The Windows-based Fuji photo kiosks located in the company's stores apparently don't run antivirus software, so lovely little bits of malicious software like Trojan.Poison-36 are winding up on customers' USB keys, according to Risky Business listener and blogger Morgan Storey.
On its own, an isolated incident of a photo kiosk infecting a USB device might not be newsworthy. But what makes this item stick out is Big W's reply to Morgan after he notified the company of the issue:
That's right folks, Big W, a subsidiary of Woolworths, didn't think it necessary to install antivirus on its photo printing kiosks. Sure, they're evaluating AV now, but blind Freddy could have seen this problem coming last year when the kiosks were installed.
What the hell were they thinking?
It's not just the lack of AV that's the problem. As Morgan points out it appears there's been zero thought put into the problem of malware spreading via these kiosks. Why not just treat customers USB devices as read-only? Why allow the kiosks to write to them at all?
Risky.Biz has so far been unable to confirm Morgan's post with Big W. According to the company's HQ the PR guy doesn't like being phoned and only takes media requests via e-mail. Seems an odd way to conduct PR, but hey, each to their own.
Risky.Biz e-mailed a series of questions to Big W at lunchtime today but as yet they remain unanswered.
It would be interesting to find out which company -- Fuji, Big W or even some other third party -- is responsible for the maintenance of the machines. It would also be interesting to find out if there are any liability issues here for Big W in light of its boneheaded lack of security planning.
