New self-protecting USB trojan able to avoid detection

By Tomáš Gardoň posted 23 Mar 2016 - 02:49PM

A unique data-stealing trojan has been spotted on USB devices in the wild – and it is different from typical data-stealing malware. Each instance of this trojan relies on the particular USB device on which it is installed and it leaves no evidence on the compromised system. Moreover, it uses a very special mechanism to protect itself from being reproduced or copied, which makes it even harder to detect.

In this article we will examine the technical details of this interesting malware.

”What really sets this malware apart is its self-protection mechanism.”

Where other malware uses ‘good old-fashioned approaches’ like Autorun files or crafted shortcuts in order to get users to run it, USB Thief uses also another technique. This method depends on the increasingly common practice of storing portable versions of popular applications such as Firefox, NotePad++ and TrueCrypt on USB drives.

The malware takes advantage of this trend by inserting itself into the command chain of such applications, in the form of a plugin or a dynamically linked library (DLL). And therefore, whenever such an application is executed, the malware will also be run in the background.

What really sets this malware apart, however, is its self-protection mechanism.

The protection mechanism

The malware consists of six files. Four of them are executables and the other two contain configuration data. To protect itself from copying or reverse engineering, the malware uses two techniques. Firstly, some of the individual files are AES128-encrypted; secondly, their filenames are generated from cryptographic elements.

The AES encryption key is computed from the unique USB device ID, and certain disk properties of the USB drive hosting the malware. Hence, the malware can only run successfully from that particular USB device.

The name of the next file in malware execution chain is based on actual file content and its creation time. It is the first five bytes of SHA512 hash computed from mentioned attributes (file content concatenated with eight bytes of the creation time).

Because of this, filenames are different for every instance of this malware. Moreover, copying malware to a different place will replace the file creation time so that malicious actions associated with the previous locality cannot be reproduced. For a better understanding of the naming technique, please see the image below.

It was quite challenging to analyze this malware because we had no access to any malicious USB device. Moreover, we had no dropper, so we could not create a suitably afflicted USB drive under controlled conditions for further analysis.

Only the submitted files can be analyzed, so the unique device ID had to be brute-forced and combined with common USB disk properties. Moreover, after successful decryption of the malware files, we had to find out the right order of the executables and configuration files, because the file copying process to get the samples to us had changed the file creation timestamp on the samples.

The execution flow of malware is quite simple. Each loader, in turn, loads and executes the following loader identified by computed hash according to the naming technique described above. However the execution must always start with the first stage loader, otherwise the malware terminates itself.

Tech Giants to Boost Encryption

Some of the most prominent names in tech are pursuing the development of much tougher encryption technologies, it has been revealed.

According to the Guardian, Google, Facebook and Snapchat are reportedly bolstering their respective encryption services, which they have been doing for some time now.

The newspaper said that these security initiatives preempt the latest highly publicized legal battle between Apple and the US Department of Justice.

This particular case, which centers on the FBI wanting access to an iPhone belonging to one of the two attackers in December’s San Bernardino shooting, has become “the battleground” in the privacy versus security debate.

Breaking the news, the Guardian’s technology reporter, Danny Yadron, said that these “projects could antagonize authorities just as much as Apple’s more secure iPhone”.

“The efforts come at a crossroads for Silicon Valley.”

“The efforts come at a crossroads for Silicon Valley. Google, Facebook, Snapchat, Amazon, Microsoft and Twitter have all signed on to legal briefs supporting Apple in its court case,” he went on to say.

“At the same time, some of the companies have shown an increased willingness to help the government in its efforts to fight the spread of Islamic extremist propaganda online – often using their services.”

In his exclusive, Mr. Yadron stated that there is renewed internal interest in Google’s End to End project; while Facebook is boosting WhatsApp’s security so that encryption covers voice calls. Meanwhile, Snapchat is said to be developing a “secure messaging system”.

It is increasingly evident that when it comes to encryption, neither tech companies nor governments and law enforcement bodies are willing to back down over key areas.

Apple, for example, remains committed to encryption in its purest sense, stating that the introduction of any kind of backdoor compromises its integrity.

“There have been people that suggest that we should have a backdoor,” Apple’s CEO Tim Cook said at the end of 2015.

“But the reality is if you put a backdoor in, that backdoor’s for everybody, for good guys and bad guys.”

FBI warn that automobiles are vulnerable to cyberattacks

By Karl Thomas 

22
inShare

The Federal Bureau of Investigation (FBI) has issued a public service announcement warning drivers that automobiles are “increasingly vulnerable” to cyberattacks.

The announcement, which was made in partnership with the Department of Transportation and the National Highway Traffic and Safety Administration, cites a study from August 2015 in which researchers identified vulnerabilities in a radio module of a MY2014 passenger vehicle.

In the study, the researchers found that they were able to manipulate door locks, turn signals and even disable brakes when the car was travelling at slow speeds.

They were also able to modify vehicle functions by hacking the electrical control units in the car. These ECUs control various vehicle functions including steering, braking and acceleration, as well as windshield wipers and headlights.

“While the identified vulnerabilities have been addressed, it is important that consumers and manufacturers are aware of the possible threats and how an attacker may seek to remotely exploit vulnerabilities in the future,” the FBI said.

The bureau also warned that in addition to vehicles being attacked through their ECUs, vulnerabilities also exist in mobile devices – such as a cellular phone or tablet connected to the vehicle via USB, Bluetooth or Wi-Fi, or within a third-party device connected through a vehicle diagnostic port. 

This announcement comes eight months after a group of security researchers successfully shut down a Jeep Cherokee travelling at 70mph by hacking into its controls, prompting a 1.4 million product recall.

The FBI advises that consumers protect themselves by maintaining an awareness of the latest recalls and updates affecting their motor vehicles and avoid making unauthorized modifications to their vehicles software.