The American Dental Association (ADA) has inadvertently mailed malware-laced USB thumb drives to thousands of dental offices nationwide.
The organization sent out 37,000 of the devices to its members before a discussion on a security forum revealed that malware was present on at least some of the drives.
The drives contained a PDF file of dental procedure codes, but some of them, which were sourced from China, also had malicious code embedded that redirects recipients to a malware-serving website. The ultimate payload is used to gain control of a user's Windows computer.
The ADA told independent security researcher Brian Krebs that the supply chain is to blame, and that only a fraction of the drives are actually infected.
“Of note it is speculated that one of several duplicating machines in use at the manufacturer had become infected during a production run for another customer,” the ADA said. “That infected machine infected our clean image during one of our three production runs. Our random quality assurance testing did not catch any infected devices. Since this incident, the ADA has begun to review whether to continue to use physical media to distribute products.”
Read more American Dental Asso. Mails Malware-Laced USB Drives to Thousands
The organization sent out 37,000 of the devices to its members before a discussion on a security forum revealed that malware was present on at least some of the drives.
The drives contained a PDF file of dental procedure codes, but some of them, which were sourced from China, also had malicious code embedded that redirects recipients to a malware-serving website. The ultimate payload is used to gain control of a user's Windows computer.
The ADA told independent security researcher Brian Krebs that the supply chain is to blame, and that only a fraction of the drives are actually infected.
“Of note it is speculated that one of several duplicating machines in use at the manufacturer had become infected during a production run for another customer,” the ADA said. “That infected machine infected our clean image during one of our three production runs. Our random quality assurance testing did not catch any infected devices. Since this incident, the ADA has begun to review whether to continue to use physical media to distribute products.”
Read more American Dental Asso. Mails Malware-Laced USB Drives to Thousands
