Laptops given to British schoolkids came preloaded with malware and talked to Russia when booted
- Reference: 1611250328
- News link: https://www.theregister.co.uk/2021/01/21/dept_education_school_laptops_malware/
- Source link:
The affected laptops, supplied to schools under the government's [1]Get Help With Technology (GHWT) scheme, which started last year, came bundled with the Gamarue malware – an old remote access worm from the 2010s.
[2]
The Register understands that a batch of 23,000 computers, the GeoBook 1E running Windows 10, made by Shenzhen-headquartered Tactus Group, contained the units that were loaded with malware. A spokesperson for the manufacturer was not available for comment.
These devices have shipped over the past three to four weeks, though it is unclear how many of them are infected. It is believed the devices were imaged as they left the factory.
[3]
One source at a school told The Register that the machines in question seemed to have been manufactured in late 2019 and appeared to have been loaded with their DfE-specified software last year.
We have been shown emails sent to and from the Department for Education (DfE), which runs the GHWT scheme, flagging up concerns about the laptops. It appears that at least one school is formatting and reimaging the laptops from a known clean build before issuing them to pupils.
We've also seen online forums where Bradford school employees discuss the council contacting them on Wednesday to warn them of the problem, saying in an email: "Upon unboxing and preparing them it was discovered that a number of the laptops are infected with a self-propagating network worm ... that looks like it contacts Russian servers when active."
People familiar with the GHWT rollout told The Register that not all the machines in the batch phoned home, however.
Forget Snow Day: Baltimore's 115,000+ public school kids get Ransomware Day, must check Win PCs for infection [4]READ MORE
The GeoBook 1Es are intended for use by schoolchildren isolating at home during the pandemic as well as in schools themselves.
The Reg understands that 77,000 GEO units have shipped so far under GHWT, with several thousand left to ship.
A DfE spokeswoman told The Register : "We are aware of an issue with a small number of devices and we are investigating as an urgent priority to resolve the matter as soon as possible. DfE IT teams are in touch with those who have reported this issue. We believe this is not widespread."
Of the GEO brand, another source said: "I'd never heard of GEO before; it's not a known manufacturer. There have been availability issues for a while now, the world has been buying lots of laptops and sometimes they are buying what they can get because the media and opposition parties are saying: 'You've got to roll this out quicker'."
Sources told us reseller XMA sourced the kit but was not asked to configure it. It was among three resellers supplying the GHWT contract. Computacenter initially bagged an [5]£87m contract to supply GHWT last year and was [6]joined by IT resellers SCC UK and XMA later that year. XMA inked a 12-month contract worth £5.7m covering 26,449 devices, in October 2020. The £2.1m SCC deal, also inked that month, covers another 10,000 devices.
XMA told us it had no comment.
Antivirus firm Sophos described Gamarue in [7]a blog post from 2016 as "a worm that enables remote access to affected systems" which typically "spreads via removable drives".
"When first run, W32/Gamarue-BJ connects to a C2 site to download updates and further instructions," said Sophos.
The malware, well known to antivirus vendors since its inception in 2011, was also distributed in the mid-2010s by the Andromeda botnet. That was KO'd by an [8]international coalition in 2017 .
[9]
If you are worried about your child's laptop, contact their school for help. If the GeoBook has antivirus software, manually update that (if you can) to the latest version and run a full system scan. That should remove any trace of Gamarue. ®
Get our [10]Tech Resources
[1] https://get-help-with-tech.education.gov.uk/start
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YAoHhWCK8IVBmyiCTo6mGwAAAE4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YAoHhWCK8IVBmyiCTo6mGwAAAE4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.theregister.com/2020/12/01/baltimore_ransomware_attack/
[5] https://bidstats.uk/tenders/2021/W01/742457459
[6] https://www.publictechnology.net/articles/news/dfe-expands-supplier-base-laptops-scheme
[7] https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Gamarue-BJ/detailed-analysis.aspx
[8] https://www.theregister.com/2017/12/05/international_team_takes_down_virusspewing_andromeda_botnet/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YAoHhWCK8IVBmyiCTo6mGwAAAE4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Since the laptops are going to the kind of people not privileged enough to know what tcpdump is, I expect someone in a bit of a crappy school IT role stumbled on it.
> Since the laptops are going to the kind of people not privileged enough to know what tcpdump is
Poor kids aren't allowed to know about computers?
They don’t get the eyeball time... Helps to have a computer of your own for that.
"Okay Year Two, have you finished your finger art? It's time for our IPSec PKI VPN and OS config class. Can anyone tell me what a virus is? Not you Mr Williamson, put down your hand. "
We knew the Tories were in bed with the Russians, but we didn't realise it had gone so far that government-issued laptops now come with pre-installed malware that calls home to Moscow!
I would be curious to learn what sort of IP addresses the laptops would try to connect to, the malware's C&C. Is this a Russian hosting provider, a residential IP network, or an IP address hosting kremlin.ru?
Also, whether they asked the Russians to investigate.
Question
What does Moscow need to know what the kids are doing? What interest is it to them?
Re: Question
Once it's on the home network, they'll be able to see whatever the parents working from home are doing too, one or two of them may be employed by someone of interest.
Re: Question
Hmmm, let's see - a "...number of the laptops are infected with a self-propagating network worm ... " Now what could you do with a network worm on a child's laptop? Maybe propagate to dad or mom's computer that connects to their work network? Or that they use for banking? Seems like a possibility to me.
Re: Question
"What does Moscow need to know what the kids are doing? What interest is it to them?"
They are probably more surprised than we are that this thing has risen from the dead courtesy of DfE. The Russian equivalent is surely a lot more IT aware.
Can only trust myself
I source the gear my kid uses, if there's a meltdown, I know who to blame.
Re: Can only trust myself
Unfortunately, a lot of children are burdened with normals* for parents.
* Defined as someone who has never heard of The Register.
Getting Pwned must be learned
It is a very good education indeed. The young ones have to be taught that getting Pwned is a fact of daily life and work and certainly not to be confused with contradictory to privacy and independent thought. Its like the old motto: "Get'm while they're young".
The ministry and the chain of command has been effective in setting up the future of computing and the next generation of voters. Today it is only calling Moscow to test the back door links to other three and four letter agencies. Next up, automatic thought correction by subliminal computing.
'we believe this is not widespread'
Aka : It only affected a small number of customers.
Yeah. it affected at least 23000 children.
How on God's Green Earth did you order stuff from children without bothering to order from a properly vetted supplier ?
Oh, right, stupid me. It would have cost more.
Well, enjoy your savings now.
Re: 'we believe this is not widespread'
"Oh, right, stupid me. It would have cost more." but it never does does it? This lot really would let the ship sink than spend the money on a haperth of tar, especially when they can spend the money in a mates pub.
Re: 'we believe this is not widespread'
Another one to add to the pile for [1]Good Law Project ?
[1] https://twitter.com/mattdoveywriter/status/1348192078904369157
Plausible Deniability
Putting a tinfoil hat on, is this a case of plausable denability or maybe just too much conspiricy theory?
Either someone in UK Gov is incompetant for giving out comprimised machines OR They are not comprimised and instead contain UK gov approved malware pre-installed with the target being in Russia (rather than GCHQ or similar) for plausable denability purposes.
Re: Plausible Deniability
Calm down. It's just a cockspur, which is par for the course when it comes to the government.
Re: Plausible Deniability
Of course it could be the Chinese aiming to embarrass the Russians. Or the EU for similar reasons. Or Trump, because Trump. Or maybe the DFE to assist in it's claim for a bigger budget. Oh - the possibilities...
@TDog - Re: Plausible Deniability
OK, everybody stay calm, you hear me ? Stay calm!
Surely if this is a ten year old bit of malware Windows will have long ago been patched against the vulnerability? If so then these laptops are using a Windows image with ten years worth of unpatched vulnerabilities, not just the one that is already there?
A 10 year old Windows 10 image?
Doesn't Windows Defender pick it up?! We have these laptops so how the bloomin' heck do we clean them...
Apparently only some builds are infected, Windows Defender does detect it, and the recovery partition does not contain the virus so if your build has it then reinstalling from recovery would be the way to go. [1]Read on from here .
[1] http://www.edugeek.net/forums/hardware/218211-geo-geobook-1e-education-laptops-horrible-8.html#post1881301
Sounds familiar....
Here in the US, smartphones given out through the government's "LifeLine" assistance program come with preinstalled malware that also calls home to Russian (and Chinese) servers:
https://staging-blog.malwarebytes.com/android/2020/07/we-found-yet-another-phone-with-pre-installed-malware-via-the-lifeline-assistance-program/
The phones also contain a backdoor that can grant any app any permission, install apps remotely and runs as SYSTEM.
Windows telemetry options ?
I suspect that these were left at Microsoft default so these machines would have been phoning home to Uncle Sam anyway.
"We are aware of an issue with a small number of devices"
Sounds like Baroness Dido Harding has given them a copy of her book of corporate IT fuckup excuses.
"Chapter 5 : A limited number of users may have been affected by this problem"
Re: "We are aware of an issue with a small number of devices"
Nice one! A small number is 7 a slightly larger number is 43, a pretty big number is 20,000 + Although, comparing her disaster numbers to this incident, 20,000 can be considered a smaller number, considerably smaller...
I wonder what sort of machine you get for less then £200 per unit.
If you do some napkin maths on the maximum cost of the laptops, then understand that there should be a hefty proffit from that, what sort of 4Gb, Atom 32Gb HDD machines are we talking here? - do they meet the current minimum specs for Windows 10?
Anybody know what the spec of the Laptops were?, did you need to connect them to your internert router with a bit of wet string?
Re: I wonder what sort of machine you get for less then £200 per unit.
Double that storage and you've got it. Specs are [1]here , if you dare go to their website.
[1] https://geo-computers.com/geobook-1e/
Re: I wonder what sort of machine you get for less then £200 per unit.
A poke around the Geo website was remarkably uninformative. A poke at Google suggests an entry level Celeron, 4Gb of Ram (notable silence as to the type, so DDR3, one assumes), 64Gb storage (all the other Geo lappys are eMMC).
My 11 year old Asus Zen UL30 is probably still faster (and has a 500Gb hdd) than that piece of shite.
"Sources told us reseller XMA sourced the kit but was not asked to configure it"
"Sources told us reseller XMA sourced the kit but was not asked to configure it."
Does this mean:
XMA sources the kit, but another IT company was then responsible for putting a DfE standard OS install on it (this sort of fragmented division of responsibilities does happen), in which case, who is the second unlucky company?
or (shudder): XMA sources the kit, from a manufacturer that hardly anyone has heard of, and, seeing that the computers already have a manufacturer supplied install (that, being a reputable manufacturer, definitely carries no risk that it could have been mastered from some knocked-together unlicensed passed around warez DVD), thinks (or, worse, is told by DfE): "Yeah, reckon that'll be fine. Ship 'em!"
DfE IT teams are in touch with those who have reported this issue. We believe this is not widespread."
AKA, they don't f*cking know what is happening, and how widespread it is.
How many people monitor their internet packets to determine the phone home ???