Slashdot Log In
Trojan Found In New HDs Sold In Taiwan
Posted by
kdawson
on Sun Nov 11, 2007 09:36 PM
from the bourne-again dept.
from the bourne-again dept.
GSGKT writes "About 1,800 brand new 300-GB or 500-GB external hard drives made for Maxtor in Thailand were found to have trojan horse malwares pre-installed (autorun.inf and ghost.pif). When the HD is in use, these forward information on the disk to two websites in Beijing, China: www.nice8.org or www.we168.org. The article implies that authorities believe the Chinese government is behind the trojans. A later article pins down the point of infection to a subcontractor company in China. A couple of months back the Register was reporting on pre-installed malware detected on Maxtor disks sold in the Netherlands. This earlier report was downplayed by a Seagate spokesman." The more recent Taipei Times article says that Seagate admits the problem on its Web site, but a search there turns up nothing.
Related Stories
[+]
IT: Russian Phishers Moving to China? 67 comments
Hugh Pickens writes "The Russian Business Network, an ISP and Web hosting provider based in St. Petersburg, whose client list amounts to a laundry list of organized cybercrime operations appears to have closed shop after a number of its main upstream Internet providers severed ties with the group. The disappearance of RBN comes less than a month after Brian Krebs of the Washington Post wrote a series of stories detailing the organization and history of the shadowy ISP. However, experts at anti-spam group Spamhaus say there are strong indications that a huge swath of Internet space recently established in China may soon emerge as the next incarnation of the Russian Business Network. In related news FBI Director Robert S. Mueller, III gave a speech on cybercrime earlier this week where he said that the FBI has 60 Legal Attaché offices around the world working with partners in Russia, Romania,Poland, Hungary, Italy, and Estonia, among others, to investigate international cyber threats."
[+]
IT: Malware Distribution Through Physical Media a Growing Concern 141 comments
twitter brings us a story about the increasing number of digital devices reaching consumers with malware already installed. In this case, digital photo frames from three different Sam's Club stores were found to contain the same type of malicious code. We discussed a similar problem with iPods a while back, as well as a more recent situation with Maxtor hard drives. Quoting the Register:
"While a compromise at the manufacturer is the most likely scenario, ISC's Sachs also pointed to retailers as a possible point of infection. Returned products, which could have been infected by the consumer, are frequently put back on the shelf, if they are in sale-able condition, and attackers could take advantage of a store's poor digital hygiene, he said. 'Trying to (infect a product) all the way back at the factory — getting it through all the checks and balances — would be pretty hard to do,' he said. 'But doing it at the store, where there might be loose return policies, and (where) they put it back on the shelf - you are not going to get a million infections, but you might get a person from an investment bank next door.'"
[+]
Digital Picture Frames Infected by Trojan Viruses 174 comments
CR0WTR0B0T writes "The San Francisco Chronicle is running a story on viruses loaded into digital picture frames, similar to the ones we discussed at the end of last year. The difference is in the virus used: 'The authors of the new Trojan Horse are well-funded professionals whose malware has 'specific designs to capture something and not leave traces ... This would be a nuclear bomb of malware.' Apparently, a number of regular folks have hooked them up to their home computer and loaded the virus. And if you think you're too smart to be fooled, apparently the Anti-Virus software makers have not caught up to the threat quite yet."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Same (Score:5, Interesting)
Oh, malware... (Score:5, Funny)
(OK, who's the comedian? My catchpas is "durable".)
Parent
Re:Oh, malware... (Score:5, Funny)
That would suck. Imagine hundreds of geeks getting a box in the mail from NewEgg filled with a product you have no use for.
Parent
Threadjack: WTF? (Score:4, Funny)
Answer : Everyone. Even geeks give up configuring Windows to that point after one hundred reinstalls. Or they give up on Windows already... Okay, "who does not reformat new HDs before use?"
Who buys Maxtor HDs anyway? Never had one that even lasted till the end of warranty, used 8 of those in under two years. And there are not enough hours in one year to make up for the order of magnitude between announced and effective MTBF. (168*52 = way less than "tens of thousands of hours".)
Not that I excuse them for dataraping their customers. The exec that ordered that should be put to a very slow and painful death. With the Maxtor engineering team. (If there even IS one.)
Parent
First off... (Score:5, Funny)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Re:First off... (Score:4, Informative)
In the case of preformatted external drives (which this one is supposed to be), however, not only will the drive immediately become available for access as soon as it's connected, Windows may also try to autorun any programs listed in the drive's autorun.inf.
Parent
Re:First off... (Score:5, Informative)
Parent
Re:First off... (Score:5, Funny)
Parent
Re: (Score:3)
In practice, it's easy to get an app to run invisibly. If someone is trojaning OEM drives, Microsoft's choice of defaulting to the insecure autorun mode means a lot of people will be infected.
Re:First off... (Score:5, Informative)
Works for USB drives and CD-ROMS.
[2007/10, from:
http://www.mydigitallife.info/2006/09/11/disable-auto-run-and-auto-play-of-u3-smart-drives-launchpad/%5D [mydigitallife.info]
1. Click Start -> Run.
2. Type RegEdit in the Open text box, then press ENTER.
3. In the Registry Editor, locate and click the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDRom
4. Modify the value of the Autorun to 0 (zero) so that CD-ROMs and Audio CDs do not run and start automatically when inserted.
5. Next navigate to the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
6. Modify the value of the NoDriveTypeAutoRun entry to 0xb5 value to turn off the AutoRun feature for CD-ROMs by right-click NoDriveTypeAutoRun and then click Modify to type B5 in the Value data box. Select Hexadecimal, and then click OK.
7. Quit Registry Editor.
8. Restart your computer.
Parent
Troll Alert... (Score:5, Insightful)
That's the problem with Windows. It doesn't Just Work(tm). You have to know these cryptic menus to edit databases just to keep your new USB drive from running whatever application happens to be on it. Maybe one day Microsoft could start doing some real usability testing and get Windows to be as easy for a new user as Linux.
[/Troll]
Parent
Re:First off... (Score:4, Funny)
Simple. You install Windows, and feel as if you were being mounted by Ball-mer. With a chair.
Parent
Re: (Score:3, Funny)
Re:First off... (Score:4, Informative)
-nB
Parent
Nope (Score:3, Informative)
Re:Nope (Score:5, Informative)
gpedit.msc
It's a windows GUI tool.
Computer Configuration > Click "Administrative Templates" > Click "System" > Double-Click "Turn off Autoplay", set it for "All Drives" and click the "apply" button.
Parent
Re: (Score:3, Interesting)
It's a bargain! (Score:5, Funny)
Thank goodness for Chinese manufacturing (Score:4, Interesting)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
I don't know how much faith I have in this "new economy," which seems to be based on people selling overpriced houses to each other and getting further and further in debt.
Re: (Score:3, Interesting)
Can't trust hardware anymore? (Score:4, Insightful)
The increasing level of integration means that hardware is more and more of a black box. While this has led to huge savings in cost and performance boosts, we've paid for it by being unable to debug the hardware, and unsure of what's really going on inside.
While the case in the article talks specifically about a trojan horse installed normally on the drive -- and thus something that should have been remedied by a good formatting job -- who knows what could happen once we have vulnerabilities embedded directly into the hardware. One could certainly imagine a trojan that was hard-coded in the firmward and kept moving itself around the disc after attempts to delete it.
It's also seems fishy that much sensitive information (of relevance to a foreign government) could be obtained from randomly putting trojans on hard drives... Isn't it possible that this was an unintentional infection from some disk-handling or testing machine along the line?
--
Educational microcontroller kits for the digital generation. [nerdkits.com]
Re: (Score:3, Interesting)
It's also seems fishy that much sensitive information (of relevance to a foreign government) could be obtained from randomly putting trojans on hard drives... Isn't it possible that this was an unintentional infection from some disk-handling or testing machine along the line?
How do you know it was random? Let's say they have a specific target in mind, and they know what sort of hard drives the target uses, and which supplier he gets them from. They infect a whole container load of disks which is bound for that supplier. Whoops, they overdid it - now some unrelated hacker wound up with one of those things, noticed the shenanigans and published them on the net.
Although the second scenario (the boring one) is a lot more likely.
Not a trojan (Score:4, Insightful)
Re:Not a trojan (Score:5, Insightful)
Something else like a... hard disk?
Parent
Re:Not a trojan (Score:5, Interesting)
Two cases here. First, you got an external USB HDD. It often contains lots of software. I have a Seagate USB/FireWire HDD, it comes with FreeAgent backup and configuration software. I bought the software with the HDD unit, they are one set. I would be an idiot if I format the HDD first.
Another case is when you get an internal HDD that is supposed to be unformatted. But you don't know if it is or isn't - not before you install it into your Windows box and power it up. If the HDD is blank, as it should be, then you need to format it, and all is well. However if it is already formatted for you and contains something, Windows has no way of knowing why it is so, and it will treat it as any other removable drive - namely, will read the autorun.inf and proceed running all the viruses in the world that the drive may contain, all that before you even realize that something is wrong.
In either case, if your antivirus finished loading by this time it may save you, if it is good enough. But I recall some recent review that claimed that a typical antivirus fails to catch as many as half of the viruses.
Parent
Re: (Score:3, Funny)
SATA connector <-> City gate
Disk drive <-> Big wooden horse
Autorun file <-> Greek soldiers
Obilgitory HOSTS comment: (Score:5, Informative)
127.0.0.1 www.nice8.org
127.0.0.1 www.we168.org
Re:Obilgitory HOSTS comment: (Score:5, Funny)
So why ignore when you can use up their bandwidth and screw up their database. Just an idea.
Parent
Re: (Score:3, Interesting)
There is a blacklist website that had the www.nice8.org site listed a while back (I serched in mine before entering it) but the we268 site wasn't in there and still isn't.
The URL to the hosts blacklist file: http://www.mvps.org/winhelp2002/hosts.htm [mvps.org] This really speeds up browsing too as a lot of the tracking sites get blocked.
Re: (Score:3, Funny)
You bastard! I did and that unsavory host at 127.0.0.1 (isn't the 127.x range like the dark back-alleys of the Intertubes?) infected me with a nasty trojan, probably because it has like a million gajigabytes of completely illegal, pirated contents on it!! A veritable pirate hive, that! I hold you pesonally responsible for directing us, pure, innocent Slashdotters to it!
Re: (Score:3, Funny)
Seagate admits it (Score:3, Informative)
So this is not a hoax, after all.
Re: (Score:3, Informative)
It could be worse (Score:5, Funny)
It was meant to benifit the customer (Score:4, Funny)
Just more proof that autorun is insanely stupid (Score:5, Insightful)
Re: (Score:3, Insightful)
Isn't Apple advertising that Macs "just work"? Macs don't have this autorun "feature", so maybe because of that, they should be sued for false advertising.
I think ... (Score:3, Funny)
Perhaps the EU can take up their case.
Re:How would that even work (Score:4, Interesting)
Parent
Re: (Score:3, Informative)
Autorun can definitely run exe's, that's its main purpose. That's how the installer automatically starts up when you insert a game or application CD. It's possible that the exe needs to be signed or something, but it's more likely that whatever program you were using simply "did it wrong".
Don't forget that you can also disable autorun permanently, rather than having to remember to hold shift every time you insert a disc.
that said.. (Score:5, Interesting)
[autorun]
shell\silly=You're silly
shell\silly\command=calc.exe
shell=silly
now remove and reinsert the USB device. Hmm.. nothing happens.. how strange. Go to My Computer and double click on I: (or whatever your drive is mapped to) and what happens? Yeah, calc.exe is run. Thanks Microsoft.
You may now flame away.
Parent
Re: (Score:3, Insightful)
Re:It's times like this... (Score:5, Funny)
Only if you disabled NTLDR as well....
Parent
We are to blame for China, not the corporations (Score:4, Insightful)
I realize you are merely repeating a popular but false meme so please do not think I am being harsh with you personally, it's the meme that I am being harsh with.
The notion that corporations are to blame for outsourcing to China is beyond naive. We the consumers, not the corporation are to blame! We have essentially forced corporations to outsource by our consideration of virtually nothing beyond price. Business is a Darwinian process. That first corporation that experimented with outsourcing was *rewarded* by consumers rather than punished. Corporations had little choice, jump on the outsourcing bandwagon or go out of business.
If you do not like outsourcing look at the labeling on packaging. Sometimes this requires a little extra effort. I needed a set of screwdrivers and in the regular tools section everything at the local Home Depot was an import. I accidentally found some manufactured in the USA elsewhere in a "professional tools" section. Maybe its not too late.
Parent
It's bad beyond a joke - so time for one (Score:5, Funny)
In Australia we get a lot of professional tools from the USA. They end up managing telecommunications and other technology companies. I ask you citizens of the United States for the good of the reputation of your country to keep those managers who are complete tools within your borders, cut off their cocaine supply and put them to work sweeping floors somewhere where they can not do much damage with their remaining brain cells.
Parent
thems is fightin words (Score:4, Interesting)
I think many folks in Taiwan would have an issue with this statement.
A quick history lesson. The aborignal people of taiwan are actually connected to the other oceania aborignes (e.g. native of the other islands like the philippines, malaysia, and indonesia). The mainland Ming and Qing dynasties (pre-cursors to modern china) never really considered the island as part of their "middle kingdom".
Meanwhile, the Dutch that colonized the island which they called Formosa (which is now Taiwan) to use as their base to trade with Japan. This was managed by the Dutch East India Company (Spain briefly tried to hone in on the island, but were driven out by the Dutch).
Eventually, the conflicts that led to the formation of modern china, spilled over to the island. Koxinga, a Ming dynasty warlord/general/rebel (born in japan to a mother who was japanese and a Ming dynasty general) overthrew the dutch on Formosa to establish a base for Ming dynasty rebels that wanted to re-take over the Qing dynasty. This event has historically been cited by the chinese as their historic claim over the island, but it seems no more valid than the Dutch claim which is basically moot (since as we know possesion is more than 9/10 of international law).
Of course the Japanese eventually defeated the Chinese in the Sino-Japanese war and the Qing ceded Taiwan to Japan as part of the Treaty of Shimonoseki. Japan basically occupied Taiwan until the end of WWII.
During the resolution of WWII and the Japanese surrender, basically, Japan was forced to give up all the territories that it gained all the way back from the end of WWI from the Republic of China which included the island of Formosa. The decision of who the territories should fall to were left up for the final Treaty of Peace with Japan which left the decision to the winners of WWII in the Pacific (basically the US, the UK and Soviet Union and the ROC).
Of course after WWII, this was all complicated as the Republic of China which was generally considered the KMT government at the time was overthrown by the People's Republic of China (Mao, etc) and the KMT government retreated and occupied Taiwan for many years claiming that they were still the KMT/ROC. That and the beginnings of the cold war power struggles led to the controversial Treaty of San Francisco which officially ended WWII in the pacific required that Japan cede Taiwan to one of the "winners" which due to a complicated set of circumstances, the ROC or the PRC were never specified (since they weren't invited to be part of the treaty because of the civil war at the time there was no agreement on who the government was).
In fact with some stretching, it's possible to conclude that the Treaty of San Francisco actually leaves Taiwan as an occupied territory of the United States (sort of like berlin was occupied by 4 powers at the end of the war in europe).
So it's actually debatable that Taiwan is even a country and if it is, if it is actually part of China or an independent country in it's own right...
Parent