iPod virus advisory lacked information - anti-virus analyst

By Erwin Oliva
INQ7.net

Apple's recent advisory on the reported iPod virus lacked information that can help users, a senior anti-virus analyst at Trend Micro told INQ7.net.

"A cursory analysis of the advisory shows a lack of really helpful information for users and looks more of a cheap shot at Microsoft's expense," said Jaime Lyndon "Jamz" Yaneza, senior threat researcher and analyst at the Security and Intelligence Group of Trend Micro Inc.

He said the advisory should at least mention the manufacturing serial number or batch of iPods affected.

The advisory did mention that less than 1 percent of the Video iPods shipped after September 12, 2006 carried the Windows RavMonE.exe virus. The advisory also noted that it had seen less than 25 reports concerning this problem.

"This known virus affects only Windows computers, and up-to-date anti-virus software which is included with most Windows computers should detect and remove it. iPod nano, iPod shuffle and Mac OS X are not affected, and all Video iPods now shipping are virus-free," the Apple advisory added.

The Apple advisory also did not determine the specific iPod models affected; does not mention preventive steps in further manufacturing processes; had no detailed characteristic information of what the virus really does; leaves the search work up to the user; and was unable to pinpoint affected regions where affected product was shipped, said Yaneza.

Yaneza's initial online sleuthing indicated that the affected product is the updated 5.5G iPod 30 gigabyte model.

He also found that the infected iPods were shipped in Dallas, Texas; Boston, Massachusetts; and Madison, Wisconsin based on feedbacks on Amazon.com.

"It's just the latest manufacturing mistake much like the numerous other reported instances from other companies. This isn't the first time we've seen hardware devices and media accidentally shipped with malware," Yaneza said.

In 1999, IBM alerts customers to the CIH virus in a small number of Aptiva PCs. In 1998, the MGM Interactive distributes a promotional game "WarGames" with the Marburg virus in gaming magazines. In 2005, Creative Labs shipped its new Zen MP3 player with "Wukill" virus. Also in the same year, I-O Data Devices shipped a worm on portable hard disk drives.

"Luckily the shipped malware were old, in which case any up-to-date anti-virus program should prevent infection. This demonstrates the need for manufacturers to ensure that any computers in their production environments (regardless of operating system) have regularly updated security and antivirus products/services installed," he said.

Yaneza said that Apple's manufacturing plant was not likely running any antivirus product or it has not been updated since mid-year 2006.

"The sage advice that consumers should keep their security and anti-virus products/services updated is still the best particularly since (just like this case for Apple) a lot of outsourcing is being done and sometimes the ability to monitor the quality of released products is unreliable," he suggested.

Apple now advises users to various free virus removers from Microsoft and a number of anti-virus companies.

Copyright 2006 INQ7.net. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.