TOKYO - Low-cost USB drives advertised online with enormous storage capacities are exposing users to the risk of lost data, malware infections and information theft, with tests finding that some products contain only a fraction of the memory shown on their labels.
USB-related security breaches have become a growing concern for companies and public organizations. Factories, research laboratories, hospitals and other facilities requiring strict security often operate computer systems disconnected from the internet. When outside data or software must be transferred to those systems, USB drives are commonly used, creating an opening for malware to enter otherwise isolated networks.
The greatest risks may lie in products that appear most attractive to ordinary buyers: USB drives offering large capacities at unusually low prices through major online shopping platforms.
A Nikkei investigation previously revealed that the Ground Self-Defense Force had used a counterfeit Chinese USB drive infected with malware. The product had been distributed through an online retailer widely used by the public, raising concerns that similar devices may have been purchased by individuals, companies and other organizations.
Internal Ground Self-Defense Force documents obtained by Nikkei showed that the infected USB drive had been used for nearly a year before the problem was detected. The documents included a detailed analysis of the device and the malware infection.
Because the USB drive had been acquired through Amazon, the risk was not limited to the Self-Defense Forces. Nikkei reporters purchased a selection of inexpensive USB drives online, including products sold under the same brand used by the Ground Self-Defense Force, and examined their true capacity.
Half of the 10 types tested had falsified storage capacities.
One device was advertised as holding about 1 terabyte, but its actual capacity was less than 0.01% of that amount. Other drives displayed less storage than advertised and began deleting previously saved data when users attempted to write more information than the devices could physically hold.
To examine how common such products are, a separate 4-terabyte USB drive was purchased online for 5,380 yen, a price far below that of a legitimate device with comparable capacity.
The drive was taken to AI Data, a company specializing in data recovery, for testing. Before examining the newly purchased product, technicians demonstrated the process using another USB drive already confirmed to be fraudulent.
When connected to a computer, the device appeared to have a capacity of 500 gigabytes. A diagnostic test completed about 10 seconds later identified suspected capacity falsification and found that the drive contained only 58.2 gigabytes, or roughly 10% of the advertised amount.
The missing storage did not exist physically. Software in the USB drive's controller had been manipulated to make the computer display memory that was not actually present.
The device could appear to accept files normally, misleading users into believing their photographs, documents and other data had been safely stored. When they later tried to open the files, however, the information could not be read because it had never been properly saved.
Testing of the 4-terabyte USB drive purchased for the investigation produced a writing error, meaning the device became unable to accept the test data. The product failed during the examination.
Technicians then dismantled the casing to inspect its internal components. Hidden inside was a microSD card with a capacity of only 64 gigabytes, a tiny fraction of the 4 terabytes displayed when the drive was connected to a computer.
The investigation also found that some suspicious products were sold in small metal cases, a form of packaging that technicians said frequently appeared with capacity-falsified devices, although legitimate products may also use similar containers.
The danger extends beyond fraudulent memory capacity. Inexpensive USB drives may also contain malware planted by hacker groups, according to the Nikkei journalist who uncovered the Ground Self-Defense Force case.
Large numbers of companies, organizations and individuals purchase inexpensive USB drives, creating opportunities for malicious devices to eventually reach businesses or institutions holding confidential information. Once connected to a computer, an infected drive could install malware and steal sensitive data.
The strategy may rely on distributing many compromised devices and waiting for one to be purchased by a valuable target.
Consumers and organizations were advised to avoid buying unusually cheap USB drives through online marketplaces and instead purchase products from established manufacturers through electronics retailers or other trusted physical stores.
Such products may cost more, but retailers generally source devices from manufacturers they consider reliable, reducing the risk of malware infections, falsified capacity and the loss of irreplaceable files.
Many consumers interviewed said they no longer used USB drives because they stored most data in cloud services. However, the report noted that cloud storage also carries serious security risks, although the source material ended before those risks were explained.
Source: テレ東BIZ
