Major Australian Retailer Accused of Selling Infected Hard Drives 128
skegg writes "Dick Smith, a major Australian electronics retailer, is being accused of regularly selling used hard drives as new. Particularly disturbing is the claim that at least one drive contained malware-infested pirated movies, causing the unlucky buyer significant data loss. Apparently the Fair Trading Commissioner will be conducting an investigation."
Standard Practice (Score:5, Interesting)
Seems standard practice with a lot of stores. Someone takes something back because they don't want or need it for whatever reason, the shop will just shrinkwrap it up again and the next buyer is none the wiser. I'm surprised that it hasn't happened sooner.
On another note, so how exactly can a video file (pirated movie or not) be 'malware infested'?
Re: (Score:1)
http://www.google.co.uk/search?sourceid=chrome&ie=UTF-8&q=wmv+malware [google.co.uk]
Re:Standard Practice (Score:4, Informative)
If you accept the licence agreement, it then downloads malware to your PC.
So all the "malware infested" media does is get the unsuspecting (or credulous, it's a fine line) user to download their own malware. It's not the video that contains the bad software and you'd expect any AV software to pick up on this old, old (the article is dated 2006) attack vector.
Sasquatch and the Queen playing Beach Volleyball (Score:2)
Yep. Was trying to download a "White Christmas" wmv for Xmas family listening off eMule. Every single file was a redirect to a malware codec. Sheesh... not even Mr. Crosby's classic is safe!
Isn't that one of those cases where a malware peddler on P2P notes what you're searching for and returns lots of fake results "customised" to your search term that are all basically the same piece of malware if you try to download them?
For example, if you searched for "sasquatch and queen elizabeth ii playing beach volleyball" (i.e. the most unlikely term to get *any* match, let alone exact match), you'd get quite a number of "results" such as "sasquatch-and-queen-elizabeth-ii-playing-beach-volleyball.wmv
Re: (Score:2)
Re: (Score:3, Informative)
The same way jpegs can be.
Re:Standard Practice (Score:5, Informative)
The parent couldn't be more correct.
People discount regular data files as being malicious simply because they're not labelled executables. What they don't think is that those files are opened by executables. These executables are often trusted programs which makes this an even bigger threat to a system as the malicious code can run hidden under the legitimate process and do its work. There's anything from buffer overruns to file parsing mistakes in the programs that can open them up to become a conduit for abuse.
An example of this is Adobe Reader's countless exploits with the PDF file format.
Re:Standard Practice (Score:4, Insightful)
Which is also why SQL injection attacks exist, everything you send to the server is data. If you take that data and execute it as code, well duh you've just created an exploit. Never, ever trust anything coming from the user.
Re: (Score:1)
You are the most ignorant AC I've come across in quite some time.
Re:Standard Practice (Score:5, Informative)
This is an incorrect assertion, an assertion my previous post debunked, but I suppose I'll re-explain:
You could have a drive full of PDFs, you could have it full of PNGs, whatever file format you'd like. You could mount the drive as noexec, however when it comes down to it, a trusted program (NOT ON THAT DRIVE) can interact with those files and since file formats can be complex AND since the programs opening them are also complex, there's a chance that the program will be vulnerable to a crafted file that tricks the program to do something that a "regular movie" or whatever wouldn't do and may not have been tested for.
If you've written a file parser of any kind, you'll see how complicated it gets in having your program code check the file for abnormalities before interacting with it. This complexity is a steep curve and all it takes is not checking an array boundary for your program to mistakenly leak data memory into its executable memory space.
The old addage plays correct here: Never trust user inputs.
Re: (Score:2)
Wrong. Every modern OS has this same problem. The only way to fix it is to switch to a CPU that uses Harvard architecture instead of Von Neumann architecture. As long as as there's no separation of code and data memory, this will be a problem.
Re: (Score:1)
One of the things that the author of "Godel, Escher, Bach" mentions, is that Godel's Incompleteness Theorem pretty much states that ANY "complete" system can be broken. The only way to avoid this, is to design an incomplete system (aka, one that is lacking features) that is small enough that all possible interactions are predictable (aka Java's original limited sandpit design).
Re: (Score:1)
Re: (Score:1)
On another note, so how exactly can a video file (pirated movie or not) be 'malware infested'?
By containing code that exploitable video players load into memory, and somehow manages to change that info into an executable status, and then somehow executes the code. But that's only one possibility.
Re: (Score:2, Informative)
While not 'containing' the malware, some media files have a field that specifies where the codec for them can be downloaded, and some players respond to this by downloading and installing the 'codec'. Needless to say, the 'codec' installer contains the malware.
Re: (Score:3)
While not 'containing' the malware, some media files have a field that specifies where the codec for them can be downloaded, and some players respond to this by downloading and installing the 'codec'. Needless to say, the 'codec' installer contains the malware.
by some you mean WMV and Windows media player, NO OTHER files do that.
Re: (Score:2)
While not 'containing' the malware, some media files have a field that specifies where the codec for them can be downloaded, and some players respond to this by downloading and installing the 'codec'. Needless to say, the 'codec' installer contains the malware.
by some you mean WMV and Windows media player, NO OTHER files do that.
True... if you get a dodgy MKV and open it up in VLC, it doesn't attempt to load a fake codec; it just uses exploits in VLC to gain VLC-level access to your system. You never have the option to back out before the malware is downloaded.
That doesn't really make MKV containers safer than WMV containers.
The big issue here is that a lot of people look at WMV/MKV/PDF/DOCX/etc. as "file formats". In fact, these are all "container formats" that interact with a specific API, and can contain multiple documents tha
Comment removed (Score:5, Interesting)
Re:Standard Practice (Score:4, Informative)
Basically any file type that can have a link to a webpage embedded, I believe both .MPG and .WMV are capable of this
No, just WMV. But "intelligent" players like Windows Media Player would "helpfully" realize that a WMV file renamed to MPG, AVI etc. was actually a WMV file and play it as such anyway. There's no reason for a movie format to contain such a link, it's for DRM'd WMV files that are supposed to take you to a page explaining how to buy access to it. Whoever came up with that scheme was stupid and I don't know any other player than WMP that ever supported it, since it was 99.99% used for malware and 0.01% for legitimate uses.
Re: (Score:2)
Whoever came up with that scheme was stupid and I don't know any other player than WMP that ever supported it, since it was 99.99% used for malware and 0.01% for legitimate uses.
It had legitimate uses???
The same problem exists with WiMP and MP3s. MP3s don't support DRM, WMAs do. So you can imbed a trojan link in the WMA file, rename it MP3, and WiMP will play the song AND the malware. Like you say, no other media player does that, and I see no legit use for it EXCEPT malware.
Maybe Norton or McAfee paid MS f
Re:Standard Practice (Score:4, Informative)
It used to not even prompt back in the day, it just automatically opened the link.
Perhaps that was only the case if you had the "download license automatically" checkbox ticked in the preferences? At any rate, you can turn this "helpful" feature off, and I always have. Though of course, this doesn't excuse MS's crappy implementation and presentation of a feature that most people won't realise is dangeous.
Re: (Score:2)
Perhaps that was only the case if you had the "download license automatically" checkbox ticked in the preferences?
At least in some version of WMP this was the default. This lead to pages like this [spyany.com]. It says so on the page too:
By default, Windows Media Player will attempt to acquire a license when you try to play the secure content if one was not issued to you by the content provider when you downloaded the content.
Re: (Score:2)
Re: (Score:2)
You can insert some microsoft-bashing here if you want, but to be fair, every OS bundles a ton of helpful programs now for web-browsing and media-playing.
Re:Standard Practice (Score:4, Interesting)
I don't know if they will get with fines (most of the time, playing the three monkey game will be enough to avoid civil/criminal charges.)
However, this is a lesson to everyone: After buying any new storage media, completely erase it first. This is something I try to keep the habit of doing, be it a USB flash drive, a SD card for my phone, external hard disks, or an internal HDD of a new PC.
The best utility, hands down, is HDDErase because it tells the drive controller to do the dirty work and erase everything, including the host protected area, sector relocation table, etc. I then follow it up by a DBAN, or at least a dd if=/dev/zero of=/dev/sdwhatever. If one can't do an ATA erase, then zeroing it out with a couple passes is the next best thing.
If only on Windows, encrypting the disk with BitLocker, then running the format command will help. The format command in Vista and newer checks to see if the previous data was a BitLocker volume, and if so, scrub away the remnants of the old volume keys. You can use TrueCrypt and create a dummy volume for the same result.
I erase data before using a drive for three reasons:
First, to exercise the drive and all accessible sectors, so the drive relocates marginal stuff immediately. In the old days, you could periodically low level format a HDD which would shrink the drive's capacity, but extend the life of the drive by cleaning out the relocation table and making it ready for handling new defects encountered. However, new drives don't have this, so the next best thing is to test all sectors before use.
Second, there have been cases of people facing criminal and civil charges for data on their storage media that wasn't theirs... it came with the device. Whether this is true or not can be debated, but it is best to not let it happen in the first place.
Third, there is always the chance of malware be installed somewhere along the supply chain. By completely zeroing it out from the MBR to the last sectors, this threat is mitigated for the most part.
This also shows another sad fact. There are a number of "computer repair" places that are pretty shady. I'm sure most readers of /. can likely do better than a lot of repair joints.
Re: (Score:2)
or at least a dd if=/dev/zero of=/dev/sdwhatever
I'm not sure if this method can be recommended. At least for me it has always been very slow (maybe 10MB/s), I still wonder why. It seems that the disk keeps seeking all the time (not going track-by-track). DBAN does it right. I've been trying tweaking the dd parameters (such as adding bs=512), but no bonus.
Re: (Score:2)
Re: (Score:2)
Flip side of this, which you ignore is willingness to accept returns and provide a full or partial refund. Obviously to provide a full refund, that item that was returned has to go somewhere, can't bin it and, can't sell it as second hand and loose money.
People get really annoyed when companies won't accept returns and provide refunds, people get really annoyed when they end up buying someone elses return, hmm, I believe it's what's called a 'catch 22' http://en.wikipedia.org/wiki/Catch-22_(logic) [wikipedia.org].
So w
Re: (Score:2)
Re: (Score:3)
It's not standard practice by most retailers, just a few dodgy ones and quite frowned upon by the ACCC. JB Hi-Fi have been caught [accc.gov.au]doing it with mobile phones.
Re: (Score:2)
Nothing new (Score:5, Interesting)
Re: (Score:2)
Which company would return harddisks without properly erasing them first?
Obviously the shop that sold the parts as new isn't particularly bright, but the company who owned the disks prior has some significant security issues.
Re: (Score:1)
Re: (Score:1)
Often companies have a contract with a supplier to do maintenance... in these cases, it'd be a case where the computer went in for maintenance or replacement, the data got copied onto the new PC, but the local tech forgot to wipe the old components before putting them back up for sale. Since it wasn't their company, and "nobody's going to notice", they didn't bother with the extra effort involved.
This usually happens when something blows on the motherboard and the fix is a complete replacement of the syste
Re:What? (Score:5, Informative)
He is embellishing for the media or trying to claim the dog ate his homework (or dingo ate his baby? ).
Re:What? (Score:5, Interesting)
Selling used stuff as new aside for a second
Umm. No.
The media blowup is being fuelled by "I bought a hard disk and it had hard core porn on it!" sensationalism but seem to be ignoring this deeper issue -
Dick Smith Electronics, Harvey Norman, JB-HiFi and the rest have been getting away with it for years but the fact is selling used goods (no matter how good a condition it's in) as new is illegal.
They can ask the same price for it if the return is in great condition but they can't just seal it back up and pop it back on the shelf next to the new unopened boxes.
Re: (Score:1)
Indeed. They should be listed as "refurbished" at least -- or "open box".
Techxperts? (Score:1)
Re: (Score:2)
There really hasn't been any technical knowledge in these stores for more than a decade
Re: (Score:1)
Maybe not infected (Score:4, Interesting)
I recall from the article that the disk was definitely second hand because it had a whole lot of movies on it (free!) but the guy who reported it to the media made a big song and dance about how the files "appeared corrupt" and "could have infected his system". None of which impresses me much. He could use a secure OS. Other retailers sell stuff which has been returned by customers. DSE should have formatted the disk, and they are at fault for that reason.
IIRC the reason he went to the media was that he is promoting an album or something and this was a golden opportunity to get his face and T shirt on TV.
Re: (Score:1)
>DSE should have formatted the disk, and they are at fault for that reason.
Not quite.
The core problem is that DSE (and others) are passing off used returned goods as new. That's illegal.
Customers are finding out and it's become a media storm because they're finding the previous owner's stuff on the phone or hard disk.
Re: (Score:2)
You know, he could have just plugged the drive and tried to boot from it. A boot virus could easily wipe out every available drive before prompting a "system not found" error. You could even hide it on a brand-new formatted drive, since the bootsector is the first sector and usually the first cylinder (currently usually sectors 0-63) is reserved. How will your "secure OS" protect you against that?
Re: (Score:2)
he could have just plugged the drive and tried to boot from it.
He didn't. He was pissed because he tried to play a movie file and it didn't work.
Re: (Score:2)
Re: (Score:2)
Preformatting the device would erase any malware which might have been on it. A secure OS would prevent the installation of any malware infected files which it might load. Obviously the secure OS doesn't help you if it is not running.
Re: (Score:2)
Re: (Score:2)
No. Just no. It's not just "wrong" to sell a used item as new. It's I-L-L-E-G-A-L. Period. And that's what they did. New vs used is not subjective. If you sell an item and it comes back with the shrink wrap opened, whether an hour has gone by or a year, it has to be presumed "used". That's what honest, law-abiding businesses do. They don't put un-shrinkwrapped packages on the shelf without clearly marking them as used, and they certainly don't re-shrinkwrap them and pass them off as new. Not even if the cus
Re: (Score:2)
In this case, I don't care how old the damn part was. It was sold to someone else before I got it, therefore the Doctrine of First Sale no longer applies, thus the part is used not new.
rather easy going return policy. (Score:1)
Not to defend the stores' oversight, but this particular store, had a rather generous return policy of 14 days no questions asked pretty much. Therefore, many people where purchasing TV sets, cameras, and whatever other good they sold, to use over a sport final weekend, or holiday, then return the item for a full refund. No intention of actually keeping the good they purchased.
Re: (Score:2)
It is the retailer's choice to offer a "no questions asked" return policy. It is irrelevant that many customers abuse such a policy. When the store offers such a policy, it assumes the all risks involved because of "no questions asked". It is unethical (and also illegal) for them to pawn off that risk on unsuspecting customers who are paying full retail price and expecting new products.
What they should have done is to refurbish the goods (add new shrink-wrap, reformat memory sticks and hard drives, reset ph
Woolworth's: ADVERSE affects on DickSmith stores (Score:1)
(AU retail giant) Woolworths-owned Dick Smith Electronics has - in our experience - several times shelved and sold "repaired" returned items (usually on a "take it or leave it basis" when stocks run low after an advertised "sale" (or did they -only- have such used gear on-hand from the start of the "sale").
Items we've seen & rejected out-of-hand:
- ASUS netbooks (in this case, shown as non-functioning "demos" & their boxes had NO indication of any repair or refurbishment by the maker; ONLY after bein
DSE distributing pirated media? (Score:4, Insightful)
DSE distributing pirated media? I'm sure the recording industry will be very interested to hear about this...
Re: (Score:1)
Re: (Score:1)
two things to remember though
1: this was when Dick Smith actually owned the business, the current DSE has nothing to do with him and
Say Whom? (Score:2)
?malware-infested pirated movies? !
Really? Isn't that why we use VLC instead of media player?
Re: (Score:1)
http://secunia.com/advisories/43131 [secunia.com]
Your media player choice doesn't really matter if an exploit exists in the version you're running.
14 days return (Score:3)
I don't know how it is in Australia, but around here, you can return anything you bought online within 14 days and get your money back (as long as you can actually return it as you got it, so food/software etc usually not included).
What do people expect happens to stuff that gets returned? Of course it goes on sale again. Otherwise selling online would be economic suicide...
Re:14 days return (Score:5, Informative)
I don't know how it is in Australia, but around here, you can return anything you bought online within 14 days and get your money back (as long as you can actually return it as you got it, so food/software etc usually not included).
What do people expect happens to stuff that gets returned? Of course it goes on sale again. Otherwise selling online would be economic suicide...
In Australia it is illegal to re-sell used returned goods as new. The goods can be re-sold but must clearly be marked as returned items, and usually a discount is offered for accepting the goods in this condition. (The discount might not be offered if the item is in high demand).
What's more if goods have been returned and the item registered or activated online or similar they are not suppose to sell the item. That is the secondary reason that computer software isn't returnable at most stores (though there are exceptions like EB games).
Re: (Score:2)
Same in the UK.
You can resell it, you have to marked it as returned, and basically the seller has to take the loss of whatever they get returned. It works on the basis that returns are such a small percentage of items, of little value to someone wishing to scam them, and represent such a small fraction of their costs, and *STILL* can be resold for even the same price so long as they are clearly marked that it's not an issue.
Go read any EU trading law. It's all in there.
Re: (Score:2)
Of course it gets sold again.
But under no circumstances should it then be advertised as 'new', ie. fresh from the factory and never been used as that is blatantly false advertising in bad faith.
Re: (Score:2)
Bigger Fish (Score:1)
Lets not forget that the company that owns and manages DSE is Australia's third largest employer Woolworths LTD.
shortcut shortcut (Score:1)
People can't even take short-cuts properly!
I guess the kind of person who takes shortcuts can't be bothered to do it properly - short-cutting the short-cut.
But I suppose that those who can take short-cuts properly don't get spotted....
DSE = Radio Shack (Score:5, Interesting)
Re: (Score:2)
Most DSE stores do still carry a few components, including resistors. It's just that you have to look quite hard.
Down the back.
In the dark corner.
Behind the door on the right.
Marked beware of the leopard.
Just keep looking, they are there somewhere.
Jaycar seems to be doing quite well here in Christchurch, they just moved into a much larger store, same stuff, just more of it.
Re: (Score:2)
Jaycar / Soanar / Electus seem to be getting bigger and bigger. Farnell is also a good choice in Australia. They were recently bought out by element14 who now offer free express shipping to major cities. Minimum order is $10 though.
Re: (Score:1)
Just go to Jaycar (Or buy online @ jaycar.com.au) for all of your electronics needs, going to Dick Smiths is like going to K-Mart for a "big screen" TV or a name brand appliance.
As a former employee... (Score:5, Insightful)
...this kind of thing was prevalent throughout the company. We would frequently be expected to sell used and returned stock without being given any real freedom in regards to marking it down. This led to a culture of lying to customers, especially in cases where it was not evident that the stock had been used.
Of course, used stock would be sold as new to customers all the time.
It even extended to returns on products that were in sealed packaging, despite having a clearly posted 14 day no questions asked refund policy we would be expected to tell customers that we wouldn't provide a refund, even if it was something that wasn't functioning as the customer expected (although within manufacturers specs).
Had this happen to me (Score:5, Interesting)
Well, a friend. Their HDD had died and they asked me what to do. "Buy a new one" says I. Turns out they had no back-ups of pictures etc, so I offered to try a recovery (no promises and I warned them everything could be lost). Anyhoo, the recovery worked with the failed HDD working as a slave to the new one. I picks up loads of deleted pictures and felt rather chuffed with my little self.
"You seems to have made loads of friends on that Egypt trip." I say.
"Never been to Egypt." they reply.
It takes 5 seconds for me to twig that donkey-boy here had done the recovery on the wrong HDD and more stuff was still being found. School reports, banking spreadsheets, tonnes of stuff. Not really what one expects to find on a "new" HDD. Once I had the pictures recovered from the correct drive (and backed-up) my friend took the "new" HDD back to the shop for a bit of a word.
Selling hooky equipment to a police officer? Not one of the storekeeper's greatest ideas. And for the previous owner, there was enough information on there for someone to do them serious ill. Luckily for them, my friend made the storekeeper physically destroy the drive (and got a full refund).
There's no issue with selling 2nd hand kit, just advertise it as such and make sure it's properly wiped first.
People are clueless (Score:2)
Re: (Score:2)
Depends on what you mean by secure erase.
sudo dd if=/dev/zero of=/dev/sda
With respect, and as long as there is no disk error during the operation (as evidenced by "<correct # bytes> copied" at the end), if you don't think that's a secure erase, you're in la-la land. Definitely secure enough for warez, and probably even secure enough if they were money-and-resources-no-object state or military secrets. Obviously I mean secure enough in terms of function, if not meeting bure
Re: (Score:2)
I doubt that much of the ID fraud comes from old hard drives. Phishing, cracking web sites, especiall dumpster diving for paper records, are where the ID theft is happening. I'd say that 99.999% of the time, a high level format would be sufficient.
Returning Hardware (Score:2)
This what they get for useing sales guys as tech's (Score:2)
And not have the techs be techs like how geek squad used to be.
Now days way to be come a tech or keep the job at a store is to get your numbers of Extended Warranties (some times even having to lie about what it covers), high cost cables , other ad ons, rip off software and more.
http://consumerist.com/2011/06/staples-canada-accused-of-selling-computers-with-old-user-data-on-hard-drive.html [consumerist.com]
http://iworkatpencils.blogspot.com/ [blogspot.com]
http://consumerist.com/2008/12/staples-give-us-80-weve-already-set-up-all-the-laptops [consumerist.com]
been there done that. (Score:1)
Infected movies? (Score:2)
malware-infested pirated movies, causing the unlucky buyer significant data loss
Why the hell would you want to execute a movie? The data loss is due to the device being bad, if it has been returned it was likely because of a reason.
Re: (Score:2)
Because these are computer n00bs. You really expect them to know these things? :(
Radioshack does this also (Score:1)
Nothing New (Score:1)
Re:Dick Smith (Score:5, Informative)
Re: (Score:1)
This is why you don't make a company with your name in it :)
Re: (Score:3)
Re: (Score:1)
Their marketing head thought that meant fridges and things
Bravo on their part, because "fridges and things" are what I see every single time I walk past them. Fridges that happen to be extremely thin and small and have moving pictures displayed on their front...
Re: (Score:2)
Re: (Score:1)
Stage 1 - Open up a new chain, supplying electronic parts/books/kits because other stores don't stock such basic materials for the hobby electrician.
Stage 2 - start to supplement income with consumer electronics because, hey, a basic part only costs 20c at best.
Stage 3 - reduce parts/kits catalogue to one tiny rotary shelf of resistors/transistors/capacitors because "Well that leaves mo
Re: (Score:2)
Re: (Score:2)
What is worse is that it isn't hard to wipe the drives. HDDErase can gnaw through a terabyte drive in 15 minutes to an hour [1], and DBAN might take a long time, but the computer can be set aside while that is going on. Even operating systems like OS X come with very easy to use HDD wiping tools.
[1]: HDDErase tells the HDD controller to zero everything out, so because the drive isn't waiting for oodles of zeros from the interface, it can write at its fastest speed.