6 ms·

Cheap rj45 ethernet to USB adapter contains malware

32 points by rsecora 2y ago

gruez 2y ago
Seems light on details. How is it executing the payload? Is it doing something like badusb where it emulates a keyboard to run the payload? Wouldn't that be super obvious? Or is it something as simple as telling the user to install a "driver"?
- johann8384 2y ago
  From the replies it sounds like it mounted as a storage device and ran autorun. It was super obvious which is what caused them to take notice.
  - olyjohn 2y ago
    Please tell me Windows doesn't STILL autorun off of external drives? I thought that was solved years ago...
  - geor9e 2y ago
    Autorun has been disabled since the release of Windows 7 in 2009.
    - unsnap_biceps 2y ago
      For what it's worth, I just checked on my windows 11 install and it was (somewhat) enabled. Settings -> Bluetooth & Devices -> AutoPlay -> Use AutoPlay for all media and devices Was set to on, and "Removable drive" was set to "Choose a default", which appears to be equivalent to "Ask me every time". I don't have anything (that I'm aware of) that auto-runs something, but I presume it will prompt me asking if I want to run setup.exe, which seems somewhat reasonable for new hardware. And from the malware analysis, https://www.hybrid-analysis.com/sample/e3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359/6783acb889e814045f0a2da6 https://www.hybrid-analysis.com/sample/e3f57d5ebc882a0a0ca96... , it's signed by "Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" which also looks pretty legit. I can totally see a lot of folks allowing it to run.
      - geor9e 2y ago
        Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not capable of running an .exe
        unsnap_biceps 2y ago
        Microsoft seems to disagree with your assertion. > An autorun.inf file is a text file that can be used by the Autorun and AutoPlay components of Microsoft Windows. When a USB drive is plugged into a USB port, an autorun USB dialog appears that prompts you to do certain operations: print images, run Windows Media Players, or open a folder. But what if you have a particular application on the USB drive and want it to be launched from the autorun USB dialog? You can put autorun.inf into the root of the USB drive and edit its commands to get the app started when the USB key is plugged. https://answers.microsoft.com/en-us/windows/forum/all/enable-or-troubleshoot-autorunautoplay-for-a-usb/eb137a20-e28b-4bf3-98f8-bcf7e45d8515 https://answers.microsoft.com/en-us/windows/forum/all/enable... > Created on November 17, 2022 > Applies to: Windows / Windows 11 / Files, folders, and storage
        gruez 2y ago
        Autorun still exists, but at least on windows 10, it doesn't run the exe right away. It shows a popup box that asks you whether to run the exe or open the drive in explorer.
        geor9e 2y ago
        Thats a Microsoft community forums agent though, and in my experience they spam low effort boilerplate solutions in hopes of getting a few votes. If they searched the web specifically for how to do something only possible before 2007, then it does make sense they found instructions from that era. Here's the info from https://en.wikipedia.org/wiki/Autorun.inf https://en.wikipedia.org/wiki/Autorun.inf that seems more up to date "For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored."
    - hulitu 2y ago
      > Autorun has been disabled since the release of Windows 7 in 2009. No. Microsoft just said it will disable it. On some systems, i've seen it disabled (i don't know if by default or by AD policy) but, on the majority of Windows 10, it was not disabled.
      - geor9e 2y ago
        By `autorun` we're talking about the notorious pre-2007 function of automatically running an exe — the `open` key in the `autorun.inf` file, specifically. It's ignored in all non-EOL Windows versions. It technically true that features called Autorun and Autoplay are still `enabled`, they just don't do what they did pre-2007. The `icon` key still works, but not `open`. You can re-enable `open` with registry edits, but it's not easy.
- geor9e 2y ago
  The dongle enumerates as a USB hub with two USB devices plugged into it. One is an ethernet dongle, which is the sort of hardware that may require a driver. The second device is a USB flash drive containing a .exe, which extracts a file called Setup.exe. It won't execute unless the user manually executes it - it's just a USB drive after all. Maybe the .exe contains malware, maybe it doesn't. Maybe antivirus scans give false positives. Maybe the manufacturer found a clever way to save money by combining the two USB devices they normally shipped together. Maybe this twitter account just made a nice paycheck from clickbait engagement.
- karotte 2y ago
  Believe it or not, but 'enumerating as a CD-ROM' drive is actually a documented feature of some Realtek USB Ethernet Interfaces: https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Realtek-Semicon-RTL8153B-VB-CG_C2802072.pdf https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Rea... (6.16. Driver Auto-Install Mode, page 24).
BenjiWiebe 2y ago
Twitter is terrible and I can't remember the nitter instance that still works.
- gruez 2y ago
  https://xcancel.com/evapro30/status/1878593145534923124 https://xcancel.com/evapro30/status/1878593145534923124
  - BenjiWiebe 2y ago
    thanks!
elfchief 2y ago
It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious". The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually requires human analysis to draw conclusions about -- and anyone who has ever used it knows how many false positives it finds. A better proclamation might be "cheap network adapter comes with an auto-running executable which needs further analysis".
- nirui 2y ago
  Can you call it "auto-running" when they it don't even bother to pack in an autorun.inf? (based on https://x.com/evapro30/status/1878635208582562113 https://x.com/evapro30/status/1878635208582562113)
  - steffanA 2y ago
    The autorun.inf would be in the flash drive, not the executable they uploaded to Any.Run. Were any pics of the flash drive contents shared?
ChrisArchitect 2y ago
Related blog post: https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memory-exe-recognized-as-malware https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memor...
IronWolve 2y ago
It ain't just twitter that has armchair experts that are rude. Most social media sites allow this behavior. So many replies with horrible posts "your doing it wrong", "read the docs", etc. I've seen so many correct responses downvoted and with horrible replies. Anyone who used old moderated email lists will see how culture changed and the decline of actual conversation. Even stack overflow has went downhill.
IamLoading 2y ago
Reverse engineering by OALabs - https://www.youtube.com/watch?v=3IfJSGWIrCo https://www.youtube.com/watch?v=3IfJSGWIrCo Current verdict - not malware.
fishstock25 2y ago
"The chinese" yeah sure. Lmao. Everybody panic, there are two chips inside! Check out https://news.ycombinator.com/item?id=42743033#42743428 https://news.ycombinator.com/item?id=42743033#42743428 for more lulz
necovek 2y ago
I liked the graceful admission of error too: https://x.com/evapro30/status/1880123024474796107 https://x.com/evapro30/status/1880123024474796107
- fishstock25 2y ago
  I like when people put their thoughts so out in the open. Makes it much easier to know whom to not work for, since the work culture must be terrible, if they even publicly express themselves that way.

32 points by rsecora 2y ago

Seems light on details. How is it executing the payload? Is it doing something like badusb where it emulates a keyboard to run the payload? Wouldn't that be super obvious? Or is it something as simple as telling the user to install a "driver"?

johann8384 2y ago
From the replies it sounds like it mounted as a storage device and ran autorun. It was super obvious which is what caused them to take notice.
- olyjohn 2y ago
  Please tell me Windows doesn't STILL autorun off of external drives? I thought that was solved years ago...
- geor9e 2y ago
  Autorun has been disabled since the release of Windows 7 in 2009.
  - unsnap_biceps 2y ago
    For what it's worth, I just checked on my windows 11 install and it was (somewhat) enabled. Settings -> Bluetooth & Devices -> AutoPlay -> Use AutoPlay for all media and devices Was set to on, and "Removable drive" was set to "Choose a default", which appears to be equivalent to "Ask me every time". I don't have anything (that I'm aware of) that auto-runs something, but I presume it will prompt me asking if I want to run setup.exe, which seems somewhat reasonable for new hardware. And from the malware analysis, https://www.hybrid-analysis.com/sample/e3f57d5ebc882a0a0ca96f9ba244fe97fb1a02a3297335451b9c5091332fe359/6783acb889e814045f0a2da6 https://www.hybrid-analysis.com/sample/e3f57d5ebc882a0a0ca96... , it's signed by "Owner: CN=Microsoft Windows Hardware Compatibility Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US; Issuer: CN=Microsoft Windows Third Party Component CA 2012, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" which also looks pretty legit. I can totally see a lot of folks allowing it to run.
    - geor9e 2y ago
      Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not capable of running an .exe
      - unsnap_biceps 2y ago
        Microsoft seems to disagree with your assertion. > An autorun.inf file is a text file that can be used by the Autorun and AutoPlay components of Microsoft Windows. When a USB drive is plugged into a USB port, an autorun USB dialog appears that prompts you to do certain operations: print images, run Windows Media Players, or open a folder. But what if you have a particular application on the USB drive and want it to be launched from the autorun USB dialog? You can put autorun.inf into the root of the USB drive and edit its commands to get the app started when the USB key is plugged. https://answers.microsoft.com/en-us/windows/forum/all/enable-or-troubleshoot-autorunautoplay-for-a-usb/eb137a20-e28b-4bf3-98f8-bcf7e45d8515 https://answers.microsoft.com/en-us/windows/forum/all/enable... > Created on November 17, 2022 > Applies to: Windows / Windows 11 / Files, folders, and storage
        gruez 2y ago
        Autorun still exists, but at least on windows 10, it doesn't run the exe right away. It shows a popup box that asks you whether to run the exe or open the drive in explorer.
        geor9e 2y ago
        Thats a Microsoft community forums agent though, and in my experience they spam low effort boilerplate solutions in hopes of getting a few votes. If they searched the web specifically for how to do something only possible before 2007, then it does make sense they found instructions from that era. Here's the info from https://en.wikipedia.org/wiki/Autorun.inf https://en.wikipedia.org/wiki/Autorun.inf that seems more up to date "For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored."
  - hulitu 2y ago
    > Autorun has been disabled since the release of Windows 7 in 2009. No. Microsoft just said it will disable it. On some systems, i've seen it disabled (i don't know if by default or by AD policy) but, on the majority of Windows 10, it was not disabled.
    - geor9e 2y ago
      By `autorun` we're talking about the notorious pre-2007 function of automatically running an exe — the `open` key in the `autorun.inf` file, specifically. It's ignored in all non-EOL Windows versions. It technically true that features called Autorun and Autoplay are still `enabled`, they just don't do what they did pre-2007. The `icon` key still works, but not `open`. You can re-enable `open` with registry edits, but it's not easy.
geor9e 2y ago
The dongle enumerates as a USB hub with two USB devices plugged into it. One is an ethernet dongle, which is the sort of hardware that may require a driver. The second device is a USB flash drive containing a .exe, which extracts a file called Setup.exe. It won't execute unless the user manually executes it - it's just a USB drive after all. Maybe the .exe contains malware, maybe it doesn't. Maybe antivirus scans give false positives. Maybe the manufacturer found a clever way to save money by combining the two USB devices they normally shipped together. Maybe this twitter account just made a nice paycheck from clickbait engagement.
karotte 2y ago
Believe it or not, but 'enumerating as a CD-ROM' drive is actually a documented feature of some Realtek USB Ethernet Interfaces: https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Realtek-Semicon-RTL8153B-VB-CG_C2802072.pdf https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Rea... (6.16. Driver Auto-Install Mode, page 24).

BenjiWiebe 2y ago

Twitter is terrible and I can't remember the nitter instance that still works.

gruez 2y ago
https://xcancel.com/evapro30/status/1878593145534923124 https://xcancel.com/evapro30/status/1878593145534923124
- BenjiWiebe 2y ago
  thanks!

elfchief 2y ago

It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious". The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually requires human analysis to draw conclusions about -- and anyone who has ever used it knows how many false positives it finds. A better proclamation might be "cheap network adapter comes with an auto-running executable which needs further analysis".

nirui 2y ago
Can you call it "auto-running" when they it don't even bother to pack in an autorun.inf? (based on https://x.com/evapro30/status/1878635208582562113 https://x.com/evapro30/status/1878635208582562113)
- steffanA 2y ago
  The autorun.inf would be in the flash drive, not the executable they uploaded to Any.Run. Were any pics of the flash drive contents shared?

ChrisArchitect 2y ago

Related blog post: https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memory-exe-recognized-as-malware https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memor...

IronWolve 2y ago

It ain't just twitter that has armchair experts that are rude. Most social media sites allow this behavior. So many replies with horrible posts "your doing it wrong", "read the docs", etc. I've seen so many correct responses downvoted and with horrible replies. Anyone who used old moderated email lists will see how culture changed and the decline of actual conversation. Even stack overflow has went downhill.

IamLoading 2y ago

Reverse engineering by OALabs - https://www.youtube.com/watch?v=3IfJSGWIrCo https://www.youtube.com/watch?v=3IfJSGWIrCo Current verdict - not malware.

fishstock25 2y ago

"The chinese" yeah sure. Lmao. Everybody panic, there are two chips inside! Check out https://news.ycombinator.com/item?id=42743033#42743428 https://news.ycombinator.com/item?id=42743033#42743428 for more lulz

necovek 2y ago

I liked the graceful admission of error too: https://x.com/evapro30/status/1880123024474796107 https://x.com/evapro30/status/1880123024474796107

fishstock25 2y ago
I like when people put their thoughts so out in the open. Makes it much easier to know whom to not work for, since the work culture must be terrible, if they even publicly express themselves that way.