China-made E-Cigarette Chargers Could Infect Your Computer with Virus

It's better for smokers to quit smoking. Are you using electronic cigarettes (E-cigarettes) instead normal ones? Still, you should quit your smoking habit, because it not only damages your health, but could pose a danger risk to the health of your computer.

E-cigarettes have become the latest vector for hackers to distribute malicious software. E-cigarettes manufactured in China are reportedly being used to spread malware via a USB port to computers when users plug in for charging it up.

The report broke when an executive at a "large corporation" had been infected with malware from an undetermined source after he quit smoking and switched to e-cigarettes made in China, detailed a recent post to social news forum Reddit.

Further investigating the matter, he found that the chargers of the e-cigarettes - bought from the online auction site eBay for $5 - are hard-coded with the malware that infected his workstation despite having latest virus and anti malware programs installed.

"The executive's system was patched up to date, had antivirus 

and anti-malware protection," Reddit user Jrockilla said. "Web logs were scoured 

and all attempts made to identify the source of the infection but to no avail." 

"Finally after all traditional means of infection were covered, IT started looking 

into other possibilities. They finally asked the executive: 'Have there been any changes 

in your life recently?' The executive answered: 'Well yes, I quit smoking two weeks ago 

and switched to e-cigarettes.' And that was the answer they were looking for."

Rik Ferguson, a security consultant for Trend Micro, also considers the matter plausible and says, "Production line malware has been around for a few years, infecting photo frames, MP3 players and more." In 2008, for instance, a photo frame produced by Samsung shipped with malware on the product's install disc, the Guardian reported.

"Hackers are able to exploit any electronic device to serve malware to 

a poorly protected network," Pierluigi Paganini, chief information security officer 

at ID management firm, said in a blog post. 

"Despite the [fact the] idea could appear hilarious, many electronic cigarettes 

can be charged over USB using a special cable or by inserting 

one end of the cigarette directly into a USB port."

The idea is similar to the BadUSB, whose source code was released by the researchers last month on the open source code hosting website Github. BadUSB was capable to spread itself by hiding in the firmware meant to control the ways in which USB devices connect to computers. Ferguson explained that "a very strong case can be made for enterprises disabling USB ports, or at least using device management to allow only authorised devices."

The Hacker’s New Best Friend Could be Your USB Port

It’s tiny and portable, yet perfect for storing large items. I’m talking about the good ol’ Universal Serial Bus (a.k.a USB) drive, the giveaway of choice at tradeshows across the world, and perfect for the easy storage and transfer of photos, documents, music and more. But you might want to think twice before plugging a free USB into your machine. The reason: USBs can now contract an undetectable - and unfixable - virus that can be spread quite easily.

News of this potent malicious software (often referred to as malware) has circled around the information security industry since researchers Karsten Noh and Jakob Lell described their new attack to a packed room at this year’s Black Hat security conference in early August.

The malware, dubbed BadUSB, can take over a computer, as well as redirect Internet-bound traffic to different site. But BadUSB’s danger doesn’t lie with its ability to execute code—this type of malware, called auto-run (because it runs automatically when the USB drive is inserted into your device), has been around for some time now. The danger lies with its ability to never be detected. BadUSB exploits how the USB standard was built and coded, and mixes malware with the device’s firmware—the code that tells the USB stick how to work. This intermingling of code makes the malware indistinguishable from normal, safe firmware.

Because of the danger this particular form of malware posed to the public at large, the pair refrained from releasing the code to attendees. That reasoning, however, didn’t sit well with another pair of researchers, who did publish the infectious malware after reverse engineering it. The malware that freaked out two security researchers enough to make them refrain from publishing their work is now out in the open.

USBs, long considered secure (perhaps incorrectly), are now major liabilities to consumers everywhere. So the question now is, should you be worried?

The answer is yes and no.

The good thing about this malware variant is that it’s isolated to just USB devices. But that’s also its danger: USB devices are so ubiquitous that consumers typically don’t pay them any attention—the best sort of attack vector hackers could hope for. Hackers could also hide this malware within a larger package and could, theoretically, infect a computer that would subsequently infect any and all USB devices that connect with that machine—thereby spreading the malware even further. All in all it’s pretty bad news.

So why did these researchers knowingly, and publicly, publish such dangerous malware? Because they want to see this security issue fixed, and the only way they’re convinced it’ll be fixed is by lighting a fire under USB manufacturers.

They’re not entirely wrong, either. Manufacturers, largely for business reasons, have been notoriously slow in fixing security issues (called patching), and USB drives are no different. By publicly making this code available, the pair of researchers will deny USB manufacturers the ability to claim that they weren’t aware of security vulnerabilities on USB. That knowledge, it’s theorized, will drive better security further down the road.

Publishing this code was well intentioned, and, truthfully, is a fairly standard practice in the information security industry. But this particular malware is going to cause a lot of headaches for quite a few years (likely a decade). So what can you do to protect yourself while this newfound attack vector is out in the wild? Well there are a few options available:

• Use caution with free USB drives.
  A lot of companies like to go to major conferences and events and hand out free USB drives. This is bad security practice. Free USBs have always carried the risk of being preloaded with malware, and now the risk has doubled. You don’t have to turn down free USBs drives, but you do have to be conscious of the risk you’re running when you don’t know where that USB has been. If you’re uncertain if a USB is safe, run a scan.
  
• Lock down your computers.
  USBs have long been a reliable method of compromising computers. All it takes is an unknowing person to plug a USB drive into a port, and the damage is done. Never leave your computer sitting out in a public place where someone could access your USB port.
  
• Use comprehensive security.
  Between USB devices, computers and mobile phones - all the technology we own is a security risk. So how can you minimize the likelihood of getting infected by malware? By using a comprehensive security service, which provides a comprehensive shield against malware, phishing attacks and a variety of other nasties aimed at compromising your digital life. Such software also automatically scans USBs when they’re connected to your computer, for known malware. This is a step you cannot afford to skip in the protection of your valuable information.

Unfixable USB Hack Threatens Life as We Know It

USB ports are a bit like Cinnabons at airports and bad Wi-Fi at hotels: ubiquitous. Almost every computer and millions of other connected devices have one. And while USB security has long been discussed, an 'unfixable' exploit threatens to up the danger quotient significantly—especially since it’s been made public.

Two security researchers, Adam Caudill and Brandon Wilson, have reverse-engineered a popular USB firmware from Taiwanese firm Phison, which powers hundreds of millions of devices. With the right exploit, USBs can become an injection conduit for malicious code—so, a flash drive could emulate a keyboard and issue commands on behalf of the logged-in user, to exfiltrate files or install malware. Such malware, in turn, can infect the controller chips of other USB devices connected to the computer.

The device can also spoof a network card and change the computer’s DNS setting to redirect traffic.

Or, a modified thumb drive or external hard disk can – when it detects that the computer is starting up – boot a small virus, which infects the computer’s operating system prior to boot.

The compromised code in question is stored in the USB’s read-write memory, so a user can’t remove it, and no patch will fix it. In order to get rid of the issue, new USBs must be issued with an entirely different security architecture.

The two are replicating research from SR Labs’ Karsten Nohl, who gave a talk at the Black Hat security conference discussing the exploit, which he dubbed BadUSB. However, given the persistent nature of the issue, he decided not to release it.

“No effective defenses from USB attacks are known,” he said in his information page on the issue. “Malware scanners cannot access the firmware running on USB devices. USB firewalls that block certain device classes do not (yet) exist. And behavioral detection is difficult, since a BadUSB device’s behavior when it changes its persona looks as though a user has simply plugged in a new device.”

 To make matters worse, cleanup after an incident is nigh impossible.

“Simply reinstalling the operating system – the standard response to otherwise ineradicable malware – does not address BadUSB infections at their root,” Nohl said. “The USB thumb drive, from which the operating system is reinstalled, may already be infected, as may the hardwired webcam or other USB components inside the computer. A BadUSB device may even have replaced the computer’s BIOS – again by emulating a keyboard and unlocking a hidden file on the USB thumb drive.”

In case we missed the point, he added, “Once infected, computers and their USB peripherals can never be trusted again.”

But the decision not to disclose is one that Caudhill and Wilson feel is a grand mistake. So now, they’ve thrown the exploit code up on Github to bring attention to the issue.

“The belief we have is that all of this should be public. It shouldn’t be held back. So we’re releasing everything we’ve got,” Caudill told the Derbycon audience in Louisville, Ky. Last week. “This was largely inspired by the fact that [SR Labs] didn’t release their material. If you’re going to prove that there’s a flaw, you need to release the material so people can defend against it.”

Government agencies and high-end espionage groups are probably already using it, Caudhill told WIRED.

“If the only people who can do this are those with significant budgets, the manufacturers will never do anything about it,” he said. “You have to prove to the world that it’s practical, that anyone can do it…That puts pressure on the manufacturers to fix the real issue.”

He added, “People look at these things and see them as nothing more than storage devices. They don’t realize there’s a reprogrammable computer in their hands.”