High-end Sony memory sticks carry software that could make computers vulnerable to hackers, say researchers from two internet security firms.
Researchers with Finnish security software company F-Secure discovered that Sony鈥檚 鈥� a USB memory stick that has a built-in fingerprint reader 鈥� includes software that creates a hidden directory on the computer鈥檚 hard drive.
Creating 鈥渋nvisible鈥� directories on a computer is a trick also employed by a type of hacking tool known as a 鈥渞oot kit鈥�. F-Secure鈥檚 researchers say the USB stick鈥檚 file-hiding trick could also let hackers cover their tracks and hide malicious activity on a machine.
Advertisement
鈥淚t is our belief that the Micro Vault software hides this folder to somehow protect the fingerprint authentication from tampering and bypass,鈥� writes researcher Mika Stahlberg . 鈥淚t is obvious that user fingerprints cannot be in a world-writable [unprotected] file on the disk. However, we feel that rootkit-like cloaking techniques are not the right way to go.鈥�
Stahlberg says his team contacted Sony before going public with the information but received no reply from the company.
CD row
In November 2005, researchers found that Sony used a similar file-cloaking technique to hide anti-piracy software on computers. The software was bundled on music CDs and the discovery sparked much controversy (see 鈥淪ony BMG sued over cloaking software on music CD鈥�).
Software and files buried in hidden drives are not only invisible on screen, they can also elude security software. On Tuesday, researchers with computer security company McAfee confirmed the vulnerability described by F-Secure.
鈥淭he apparent intent was to cloak sensitive files related to the fingerprint verification feature included on the USB drives,鈥� says McAfee spokesman Dave Marcus.
鈥淗owever, software creators apparently did not keep the security implications in mind. The application could be used to hide arbitrary software, including malicious software.鈥�
Sony spokesman Chisato Kitsukawa said he could not immediately comment on the situation.
