Schneider Electric may have shipped USB drives infested with malware

[nir]

The flash drives were "contaminated" during the manufacturing process.

 

Schneider Electric has warned customers that USB drives shipped with some of the firm's products are potentially infected with malware.

 

USB flash drivers sent with Conext Combox and Conext Battery Monitor products, part of Schneider Electric's solar power range, were "contaminated" during the manufacturing process, according to a security advisory released by the industrial equipment manufacturer.

 

Schneider Electric says that the USB media "may have been exposed to malware during manufacturing at a third-party supplier's facility."

 

All versions of Conext Combo (sku 865-1058) and Conext Battery Monitor (sku 865-1058) recently shipped with the USB drives, which contain user manuals and "non-essential" software, may have been affected.

 

The company, naturally, is asking customers not to load up or use the flash drives and recommends that the USB dongles should be disposed of.

 

Schneider Electric also says that the malware "should be detected and blocked by all major anti-malware programs," which suggests the malicious code is run-of-the-mill, rather than malware crafted for a targeted attack against Schneider Electric customers.

 

The company is not the only major household name which has needed to inform customers of potential USB malware infections of late. In 2017, IBM warned customers that some flash drives sent with purchased Storewize storage systems could be laden with malware.

 

Earlier this week, a security vulnerability was revealed which impacts Schneider Electric Modicon controllers. The security flaw, CVE-2018-7789, can be exploited to remotely force reboots, which can cause serious disruption in the operations of industrial control system (ICS) networks.

 

ZDNet has reached out to Schneider Electric with additional queries and will update if we hear back.

 

Source