Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2009-12-21 InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

There is no such thing as a free lunch .

Published: 2009-12-21
Last Updated: 2009-12-21 21:38:24 UTC
by John Bambenek (Version: 1)
0 comment(s)

An ISC reader wrote in alerting us to unconfirmed reports that organizations and some government agencies are received "unexpected" shipments of USB thumb drives.  Don't know if it's true or not, but with the holidays upon us it bears reminding that USB devices received in suspicious ways often are loaded with hostile software.  Sometimes, even commercial off-the-shelf USB devices like photo frames and the like can be infected (see: the Digital Hijackers ISC diary from last Christmas).

It remains a favorite trick of pentesters to throw USB keys infected with malware around for a low-tech vector of an attack in an organization. Trade shows and the like, even a better venue (and you can target by industry or organization).  A colleague told me that his favorite trick was to mark a USB thumb drive as "Joe's Bachelor Party Pictures" for that extra "incentive" to get people to plug the device in.

If you're an organization and receive USB keys, even promotional swag, do a low-level format first.  If you buy a USB storage device from the store, wipe it first (especially the annoying U3 devices). Sometimes vendors ship USB keys with firmware updates that can be infected (see this example involving HP firmware, there was also a report for Checkpoint Firewall firmware too).  Those devices can't be low-level formatted, but a quick "media check" for hidden goodness may be warranted.

There's no such thing as a free lunch, but there is such a thing as free malware.  Cavaet Emptor.

If you've had such shipments of unknown USB devices, let us know so we can coorelate data.

John Bambenek
bambenek at gmail /dot/ com

0 comment(s)

iPhone Botnet Analysis

Published: 2009-12-21
Last Updated: 2009-12-21 19:38:29 UTC
by Marcus Sachs (Version: 1)
3 comment(s)

SRI's Malware Threat Center has published an excellent analysis of the iPhone botnet that we covered in a diary a few weeks ago.  Here is the abstract:

We present an analysis of the iKee.B (duh) Apple iPhone bot client, captured on 25 November 2009.  The bot client was released throughout several countries in Europe, with the initial purpose of coordinating its infected iPhones via a Lithuanian botnet server.   This report details the logic and function of iKee's scripts, its configuration files, and its two binary executables, which we have reverse engineered to an approximation of their C source code implementation.    The iKee bot is one of the latest offerings in smartphone malware, in this case targeting jailbroken iPhones.  While its implementation is simple in comparison to the latest generation of PC-based malware, its implications demonstrate the potential extension of crimeware to this valuable new frontier of handheld consumer devices.

Thanks to Phil Porras and the MTC team for all of their great work!

Marcus H. Sachs
Director, SANS Internet Storm Center

Keywords: botnet ikee iPhone
3 comment(s)
Diary Archives