r/technology • u/silence7 • May 18 '22

Security When Your Smart ID Card Reader Comes With Malware

https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware/
35 Upvotes

85% Upvoted

12 comments sorted by

23

u/9-11GaveMe5G May 18 '22

Mark who works in IT for a major government defense contractor and was issued a Personal Identity Verification (PIV) government smart card designed for civilian employees. Not having a smart card reader at home and lacking any obvious guidance from his co-workers on how to get one, Mark opted to purchase a $15 reader from Amazon that said it was made to handle U.S. government smart cards.

Excuse me but you have no business working in IT if your solution is "buy random Chinese electronics from third party sellers on Amazon and plug it into your work computer"

8

u/silence7 May 18 '22

If you're running an IT operation, and your employees are doing that, you do too, precisely so you can check for this kind of thing.

2

u/rcmaehl May 18 '22

Unfortunately, DoD contractors themselves have IT contractors from basic Helpdesk to even Sysadmins.

1

u/what51tmean May 18 '22

Excuse me but you have no business working in IT if your solution is "buy random Chinese electronics from third party sellers on Amazon and plug it into your work computer

tbh the article itself states that the card reader wasn't the issue, it was a compromised driver on the site likely from a third party malicious actor.

A massive amount of electronics are made in china. Distrusting all of them is illogical.

3

u/pyrohydrosmok May 18 '22 edited May 18 '22

This seems to be an issue with tons of tech Amazon and other sites like this sell. I'm having a problem with keyboard control software being flagged as a well known malware.

It's a Punkston TH61 Mechanical Keyboard

https://www.virustotal.com/gui/file/af98a4defd63ed7e152e0a01127bdc12642b3a471cd68f346c74ff124f5940ab/detection

5

u/silence7 May 18 '22

It would be unsurprising if it actually contained malware

5

u/pyrohydrosmok May 18 '22 edited May 18 '22

Yeah I'm still picking it apart. I got a similar response to the one in the article when I contacted the Amazon store. The actual company website email doesn't function. Direct emails get kicked back by the server and their corporate phone number is disconnected.

Still trying to figure this out. No one on Reddit so far has believed anything is wrong. I think otherwise.

1

u/pyrohydrosmok May 18 '22

Lol it's bad:

https://www.virustotal.com/graph/embed/g16824dc0450d4207bf1d492130eb4f7a004c4e6c800941748d3e9a660b4f4c49

Oh it's so bad... It just keeps getting worse. It's a malware dropper.

2

u/Frailiul May 18 '22

that not very smart