Malicious software in school and student textbooks

Over 53,500 malicious or potentially unwanted files disguised as ready-to-use textbooks and books for schools and universities have been found by Kaspersky experts.

From August 2018 to July 2019, 356,662 attacks were used on 104,819 users; a decrease of 21% compared to the previous year.

These are among the main findings of Kaspersky’s “Back to School” report, and while some may find textbooks quite expensive, they are an inevitable part of any educational program.

As a result, many textbooks can be found online, and students can avoid the high cost of downloading them from pirated websites or file hosting forums, along with student textbooks. However, malicious players are willing to use student hunger for knowledge and academic success as an opportunity to distribute malware.

In total, 17,755 threats disguised as textbooks were identified, and most of the time they were presented as English (2,080), Mathematics (1,213) and Literature (870) textbooks. The types of threats behind these “disguises” varied: from annoying, but not destructive adware or spam, to extremely dangerous malware.

The remaining 35,776 threats were disguised in literature and reports on various topics. As the researchers examined them more carefully, they noticed something unusual. In 35.5% of the cases, the most popular malware was an eight-year-old “worm” virus; an outdated threat that is not often seen today. It was actively distributed through a specific attack carrier; the USB-stick.

After careful testing, experts concluded that the worm “lives” on computers, student printing services, often used for years without regular security updates and running outdated software, seemingly reaching there through a job that needs to be printed.

“Students who try to avoid paying for textbooks and other educational materials create an opportunity for digital criminals they simply cannot resist. This is a serious problem for educational organizations, as when the “infection” is transmitted to a computer on the school network, it can spread very easily.

Not all schools are ready to respond effectively to such incidents, as educational organizations are not considered a typical target for scammers, but threatened players take every opportunity possible. That is why preventive measures are vital for such organizations.”

said Maria Fedorova, a security researcher at Kaspersky.