never updated, had nothing between the worm and the operating system.

Microsoft offered 250,000 dollars in February 2009 for information leading to the arrest and conviction of Conficker's authors. In 2011 police in Ukraine, working with the FBI, arrested three people over a scam that used the worm, and none is on record as convicted. Copies of Conficker were still being found on computers more than ten years after it first appeared.

A guest at the downtown hotel goes to dinner and leaves a laptop in the room. The laptop's firmware, the small program built into its hardware that runs before anything else, decides what the laptop starts from. Anyone who gets into the room while the guest is out can restart the laptop with a USB drive plugged in and tell it to start from the drive. The operating system on the drive then runs in place of the laptop's own, and it can copy every file off the laptop's disk or plant a program that runs the next time the guest starts the laptop. Security researchers call any attack by someone left alone with a device an evil maid attack, after a 2009 demonstration by Joanna Rutkowska and Alexander Tereshkin against a laptop left in a hotel room.

What does the person in the hotel room have that Conficker never had?

The person in the room has the machine itself, at the moment it starts. Conficker always arrived after Windows was already running, and every way it came in passed through Windows. The visitor in the room acts before Windows loads, when the firmware decides what to start, and a firmware password is checked at exactly that moment.

Even so, a visitor with enough time can take the disk out and read it in another computer. That laptop needs the firmware password and a disk encrypted so that another operating system can't read it.