Vendor FAIL - Certified Pre-Owned (CPO)

How vendors screw up their own products and leave YOU holding the virtual bag

For reasons unknown, vendors occasionally fail to maintain quality control over the media they ship. Whether it is CD-ROM, DVD, USB or some other form of media, it may contain viruses, trojans or even drug-runner music. When this happens, the software you receive obviously can't be trusted in any fashion, and installing software from already compromised media immediately puts your system's integrity in question. This page serves to keep a record of such incidents and remind vendors that shipping "pre-0wned" software is deplorable. This list is designed to capture consumer related exposures, specifically malware or other items of interest. This list will not include incidents of vendors shipping vulnerable software as that list would be extensive. In addition, it will not track targeted malware attacks against specific targets, such as the "Farewell Dossier". For an interesting historical perspective of such incidents until 1996, consult McDonald's list. Some of these incidents are integrated in the CPO list depending on the information available.

This list is not complete, yet it should make you realize that nothing is safe. Every piece of electronics you buy and every piece of software you install may come with malware pre-installed. Rather than manufacturers introducing a higher set of quality controls to prevent such incidents, we will no doubt see companies produce new products that will help keep you "safe" from such threats. These "controls" would no-doubt be another bandaid on top of bandaids that make up a lucrative market, which is sad commentary about how customers perceive and receive "electronic security".

Copyright 2008 by Attrition.org. Permission is granted to quote, reprint or redistribute provided the text is not altered, and appropriate credit is given. Term "certified pre-owned" courtesy of Dan Geer.