Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 18 guests and 2 members online
EH-Net Donations

Enter Amount:
$

Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Malwarearrow Flash drive virus
Ethical Hacker Community Forums
November 20, 2008, 09:54:20 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
  Print  
Author Topic: Flash drive virus  (Read 10338 times)
0 Members and 1 Guest are viewing this topic.
iSmith
Full Member
***
Offline Offline

Posts: 156


Do or do not. There is no try. - Yoda


View Profile
« on: January 29, 2008, 09:41:11 AM »

I once got an infected flash drive to clean. As soon as I put it in, Norton told me it had w32.sillyFDC. I tried to delete it, but the drive was locked. So i unlocked it and put it back in, and the virus disapeared right in front of my eyes. So I scanned it with Norton and it picked up 3 instances of w32.rontok@mm. But even a regularly updated Norton '07 can get confused by this old tricky virus. It names itself X.exe where X is the directory in which it resides. If you open the folder X in Windows explorer the virus moves itself, too quick to catch. I was eventually forced to delete 19 copies of it in dos prompt. Grin
Logged

In my eyes, your operating system is as solid as swiss cheese.
Negrita
Sr. Member
****
Offline Offline

Posts: 289



View Profile
« Reply #1 on: January 29, 2008, 03:20:16 PM »

Yet another example of the superiority of the CLI over the GUI.
Logged

CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
dannioni
Newbie
*
Offline Offline

Posts: 44


View Profile
« Reply #2 on: February 04, 2008, 11:38:26 AM »

Or you could just have opened it in linux from the very beginning Tongue
Logged
pseud0
Full Member
***
Offline Offline

Posts: 139



View Profile
« Reply #3 on: February 04, 2008, 01:08:35 PM »

Or you could have modified the source code to open a listening port for you then left the thumb drive on the table in the break room by the HR department.  At least that is what my evil twin would have done.
Logged

CISSP, CISM
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 295



View Profile
« Reply #4 on: February 04, 2008, 02:55:19 PM »

I wonder how many USB drives are running around that have Hacksaw on them already.  I could just see someone giving out a box of 'free' usb drives to a college or institution, and using the emailed info from their Gmail account to 'passively' gather info on the students or institution. 

Interesting thought, has anyone done that for pen testing?  Gone into the target area and given out 'free' thumbdrives as a 'promotion'?  Besides installing backdoors and whatnot on them, just having the machines email you outside the organization info passively would be an interesting attack as well.
Logged

"Bad.. Good?  I'm the guy with the gun"
BillV
Hero Member
*****
Offline Offline

Posts: 862


View Profile
« Reply #5 on: February 04, 2008, 03:08:38 PM »

I heard a story in one of my classes of someone giving out CD's that had something on them, but I've not heard of anyone doing it with a flash drive.. though I'm sure it's been done.
Logged
iSmith
Full Member
***
Offline Offline

Posts: 156


Do or do not. There is no try. - Yoda


View Profile
« Reply #6 on: February 04, 2008, 03:40:34 PM »

Dannioni, all of the linux distros i've used cannot modify files on a windows storage device.
Logged

In my eyes, your operating system is as solid as swiss cheese.
Negrita
Sr. Member
****
Offline Offline

Posts: 289



View Profile
« Reply #7 on: February 04, 2008, 04:32:06 PM »

Dannioni, all of the linux distros i've used cannot modify files on a windows storage device.
Have you ever tried Knoppix?
Logged

CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
jimbob
Sr. Member
****
Offline Offline

Posts: 307



View Profile WWW
« Reply #8 on: February 04, 2008, 04:46:40 PM »

Dannioni, all of the linux distros i've used cannot modify files on a windows storage device.
Linux now supports read/write on NTFS. Unless you talking about a windows striped volume linux ought to be able to read and write to a regualr Windows storage device.

Jimbob
Logged
pseud0
Full Member
***
Offline Offline

Posts: 139



View Profile
« Reply #9 on: February 04, 2008, 07:11:02 PM »

To the question earlier, yes, there are pen testing teams that have physical media drops as part of their assessment.  One of the tiger teams I know used it to really screw with a bank.  They dropped a dozen usb drives in the parking lot that were installed with a piece of code that would fire off when windows auto mounted.  It didn't install anything, just pinged their server so they could get a count.  11 of the 12 were used in the bank, the last was used by a customer on their home system.  As for CD's, that is a story from one of the original black hats.  Someone loaded a trojan onto those little mini-CDs and just walked around the conference throwing them onto the tables of other participants.  Dozens of people picked them up thinking they were demo disks.  The next generation of this is already here, and that is infecting the media on creation.  Foreign governments are pre-loading devices with trojans and just waiting to see where they'll end up.  Other times you'll get people in the factories that will put the malware into memory chips without ever knowing what devices they will get built into...

http://redtape.msnbc.com/2008/01/digital-picture.html
Logged

CISSP, CISM
BillV
Hero Member
*****
Offline Offline

Posts: 862


View Profile
« Reply #10 on: February 04, 2008, 10:02:38 PM »

Yeah, that's right. That's the story I heard about the CD's. As for the stuff that's getting put on during creation.. pretty creepy.
Logged
iSmith
Full Member
***
Offline Offline

Posts: 156


Do or do not. There is no try. - Yoda


View Profile
« Reply #11 on: February 05, 2008, 09:09:03 AM »


Have you ever tried Knoppix?
[/quote]
I have tried slax, nimblex, and mandriva but i have never really been able to get my hands on knoppix.
Logged

In my eyes, your operating system is as solid as swiss cheese.
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 295



View Profile
« Reply #12 on: February 05, 2008, 10:15:16 AM »

Reminds me of the Maxtor hard drives that had a built in trojan that phoned home to china and sent your data to servers there.  A good article on that... though it's amazing how that story became very quiet. 

iSmith, knoppix is as easy to get your hands on as googling it, downloading the iso and making a cd.  It's really a great program for fixing Windblows when it breaks.  Lots of utilities, and like... well most Linux distro's I've ever tried, it supports reading/altering ntfs partitions.  A thumbdrive with either DSL (damn small linux) or backtrack on it is a great little pocket sized tool for fixing computer... or 'fixing' computers.
Logged

"Bad.. Good?  I'm the guy with the gun"
pseud0
Full Member
***
Offline Offline

Posts: 139



View Profile
« Reply #13 on: February 05, 2008, 10:37:17 AM »

For folks moving into the security or incident response space for the first time, Knoppix, Helix, and BackTrack are an incredible resource.  As for mounting the windows drive you are going to hit two issues: make sure your linux build is recognizing your usb ports, and using the right file system.  Most of the live CD's will auto sense the usb ports so that shouldn't be an issue, and some of them will automount the drive if it is plugged in when you boot.  If you have to mount it manually, try ntfs first and samba seconds if you can't get ntfs to work.  Another thing to check, if you are trying to mount with one of the linux builds meant for forensics (especially Helix) when you do get it mounted it will be hard set as read only.  It can be a bit of a pain in the hind-quarters to get it mounted as writeable.
Logged

CISSP, CISM
Negrita
Sr. Member
****
Offline Offline

Posts: 289



View Profile
« Reply #14 on: February 05, 2008, 02:45:19 PM »

I have tried slax, nimblex, and mandriva but i have never really been able to get my hands on knoppix.

Here you go!!!
Logged

CEH, CCSA NG/AI, NNCSS, MCP, MCSA 2003

There are 10 kinds of people, those that understand binary, and those that don't.
Pages: [1] 2   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.07 seconds with 23 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
During the most recent election, I:
 
Support EH-Net


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.