Proprietary · · 32 days

Samsung picture frame CD shipped malware

Samsung's SPF-85H digital picture frame shipped with a Windows driver CD whose Frame Manager XP 1.08 installer carried malware.

The Samsung incident was physical-media supply chain rather than a compromised web download. Customers bought a digital picture frame, inserted the bundled CD, and installed Frame Manager XP 1.08 to connect the device to Windows. The trust came from the box on the shelf and the Samsung-branded installer media.

The infected installer was reported with the Sality family and related detections. Trend Micro's write-up called it a Sality worm and recorded it as Troj_Agent.xoo, while Amazon and Symantec named it W32.Sality.AE, and The Register and SANS ISC relayed Amazon's warning to customers who had received the affected frames. The clean path was to remove the CD-installed software and install Frame Manager 1.082 from Samsung.

Samsung's 2008-11-27 advisory named five frames: SPF-75H, SPF-76H, SPF-85H, SPF-85P, and SPF-105P. Amazon's own notice to customers named only the SPF-85H. The reports do not establish that every unit or every model shipment carried the infected disc, so this record scopes the artifact to the Frame Manager XP 1.08 installer CD and treats the model list as affected-distribution context.

The case is a reminder that boxed hardware can carry software supply-chain risk without any network compromise. The installer media arrived with the product, so the user's first security decision was made before they ever visited a vendor download page.

Appendix · Affected releases

Samsung Frame Manager XP fixed 1.082
1.08
  • The replacement Frame Manager 1.082 download was described by Computerworld as "an updated - and theoretically malware-free - version"; no source we hold states that it was verified clean.
  • Samsung's advisory says "a batch of Photo Frame Driver CDs contain [sic] a worm virus in the Frame Manager software". Only Windows XP was affected; Vista was immune. The disc was required to use the frame as a USB monitor, so skipping it was not an option for that use.
  • Samsung did not state how the malware reached the disc, or how it passed quality control. The Register's duplication-machine explanation is explicit speculation.
  • SANS ISC preserved Amazon guidance telling customers to uninstall the CD version, install the clean update, and run antivirus cleanup.

References

  1. Samsung digital picture frame CD infected by virustheregister.com
  2. Yet Another Digital Picture Frame Malware Incidenttrendmicro.com
  3. Samsung Digital Picture Frame shipped with Malwareisc.sans.edu
  4. Amazon Warns Customers of Infected Digital Photo Framesfirewall.cx

Source record: proprietary/samsung-picture-frame/meta.yaml