The Anti-virus Times

Friday, August 18, 2017

According to a common information security joke, the best way to keep a system secure is to shut it down, put it in a cave, and barricade the entrance. However, we've already seen that, under certain circumstances, even a machine that has been shut down can be controlled—using Intel AMT. And how about complete isolation?

Computers that aren’t connected to an intranet or the Internet are a common phenomenon. Machines of this kind can, for example, be used to process sensitive information.

If a computer doesn't receive data from other nodes (input is only conducted via a keyboard or other peripheral devices that are always connected to it), it can still get infected, but to accomplish that, an attacker would need to exploit some sort of hardware backdoor.

However, removable media is normally used to transfer data between isolated machines and the network. And by “media” we usually mean flash drives.

The last phrase brings up memories of viruses for MS-DOS.

Back then, their authors tried very hard to reduce the size of their programs if only by a single byte. Nowadays, malware doesn’t just infect systems;

it also has certain system requirements.

It’s very picky.

How does other NSA software steal or modify information? The same way other malicious programs do:

1. A system gets infected after a brute-force or phishing attack or by some other means.

   The initial infection occurred because the anti-virus on an employee's PC was either disabled or was using outdated virus definitions, allowing malware to be launched from a phishing email containing documents.exe.

   Please note that the anti-virus software had detected the malicious attachments as well as the attackers' activities in the compromised systems—long before any money was stolen. Among all the other things detected was suspicious behaviour on the part of the legitimate program Ammyy Admin. In some cases infection was prevented by the anti-virus software.

   https://www.drweb.com/pravda/issue/?number=176&lng=en

2. Awaiting a connection between the infected computer and removable media.
3. Infecting media.

   Doctor Web reports a significant increase in new malware spreading via removable data storage devices. The scripts make use of code obfuscation which complicates their analysis.

   Under the Dr.Web classification system, this malicious code is called Win32.HLLW.Autoruner.

   https://news.drweb.com/show/?i=178&c=5&lng=en

4. Infecting other servers and PCs via an infected flash drive or another removable media device.

It’s quite obvious that this method can be successfully applied only if writing data on removable media and the autorun feature aren't disabled. Nonetheless, this infection technique is quite popular. For example, banking Trojans that infect cash points use it quite often.

The spyware's parameters can be changed.

Interestingly, a rare malicious species—a malicious program for iOS—also spreads over removable media.