IBM distributes virus-laden USB keys at security conference
ASHER MOSES — IBM has been left with egg on its face after it distributed virus-laden USB keys to attendees at Australia's biggest computer security conference. — Delegates of the AusCERT conference …
Context & Ripple Effects
The incident lands at the worst possible venue for IBM: AusCERT is Australia's largest computer security conference, so the company handed compromised hardware directly to the most security-literate audience on the continent. It also compounds a rough stretch for Big Blue's public standing in 2010 — April brought confirmed reports that IBM was threatening legal action against TurboHercules over the open source Hercules mainframe emulator, and March saw reports of more than 1,700 job cuts, giving critics a pattern of missteps to point to rather than a one-off gaffe.
First-order effects
- AusCERT delegates who plugged in the keys face immediate exposure to whatever malware they carried, and conference organisers must now issue containment guidance to attendees.
Second-order effects
- Rival security vendors gain a ready-made talking point against IBM's consulting-led security pitch, while enterprise buyers have a fresh reason to scrutinise how vendors QA the promotional hardware they distribute.
Third-order effects
- If vendor-distributed media is treated as an untrusted vector by default, conferences and enterprises will tighten procurement and scanning policies around removable media generally — a shift toward assuming any USB device, however reputable its source, may be hostile.
The trend: Removable media keeps proving that trust should attach to the channel, not the brand behind it, pushing organisations toward default-distrust policies for USB devices.