Saturday, 16 February 2008

Linkage

Were you given a digital photo frame over the holiday?

Did you connect it to your computer?  You may be PWN3D:

An insidious computer virus recently discovered on digital photo frames has been identified as a powerful new Trojan Horse from China that collects passwords for online games - and its designers might have larger targets in mind.
...
The initial reports of infected frames came from people who had bought them over the holidays from Sam's Club and Best Buy.  New reports involve frames sold at Target and Costco, according to SANS, a group of security researchers in Bethesda, Md., who began asking for accounts of infected devices on Christmas Day.
...
...the researchers also found four other, older Trojans on each frame, which may serve as markers for botnets - networks of infected PCs that are remotely controlled by hackers. - San Francisco Chronicle
It's the old autorun game...

Best Buy should have been alert for this kind of stuff already.  The mass merchants (Sam's Club, Target, and Costco) had better learn quickly.

Elsewhere:
SANS Diary:  Digital Hitchhikers
SANS Diary:  Digital Hitchhikers part 2
SANS Diary:  Digital Hitchhikers part 3
SANS Diary:  Digital Hitchhikers part 4  (detailed info on Best Buy/Sams Club product)
SANS Diary:  Insignia Photo Frame Malware Request

Microsoft TechNet:  Island Hopping - the Infectious Allure of Vendor Swag
A Vista®-centric article, but buried within is this scary stuff:
The tools I have discussed so far use U3 (u3.com), a technology designed to enable users to bring programs with them on a flash drive.  In a nutshell, a U3-enabled flash drive lies about itself. It tells the OS that it is actually a USB hub with a flash drive and a CD plugged into it.  Windows® versions prior to Windows Vista® will, by default, automatically run programs designated in the autorun.inf file on CDs, but not on USB drives.  By lying about itself, the U3-enabled USB flash drive fools the OS into autorunning something called the U3 launcher.  The U3 launcher, in turn, can start programs, give you a menu, or do pretty much anything that you could do with the computer yourself.

All the exploit tools do is replace the launcher with the exploit code.  As soon as the flash drive is plugged into a Windows XP system, the exploit tool automatically runs.

Via:  Instapundit

Posted by: Old Grouch in Linkage at 21:12:20 GMT | No Comments | Add Comment
Post contains 387 words, total size 4 kb.

Comments are disabled. Post is locked.
70kb generated in CPU 0.0965, elapsed 0.3919 seconds.
51 queries taking 0.3841 seconds, 207 records returned.
Powered by Minx 1.1.6c-pink.