Laptops given to British schools came preloaded with remote-access worm

A shipment of laptops supplied to British schools by the Department for Education to help kids learn under lockdown came preloaded with malware, The Register can reveal. The affected laptops, distributed to schools under the UK government's Get Help With Technology (GHWT) scheme, which started last year, came bundled with …

[Anonymous Coward]

DfE IT teams are in touch with those who have reported this issue. We believe this is not widespread."

AKA, they don't f*cking know what is happening, and how widespread it is.

How many people monitor their internet packets to determine the phone home ???

[Anonymous Coward]

Since the laptops are going to the kind of people not privileged enough to know what tcpdump is, I expect someone in a bit of a crappy school IT role stumbled on it.

[monty75]

> Since the laptops are going to the kind of people not privileged enough to know what tcpdump is

Poor kids aren't allowed to know about computers?

[Anonymous Coward]

They don’t get the eyeball time... Helps to have a computer of your own for that.

[Blazde]

Back in my day it was the poor kids, who genuinely valued their hardware access, that knew the most about it. The rich kids had far too much cool stuff to play with to care why or how one flashy gizmo among many actually worked.

[sanmigueelbeer]

We believe this is not widespread.

Translation: Only <22,990 laptops are affected, ergo, "not widespread".

[Danny 2]

"Okay Year Two, have you finished your finger art? It's time for our IPSec PKI VPN and OS config class. Can anyone tell me what a virus is? Not you Mr Williamson, put down your hand. "

[Anonymous Coward]

We knew the Tories were in bed with the Russians, but we didn't realise it had gone so far that government-issued laptops now come with pre-installed malware that calls home to Moscow!

[Muppet Boss]

I would be curious to learn what sort of IP addresses the laptops would try to connect to, the malware's C&C. Is this a Russian hosting provider, a residential IP network, or an IP address hosting kremlin.ru?

Also, whether they asked the Russians to investigate.

[pintofbitter]

and I got a load of down votes for asking why the hell we let a "red" Chinese company into our networks ! Well done Boris !

[BigSLitleP]

aaaand you're going to get more downvotes for equating two things that are not related.

[Zebo-the-Fat]

Question

What does Moscow need to know what the kids are doing? What interest is it to them?

[druck]

Re: Question

Once it's on the home network, they'll be able to see whatever the parents working from home are doing too, one or two of them may be employed by someone of interest.

[0laf]

Re: Question

Some schools are on networks shared with local authorities.

Local authorities have network links into central government departments.

Hitting schools is a low cost, low risk supply line attack so well worth doing even if the chance of a big payoff are low as well.

If nothing else hitting schools causes a general disruption especially if kids going home affects industry, government and decreses general trust in the goverment as a whole.

[RM Myers]

Re: Question

Hmmm, let's see - a "...number of the laptops are infected with a self-propagating network worm ... " Now what could you do with a network worm on a child's laptop? Maybe propagate to dad or mom's computer that connects to their work network? Or that they use for banking? Seems like a possibility to me.

[steelpillow]

Re: Question

"What does Moscow need to know what the kids are doing? What interest is it to them?"

They are probably more surprised than we are that this thing has risen from the dead courtesy of DfE. The Russian equivalent is surely a lot more IT aware.

[chivo243]

Can only trust myself

I source the gear my kid uses, if there's a meltdown, I know who to blame.

[Jason Hindle]

Re: Can only trust myself

Unfortunately, a lot of children are burdened with normals* for parents.

* Defined as someone who has never heard of The Register.

[Tomato42]

Re: Can only trust myself

I believe the term of choice is "muggle"

[PickledAardvark]

Re: Can only trust myself

'Meltdown' is an unfortunate term owing to the number of bedroom fires caused by overheating computer devices and power supplies.

[NightFox]

Re: Can only trust myself

Fine for those who can afford to - thousands are struggling just to 'source' the food their kids eat.

[b0llchit]

Getting Pwned must be learned

It is a very good education indeed. The young ones have to be taught that getting Pwned is a fact of daily life and work and certainly not to be confused with contradictory to privacy and independent thought. Its like the old motto: "Get'm while they're young".

The ministry and the chain of command has been effective in setting up the future of computing and the next generation of voters. Today it is only calling Moscow to test the back door links to other three and four letter agencies. Next up, automatic thought correction by subliminal computing.

[Pascal Monett]

'we believe this is not widespread'

Aka : It only affected a small number of customers.

Yeah. it affected at least 23000 children.

How on God's Green Earth did you order stuff from children without bothering to order from a properly vetted supplier ?

Oh, right, stupid me. It would have cost more.

Well, enjoy your savings now.

[Tom 7]

Re: 'we believe this is not widespread'

"Oh, right, stupid me. It would have cost more." but it never does does it? This lot really would let the ship sink than spend the money on a haperth of tar, especially when they can spend the money in a mates pub.

[Dan 55]

Re: 'we believe this is not widespread'

Another one to add to the pile for Good Law Project?

[katrinab]

Re: 'we believe this is not widespread'

“ Oh, right, stupid me. It would have cost more.”

Nope, that’s not how this Tory government works. Contracts go to Tory donors for way above market value, and the donations aren’t that big, typically around £10,000. [1]

[1] As alleged by The Good Law Project. Court case pending.

[Danny Boyd]

Re: 'we believe this is not widespread'

Tory, shmory... They explained clearly: the supply was short, so they grabbed what was available, because media and opposition put a pressure on them to move fast.

[hoola]

Re: 'we believe this is not widespread'

I would have thought this was in the base image, all or nothing. One assumes as it has been found then it is all.

Utter incompetence on the part of the people procuring them. Presumably the came by the container load and were broken done for distribution without anyone even checking what was in the box.

I love the phrase about Antivirus software. There appear to be Windows 10 so there is Defender built in by default. It just is limited in the protection it gives compared to other products. If they have installed something else then one assumes that it is a freebee so who knows what it is doing.

[DevOpsTimothyC]

Plausible Deniability

Putting a tinfoil hat on, is this a case of plausable denability or maybe just too much conspiricy theory?

Either someone in UK Gov is incompetant for giving out comprimised machines OR They are not comprimised and instead contain UK gov approved malware pre-installed with the target being in Russia (rather than GCHQ or similar) for plausable denability purposes.

[Test Man]

Re: Plausible Deniability

Calm down. It's just a cockspur, which is par for the course when it comes to the government.

[TDog]

Re: Plausible Deniability

Of course it could be the Chinese aiming to embarrass the Russians. Or the EU for similar reasons. Or Trump, because Trump. Or maybe the DFE to assist in it's claim for a bigger budget. Oh - the possibilities...

[Anonymous Coward]

@TDog - Re: Plausible Deniability

OK, everybody stay calm, you hear me ? Stay calm!

[JDPower]

Surely if this is a ten year old bit of malware Windows will have long ago been patched against the vulnerability? If so then these laptops are using a Windows image with ten years worth of unpatched vulnerabilities, not just the one that is already there?

[TRT]

A 10 year old Windows 10 image?

[JDPower]

Even more reason why this must be a patched vulnerability.

[Kane]

Wooooosh...

[TRT]

Of course, one could argue that there's more than 10 yearsworth of unpatched vulnerabilities in a even week old Windows 10 image...

[pc-fluesterer.info]

Malware != vulnerability

not every malware relies on vulnerabilities. A vulnerability, if at all, you only need as part of an attack vector to infiltrate a system. But as well you can implement a RAT or whatever malware targeted and manually if you can get hold of the machine(s) in question. That doesn't employ a vulnerability.

[JDPower]

Re: Malware != vulnerability

Thanks for explaining what I was missing instead of just posting a smug reply. I presume Windows Defender would block this 10 year old known malware, so whilst it shouldn't have happened it's still a slight non issue (rather than the articles implication that these laptops are all sending data to Russia)

[TRT]

Re: Malware != vulnerability

Indeed, the volume just needs to be mounted as a writeable filesystem on an infected host, say a bulk duplicator, in order for whatever installer or package is involved to appear on that media.

[blokemoke]

Doesn't Windows Defender pick it up?! We have these laptops so how the bloomin' heck do we clean them...

[Dan 55]

Apparently only some builds are infected, Windows Defender does detect it, and the recovery partition does not contain the virus so if your build has it then reinstalling from recovery would be the way to go. Read on from here.

[Anonymous Coward]

Sounds familiar....

Here in the US, smartphones given out through the government's "LifeLine" assistance program come with preinstalled malware that also calls home to Russian (and Chinese) servers:

https://staging-blog.malwarebytes.com/android/2020/07/we-found-yet-another-phone-with-pre-installed-malware-via-the-lifeline-assistance-program/

The phones also contain a backdoor that can grant any app any permission, install apps remotely and runs as SYSTEM.

[alain williams]

Windows telemetry options ?

I suspect that these were left at Microsoft default so these machines would have been phoning home to Uncle Sam anyway.

[Howard Sway]

"We are aware of an issue with a small number of devices"

Sounds like Baroness Dido Harding has given them a copy of her book of corporate IT fuckup excuses.

"Chapter 5 : A limited number of users may have been affected by this problem"

[chivo243]

Re: "We are aware of an issue with a small number of devices"

Nice one! A small number is 7 a slightly larger number is 43, a pretty big number is 20,000 + Although, comparing her disaster numbers to this incident, 20,000 can be considered a smaller number, considerably smaller...

[katrinab]

Re: "We are aware of an issue with a small number of devices"

The number of people affected is limited by the school population of the country. Therefore it is correct to say it is a limited number.

[John Brown (no body)]

Re: "We are aware of an issue with a small number of devices"

And the first Google result tells me there were 11.7 million school age students in the UK in 2016. So 20,000ish is a small number in that respect. It's not a good result, but it's far from being the disaster some are claiming.

[Doctor Syntax]

Re: "We are aware of an issue with a small number of devices"

Not needed. Unless they're able to prefix every statement with that and/or "Your security is important to us." as appropriate nobody is allowed into the PR profession.