Chinese Trojan on Seagate/Maxtor 3200 Hard Disks

The mainstream media seems to have missed this one...

Chinese Trojan on Maxtor HDDs spooks Taiwan
By John Leyden
12 Nov 2007 20:17
Ghost in the machine


Confirmation that a Maxtor hard disk drive was infected with a Trojan by a manufacturing sub-contractor in China is spooking Taiwanese authorities, one of the countries where examples of the infected kit have begun to appear.

As first reported by El Reg in September a pre-installed Trojan named AutoRun-AH was discovered by Kaspersky Labs on Maxtor 3200 external hard drives sold in the Netherlands. Maxtor is owned Seagate. Initially, Seagate expressed skepticism about the reports.

But following a subsequent investigation the firm confirmed that an unspecified number of Maxtor Basics Personal Storage 3200 drives sold after August 2007 were indeed contaminated by malware during the manufacturing process. It traced the problem to an unnamed sub-contractor in China.

AutoRun-AH is a Trojan that searches for passwords to online games and sends them to a server located in China. It also disables anti-virus software.

Seagate is on the case, it says. It "quickly put a stop ship to units leaving the facility as soon as the company learned of the probable infection. All units now leaving the facility in question have been cleared of the virus and units in inventory are being reworked before being released for sale. However, some affected units may have been sold to the public before the problem was detected".

Maxtor 3200 external hard drives come in a range of sizes. Some infected 500 GB versions of the product have reached Taiwan sparking a major security flap undoubtedly exacerbated by the tense political relationship between Beijing and Taipei. Many of the large capacity drives subject to the alert are used by government departments, fueling espionage fears.

Around 1,800 portable drives, produced in Thailand, were contaminated with Trojan horse malware, the Taipei Times reports. Local distie Xander International has being instructed by the Ministry of Justice to pull the products from its shelves.

Seagate has yet to respond to our requests for comment on the number of hard disks it thinks may have been infected, or where they are.

http://www.channelregister.co.uk/2007/11/12/maxtor_infected_hdd_updated/