[Windows 8 General] GoodDayToDie:
Erm... I'm sorry, but that is absolutely incorrect. While a lot of skepticism about this attack is absolutely warranted, the physics involved are not in any way the reason. I suspect that the source of your confusion is that you're confusing the communication method between infected machines (the ultrasonic sound waves) for an infection vector; it is not. You still make many false claims, though.

First point: a (sufficiently powerful) radio transmission can *easily* disrupt electronic devices not intended as receivers. Ask any HAM radio operator, especially if they have ever tried to use a PC near their rig. Iron ferrite "chokes" are used on wires (such as video, mouse, and keyboard cables, among others) to absorb signals which originate from high-frequency sources like radio waves. While it's true that equipment not specifically intended to receive radio frequencies is *usually* not interfered with unless the source of the interference is fairly strong or fairly close (only a few Watts of broadcast power in close proximity, but it falls off very rapidly with distance), it's inaccurate to claim that it doesn't happen.

Second point: the "special material" which receivers are made of is typically copper. It can be any conductive material, though. A basic knowledge of electromagnetism would make this pretty obvious; as a changing electromagnetic field (such as a radio wave) intersecting an electrical conductor (such as a radio antenna, which is often basically just a copper wire or tube with an anti-corrosion coating on it) will induce an electric field in the conductor. It's true that the conductor needs to be "tuned" (modified to have an effective length which is - typically - some integer fraction of the wavelength of the EM wave) in order to establish the standing waves (constructive interference; this is *slightly* more advanced physics) necessary to make that frequency stand out enough to generate a particularly strong electrical signal, but it's not very hard to tune an antenna. Your typical civilian FM radio broadcasts, for example, span a considerable frequency range with a difference in wavelength of around 25% from the highest to the lowest frequency, yet your car (or phone) can receive them all using the same antenna.

Third point: compression is irrelevant. If you're communicating between two devices which are *supposed* to communicate, such as between WiFi adapters, the decoding will happen automatically in the hardware. If you're communicating between two analog interfaces, such as a speaker and a microphone, the signals will pass through an ADC - an Analog/Digital Converter - to transform them between the digital format that the computing hardware understands and the analog waveforms of the transmission medium.

Fourth point: there is absolutely no reason why you couldn't infect a system through a USB device. When a USB port is connected, the machine queries the device for its particulars, including the device ID (how your computer knows the difference between an iPod and a printer), USB interface version, and other metadata. This happens even in modern BIOSes and EFI systems; how else could a computer boot from a flashdrive or external hard drive or USB-connected floppy drive? A vulnerability in the code which handles this handshaking could be exploited by the device - after all, there's an exchange of data going on, and the data needs to be parsed and processed - to take over the system at the firmware level.

Fifth point (but related to fourth): exactly *what* sort of "security system" do you expect to catch this? Your antivirus program, the one that runs as a process on the CPU and probably doesn't even pay attention to USB connections and disconnections, only to file systems being mounted or removed? Your state-of-the-art BIOS security, which amounts to requiring a password before running the Setup program and allowing you to block writes to the boot sector of the disk? The machine you pass every USB device through before connecting it to your computer, which uncaps the chips and traces out all their circuitry looking for anything that would send unexpected data?

Sixth point: You want to know the difference between a speaker and a microphone? Whether you pay attention to the currents constantly travelling on the wire from the transducer, or only bother applying your own currents to make the driver move. Mics typically need amplification (a trivially simple electrical circuit, by the way, EE101 material if you didn't learn it earlier) before the signals are strong enough to drive another speaker loudly enough for you to hear it, and it's possible to make a transducer which is much better suited to be a speaker or a mic, but either one can act as either.

Seventh point: pretty irrelevant, but unless you put a diode on that wire, electricity can flow down a wire in either direction. Speakers (and mics) don't typically have diodes. In fact, sometimes they are explicitly designed to have electricity flow in both directions as the sound waves move the magnet closer and further from the coil (for electromagnet-driven microphones; there are other kinds) or the electrical signals flow one direction to push the driver's magnet out and the other direction to draw it closer in (for electromagnet-driven speakers).

Eighth point: also pretty irrelevant, but speaker and microphone cables actually make pretty decent radio antennas. Ever noticed how smartphones require you to have headphones connected before the phone can pick up FM radio? That's because it uses the wire to pick up the signals from the radio waves. The frequencies are much too high for you to hear - typically radio waves in in the range of hundreds of kilohertz up well into the gigahertz, while audio signals are only a handful of kilohertz (most humans can't hear any higher than the low double digits of KHz). They are also *usually* pretty faint, but not always. Try listening to a speaker whose wire goes past a poorly-shielded AC motor (or anything else with significant AC current flow) and you'll hear a distinct 60Hz (or 50Hz, depending on what the mains in your country uses) hum. It's low-pitched, but it's audible, and it is coming from the AC wires and/or equipment into your speaker wires, then being rendered into sound by the speaker drivers.

Ninth point: back to the malware at hand, the radio waves aren't affecting the BIOS directly at all. The radio waves are being picked up by the radio transceiver (you would probably call it a WiFi adapter) and being converted into digital signals, then those signals are being sent to the rest of the computer. With the right exploits in the OS and/or BIOS, those signals could trigger the firmware flashing system, overwriting your BIOS/EFI with data from the transmitting computer.

Tenth point, and looping back to something you seem to have misunderstood from the beginning: the reason that this malware is so unusual is because it communicates between infected machines without any conventional network interface (including WiFi); instead, transmissions are sent via the speakers and received via the microphones. Some very low-level program is monitoring the data from the mic at all times (no different really, aside from being hidden, than any other program that listens to the microphone), looking for any waveforms that resemble the data it expects. Because this data is sent at a range outside of human hearing, you don't even notice it happening. Because it doesn't go over the conventional network interfaces, it works on "airgapped" computers that have their conventional interfaces disabled or removed. It probably doesn't have much range - the speakers aren't that powerful (or microphones that sensitive), especially so far outside their designed optimum frequency range, and there will be a lot of interference - but normally it's considered safe to have airgapped PCs sitting in the same room as one another, so you can analyze one (with the malware on it) while you remain connected to the Internet on the other.

I repeat: I remain skeptical. The infection vector is not fully determined right now, and the proposed option - USB devices (as opposed to data within USB devices) that attack the system they are connected to - is conceivable but unlikely. The concept of using the speakers and microphone as a short-range communication bus between airgapped machines is totally possible - it's been done before - but the use of sound as a communication medium was not conclusively proven, and anything well outside of human hearing range is going to be hard for the speakers to send and mics to pick up, most likely. The concept of malware that attacks the system firmware is totally reasonable, but usually it woul need to be very precisely targeted at that firmware; two Lenovos of the same family might both be vulnerable, a Lenovo and a Dell probably wouldn't be unless the attack was extremely sophisticated.

The most unlikely part of the story is frankly that it's so incredibly persistently attacking this one individual, but nobody else has reported it. There are a *lot* of security researchers in the world, with a lot of flashdrives being passed around between people and a lot of PCs that they've been connected to, and nobody else has noticed this attack despite it having some pretty clear markers Without independent verification and ideally a bit more study, it remains, at best, a curiosity.

Whatever it is, it doesn't come close to warranting a thread with WARNING in the subject line! [MENTION=5105831]ricky310711[/MENTION], you should feel ashamed of yourself for trying to spread fear. Your summary of how this thing is believed to operate is almost as inaccurate as your assessment of its threat level, and overly sensational besides. For shame!