The Channel logo

News

By | John Leyden 12th November 2007 20:17

Chinese Trojan on Maxtor HDDs spooks Taiwan

Ghost in the machine

Confirmation that a Maxtor hard disk drive was infected with a Trojan by a manufacturing sub-contractor in China is spooking Taiwanese authorities, one of the countries where examples of the infected kit have begun to appear.

As first reported by El Reg in September a pre-installed Trojan named AutoRun-AH was discovered by Kaspersky Labs on Maxtor 3200 external hard drives sold in the Netherlands. Maxtor is owned Seagate. Initially, Seagate expressed skepticism about the reports.

But following a subsequent investigation the firm confirmed that an unspecified number of Maxtor Basics Personal Storage 3200 drives sold after August 2007 were indeed contaminated by malware during the manufacturing process. It traced the problem to an unnamed sub-contractor in China.

AutoRun-AH is a Trojan that searches for passwords to online games and sends them to a server located in China. It also disables anti-virus software.

Seagate is on the case, it says. It "quickly put a stop ship to units leaving the facility as soon as the company learned of the probable infection. All units now leaving the facility in question have been cleared of the virus and units in inventory are being reworked before being released for sale. However, some affected units may have been sold to the public before the problem was detected".

Maxtor 3200 external hard drives come in a range of sizes. Some infected 500 GB versions of the product have reached Taiwan sparking a major security flap undoubtedly exacerbated by the tense political relationship between Beijing and Taipei. Many of the large capacity drives subject to the alert are used by government departments, fueling espionage fears.

Around 1,800 portable drives, produced in Thailand, were contaminated with Trojan horse malware, the Taipei Times reports. Local distie Xander International has being instructed by the Ministry of Justice to pull the products from its shelves.

Seagate has yet to respond to our requests for comment on the number of hard disks it thinks may have been infected, or where they are. ®

comment icon Read 16 comments on this article alert Send corrections

Opinion

Neil McAllister

Claims that cloud will drive Oracle's future growth ring hollow
Pure Storage array

Neil McAllister

How the cloud taught Redmond to play by a new set of rules

Features

Pebble Steel
Meet the man who accidentally created the smartwatch hype
No, silly... he was the fall guy for years of Finnish folly
Fraud image