Trojan Found In New HDs Sold In Taiwan 344
GSGKT writes "About 1,800 brand new 300-GB or 500-GB external hard drives made for Maxtor in Thailand were found to have trojan horse malwares pre-installed (autorun.inf and ghost.pif). When the HD is in use, these forward information on the disk to two websites in Beijing, China: www.nice8.org or www.we168.org. The article implies that authorities believe the Chinese government is behind the trojans. A later article pins down the point of infection to a subcontractor company in China. A couple of months back the Register was reporting on pre-installed malware detected on Maxtor disks sold in the Netherlands. This earlier report was downplayed by a Seagate spokesman." The more recent Taipei Times article says that Seagate admits the problem on its Web site, but a search there turns up nothing.
Same (Score:5, Interesting)
Re: (Score:2, Insightful)
Threadjack: WTF? (Score:4, Funny)
Answer : Everyone. Even geeks give up configuring Windows to that point after one hundred reinstalls. Or they give up on Windows already... Okay, "who does not reformat new HDs before use?"
Who buys Maxtor HDs anyway? Never had one that even lasted till the end of warranty, used 8 of those in under two years. And there are not enough hours in one year to make up for the order of magnitude between announced and effective MTBF. (168*52 = way less than "tens of thousands of hours".)
Not that I excuse them for dataraping their customers. The exec that ordered that should be put to a very slow and painful death. With the Maxtor engineering team. (If there even IS one.)
Re: (Score:3, Informative)
Then the malware already automatically gets run.
Re: (Score:3, Insightful)
Most brands ship that brain-dead "install software" anyway, which the clueless will install. Have that "Initialize" the drive for them. The ones smart enough to not install that crap software will be smart enough to format the drive themselves.
=Smidge=
Re: (Score:2)
The current (as of writing) Windows Secrets newsletter features an article that would let you at least prevent most kind of autorun.inf scripts from ever running in the first place. It would save me some trouble from all those college girls (errr.. I mean relatives) that gets infected by these sort of things all the time...
One [windowssecrets.com]
Oh, malware... (Score:5, Funny)
(OK, who's the comedian? My catchpas is "durable".)
Re:Oh, malware... (Score:5, Funny)
That would suck. Imagine hundreds of geeks getting a box in the mail from NewEgg filled with a product you have no use for.
First off... (Score:5, Funny)
Re: (Score:2)
I know in most Linux distros a HD that isn't mentioned in fstab will not get mounted, but what about Windows?
I guess you have to boot from a LiveCD and format the disc to be sure.
Comment removed (Score:4, Informative)
Comment removed (Score:5, Informative)
Re:First off... (Score:5, Funny)
Re: (Score:3)
In practice, it's easy to get an app to run invisibly. If someone is trojaning OEM drives, Microsoft's choice of defaulting to the insecure autorun mode means a lot of people will be infected.
Re:First off... (Score:5, Informative)
Works for USB drives and CD-ROMS.
[2007/10, from:
http://www.mydigitallife.info/2006/09/11/disable-auto-run-and-auto-play-of-u3-smart-drives-launchpad/%5D [mydigitallife.info]
1. Click Start -> Run.
2. Type RegEdit in the Open text box, then press ENTER.
3. In the Registry Editor, locate and click the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CDRom
4. Modify the value of the Autorun to 0 (zero) so that CD-ROMs and Audio CDs do not run and start automatically when inserted.
5. Next navigate to the following registry subkey:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
6. Modify the value of the NoDriveTypeAutoRun entry to 0xb5 value to turn off the AutoRun feature for CD-ROMs by right-click NoDriveTypeAutoRun and then click Modify to type B5 in the Value data box. Select Hexadecimal, and then click OK.
7. Quit Registry Editor.
8. Restart your computer.
Troll Alert... (Score:5, Insightful)
That's the problem with Windows. It doesn't Just Work(tm). You have to know these cryptic menus to edit databases just to keep your new USB drive from running whatever application happens to be on it. Maybe one day Microsoft could start doing some real usability testing and get Windows to be as easy for a new user as Linux.
[/Troll]
Re: (Score:3, Informative)
Re: (Score:3, Informative)
That won't work.
msconfig is a diagnostic tool for disabling programs which are loaded at boot time. It has nothing to do with autoloading CDs.
There is no built-in autostart ui. If you're scared of the registry, you can download TweakUI, but you'll still need to disable autostart on a drive-by-drive basis.
Re:Actually, "Just Work"ing is the problem here... (Score:3)
Windows does this already. The first time you connect a drive or insert a CD/DVD, Windows first tries to determine the type of media (pictures, videos, data files, etc.) and presents a prompt asking you what you
Re: (Score:3, Funny)
On behalf of every Linux user that's ever had to listen to Windows users making fun of /etc: <nelson>Ha-ha!</nelson>
Re:First off... (Score:4, Funny)
Simple. You install Windows, and feel as if you were being mounted by Ball-mer. With a chair.
Re: (Score:3, Funny)
Re:First off... (Score:4, Informative)
-nB
Nope (Score:3, Informative)
Whoops (Score:2)
Bah, right after I posted my comment I realized I wasn't thinking straight. Time for bed I guess. Ignore parent and imagine I typed this instead:
Default Windows settings would mount the drive and immediately parse autorun.inf. I'm not sure about running the trojan, but I think MS totally disabled the run part of autorun in Vista and maybe an XP update (instead you get a dialog which shows the autorun action as one of several options you can take including nothing, or opening the drive in explorer).
Not the only...think different (Score:2)
Or... chassis it into an external FW/USB/SATA enclosure, cabled to a Mac & either reformat it for OS X & use... or wipe it and format it for a windows box.
Re:Nope (Score:5, Informative)
gpedit.msc
It's a windows GUI tool.
Computer Configuration > Click "Administrative Templates" > Click "System" > Double-Click "Turn off Autoplay", set it for "All Drives" and click the "apply" button.
Re: (Score:2)
Re: (Score:2)
-nB
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Re: (Score:3, Funny)
It's a bargain! (Score:5, Funny)
Re: (Score:2)
It's times like this... (Score:2, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re:It's times like this... (Score:5, Funny)
Only if you disabled NTLDR as well....
Re: (Score:2)
I think the GP is implying that he doesn't have worry about things LIKE this.
An example I have would be a buddy of mine at work. He's a technician also, but not really a "geek". Anyway, he got a message from Time Warner the other day saying he was kicked off his cable Internet for sending out spam. Evidently, his desktop machine got infected. He said, "I don't get it. How did it get infected? I never use it. I always use my notebook. It's
Thank goodness for Chinese manufacturing (Score:4, Interesting)
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
I don't know how much faith I have in this "new economy," which seems to be based on people selling overpriced houses to each other and getting further and further in debt.
Re: (Score:3, Interesting)
Re: (Score:2)
Can't trust hardware anymore? (Score:4, Insightful)
The increasing level of integration means that hardware is more and more of a black box. While this has led to huge savings in cost and performance boosts, we've paid for it by being unable to debug the hardware, and unsure of what's really going on inside.
While the case in the article talks specifically about a trojan horse installed normally on the drive -- and thus something that should have been remedied by a good formatting job -- who knows what could happen once we have vulnerabilities embedded directly into the hardware. One could certainly imagine a trojan that was hard-coded in the firmward and kept moving itself around the disc after attempts to delete it.
It's also seems fishy that much sensitive information (of relevance to a foreign government) could be obtained from randomly putting trojans on hard drives... Isn't it possible that this was an unintentional infection from some disk-handling or testing machine along the line?
--
Educational microcontroller kits for the digital generation. [nerdkits.com]
Re: (Score:3, Interesting)
It's also seems fishy that much sensitive information (of relevance to a foreign government) could be obtained from randomly putting trojans on hard drives... Isn't it possible that this was an unintentional infection from some disk-handling or testing machine along the line?
How do you know it was random? Let's say they have a specific target in mind, and they know what sort of hard drives the target uses, and which supplier he gets them from. They infect a whole container load of disks which is bound for that supplier. Whoops, they overdid it - now some unrelated hacker wound up with one of those things, noticed the shenanigans and published them on the net.
Although the second scenario (the boring one) is a lot more likely.
Not a trojan (Score:4, Insightful)
Re:Not a trojan (Score:5, Insightful)
Something else like a... hard disk?
Re: (Score:2)
>Something else like a... hard disk?
A hard disk is mostly... hardware. There's a little software in it, even in a good, uninfected unit, but that's called firmware. One doesn't buy a hard disk for that firmware.
Re:Not a trojan (Score:5, Interesting)
Two cases here. First, you got an external USB HDD. It often contains lots of software. I have a Seagate USB/FireWire HDD, it comes with FreeAgent backup and configuration software. I bought the software with the HDD unit, they are one set. I would be an idiot if I format the HDD first.
Another case is when you get an internal HDD that is supposed to be unformatted. But you don't know if it is or isn't - not before you install it into your Windows box and power it up. If the HDD is blank, as it should be, then you need to format it, and all is well. However if it is already formatted for you and contains something, Windows has no way of knowing why it is so, and it will treat it as any other removable drive - namely, will read the autorun.inf and proceed running all the viruses in the world that the drive may contain, all that before you even realize that something is wrong.
In either case, if your antivirus finished loading by this time it may save you, if it is good enough. But I recall some recent review that claimed that a typical antivirus fails to catch as many as half of the viruses.
Re: (Score:2, Insightful)
If someone puts malware in a device I would willingly put in my computer without me employing security measures, I would consider that more true to the original source of the term.
Re: (Score:3, Funny)
SATA connector <-> City gate
Disk drive <-> Big wooden horse
Autorun file <-> Greek soldiers
Its a classic Trojan Horse. (Score:2)
How would that even work (Score:2)
As to the reference about these drives being used for government databases, certainly they would be reformatted when added to a RAID, wouldn't they? Even if preformatte
Re:How would that even work (Score:4, Interesting)
Re: (Score:3, Informative)
Autorun can definitely run exe's, that's its main purpose. That's how the installer automatically starts up when you insert a game or application CD. It's possible that the exe needs to be signed or something, but it's more likely that whatever program you were using simply "did it wrong".
Don't forget that you can also disable autorun permanently, rather than having to remember to hold shift every time you insert a disc.
Re: (Score:2)
Re: (Score:2)
Talk about security... (Score:2)
Is MS also going to tell us how this is a feature on HDs? I can see it in CDs. I could even see it in USB drives. But in hard disks? Where's the point in an autorun feature on a hard drive?
Re: (Score:2)
1. insert a usb drive, let's say it is mounted to I:
2. edit I:\autorun.inf with a text editor (for example, notepad) and put:
[autorun]
open=calc.exe
action=Run Calculator
3. copy c:\windows\system32\calc.exe to I:
4. remove the usb drive
5. reinsert the usb drive
Windows will pop up a dialog that says:
Windows can perform the same action each time you insert a disk or connect a device with this kind of file:
Program
What do you want Windows to do?
Run Calculator
using the program on the device
Open folder to view files
using Windows Explorer
Take no action
[] Always do the selected action
You can make the action say "Open folder to view files" and you can even make the icon look similar, but Windows will always say that helpful "using the program on the device" and it w
that said.. (Score:5, Interesting)
[autorun]
shell\silly=You're silly
shell\silly\command=calc.exe
shell=silly
now remove and reinsert the USB device. Hmm.. nothing happens.. how strange. Go to My Computer and double click on I: (or whatever your drive is mapped to) and what happens? Yeah, calc.exe is run. Thanks Microsoft.
You may now flame away.
Re: (Score:2)
Re: (Score:2)
In my experiance bare drives don't but drives ready mounted up in USB caddies do.
Sure you could reformat it to remove stuff but by the time you get to the format screen you are probablly already infected.
Re: (Score:2)
Do they have some mechanism for surviving the intial format or is this a complete hoax?
What "initial format"? If you buy this drive and install it, preformatted with the trojan, Windows will see it as already formated and mount it, then autorun the malware. Moments later, the human who doesn't notice it's already formatted goes slowly (to a computer) to the disk format utility. By the time the format begins, the damage has already been done.
I will admit that I have noticed that sometimes brand new drives are already formatted, but then I immediately reformat them as HFS+ volumes. Next time
Re: (Score:3, Insightful)
Maybe a format (Score:2, Insightful)
Re: (Score:2)
My impression is that they're just regular files pre-loaded on it, so reformatting will work. Provided of course you don't plug it in to a Windows PC with auto-run enabled in order to format it.
I wonder if one day we will see drives that have malware embedded in the controller that can't ever be erased? Maybe it's possible for them to detect "initial connection and probing by Windows" by waiting for a certain sequence of commands, and only expose the malware then. If you look at the drive later, or use a
Obilgitory HOSTS comment: (Score:5, Informative)
127.0.0.1 www.nice8.org
127.0.0.1 www.we168.org
Re:Obilgitory HOSTS comment: (Score:5, Funny)
So why ignore when you can use up their bandwidth and screw up their database. Just an idea.
Re: (Score:3, Interesting)
There is a blacklist website that had the www.nice8.org site listed a while back (I serched in mine before entering it) but the we268 site wasn't in there and still isn't.
The URL to the hosts blacklist file: http://www.mvps.org/winhelp2002/hosts.htm [mvps.org] This really speeds up browsing too as a lot of the tracking sites get blocked.
Re: (Score:2)
I think we Slashdotted it. They're not responding.
Re:Obilgitory disable autorun comment (Score:2)
127.0.0.1 www.nice8.org
127.0.0.1 www.we168.org
Be sure to put them in the upstream router. Autorun may compromise the system.. DUH it's a trojan. Since the affected drives are portable drives, it is very important to disable autorun as well as block the sites upstream of the compromised machine.
Re: (Score:3, Funny)
You bastard! I did and that unsavory host at 127.0.0.1 (isn't the 127.x range like the dark back-alleys of the Intertubes?) infected me with a nasty trojan, probably because it has like a million gajigabytes of completely illegal, pirated contents on it!! A veritable pirate hive, that! I hold you pesonally responsible for directing us, pure, innocent Slashdotters to it!
Liar! (Score:2)
(The scary part is that I'm not so convinced I couldn't find a judge who wouldn't allow that suit...)
Re: (Score:3, Funny)
But who's affected? (Score:2)
Seagate admits it (Score:3, Informative)
So this is not a hoax, after all.
Re: (Score:3, Informative)
It could be worse (Score:5, Funny)
It was meant to benifit the customer (Score:4, Funny)
Just more proof that autorun is insanely stupid (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Isn't Apple advertising that Macs "just work"? Macs don't have this autorun "feature", so maybe because of that, they should be sued for false advertising.
Lenovo (Score:2)
I think ... (Score:3, Funny)
Perhaps the EU can take up their case.
First Hard Drives, then Motherboard BIOSes (Score:2, Insightful)
How will you know? How will you get rid of it, (I know flash the
BIOS, but maybe the BIOS doesn't want to be flashed.)
There's talk that the next war will be a cyberwar. I guess that's
better than the other kind, but these are some of the ways to do it
I'd say.
More Info on the Worm (Score:2, Informative)
Re: (Score:2)
I'd take that number with a quite unhealthy dose of salt. Most likely Symantec got a sample from somewhere (a customer, their cooperation with other AV researchers) but didn't encounter any samples through their detectors (well, how would they if that trojan is distributed in ways they cannot dete
... May not be as simple as it seems (Score:2, Interesting)
This
Re: (Score:2, Insightful)
What the hell was I thinking? American businesses that outsource to China are no better than spies and traitors themselves. For all the damage they do, they might as well be.
We are to blame for China, not the corporations (Score:4, Insightful)
I realize you are merely repeating a popular but false meme so please do not think I am being harsh with you personally, it's the meme that I am being harsh with.
The notion that corporations are to blame for outsourcing to China is beyond naive. We the consumers, not the corporation are to blame! We have essentially forced corporations to outsource by our consideration of virtually nothing beyond price. Business is a Darwinian process. That first corporation that experimented with outsourcing was *rewarded* by consumers rather than punished. Corporations had little choice, jump on the outsourcing bandwagon or go out of business.
If you do not like outsourcing look at the labeling on packaging. Sometimes this requires a little extra effort. I needed a set of screwdrivers and in the regular tools section everything at the local Home Depot was an import. I accidentally found some manufactured in the USA elsewhere in a "professional tools" section. Maybe its not too late.
It's bad beyond a joke - so time for one (Score:5, Funny)
In Australia we get a lot of professional tools from the USA. They end up managing telecommunications and other technology companies. I ask you citizens of the United States for the good of the reputation of your country to keep those managers who are complete tools within your borders, cut off their cocaine supply and put them to work sweeping floors somewhere where they can not do much damage with their remaining brain cells.
Re: (Score:3, Interesting)
What you're trying to say is "vote with your wallet." We are decades past that having any effect and I'll tell you why.
Remember one thing: consumers are the end of the supply and manufacturing chain. Products don't appear out of thin air, even simple items are the result of a long succession of manufacturing processes. Many years ago, the Japanese deliberately used predatory pri
Re: (Score:3, Insightful)
I agree. I am not suggesting that one buy solely on a nationalistic basis. What I am arguing is that local products and services should be one important factor. Recall that the complaint in my original post was "our consideration of virtually nothing beyond price".
I don't remember as well, but I imagine Japanese consumer ele
Re: (Score:2)
That would be consistent with the headline and summary, but they could also be very wrong.
Re: (Score:2)
"Around 1,800 of the portable Maxtor hard discs, produced in Thailand, carried two Trojan horse viruses: autorun.inf and ghost.pif, the bureau under the Ministry of Justice said."
Re: (Score:2)
thems is fightin words (Score:4, Interesting)
I think many folks in Taiwan would have an issue with this statement.
A quick history lesson. The aborignal people of taiwan are actually connected to the other oceania aborignes (e.g. native of the other islands like the philippines, malaysia, and indonesia). The mainland Ming and Qing dynasties (pre-cursors to modern china) never really considered the island as part of their "middle kingdom".
Meanwhile, the Dutch that colonized the island which they called Formosa (which is now Taiwan) to use as their base to trade with Japan. This was managed by the Dutch East India Company (Spain briefly tried to hone in on the island, but were driven out by the Dutch).
Eventually, the conflicts that led to the formation of modern china, spilled over to the island. Koxinga, a Ming dynasty warlord/general/rebel (born in japan to a mother who was japanese and a Ming dynasty general) overthrew the dutch on Formosa to establish a base for Ming dynasty rebels that wanted to re-take over the Qing dynasty. This event has historically been cited by the chinese as their historic claim over the island, but it seems no more valid than the Dutch claim which is basically moot (since as we know possesion is more than 9/10 of international law).
Of course the Japanese eventually defeated the Chinese in the Sino-Japanese war and the Qing ceded Taiwan to Japan as part of the Treaty of Shimonoseki. Japan basically occupied Taiwan until the end of WWII.
During the resolution of WWII and the Japanese surrender, basically, Japan was forced to give up all the territories that it gained all the way back from the end of WWI from the Republic of China which included the island of Formosa. The decision of who the territories should fall to were left up for the final Treaty of Peace with Japan which left the decision to the winners of WWII in the Pacific (basically the US, the UK and Soviet Union and the ROC).
Of course after WWII, this was all complicated as the Republic of China which was generally considered the KMT government at the time was overthrown by the People's Republic of China (Mao, etc) and the KMT government retreated and occupied Taiwan for many years claiming that they were still the KMT/ROC. That and the beginnings of the cold war power struggles led to the controversial Treaty of San Francisco which officially ended WWII in the pacific required that Japan cede Taiwan to one of the "winners" which due to a complicated set of circumstances, the ROC or the PRC were never specified (since they weren't invited to be part of the treaty because of the civil war at the time there was no agreement on who the government was).
In fact with some stretching, it's possible to conclude that the Treaty of San Francisco actually leaves Taiwan as an occupied territory of the United States (sort of like berlin was occupied by 4 powers at the end of the war in europe).
So it's actually debatable that Taiwan is even a country and if it is, if it is actually part of China or an independent country in it's own right...