DarkFiber Consulting – IT Managed Services

Malicious Code Spreading Through USB Flash Drive Devices

November 20th, 2008 . by DarkFiber Consulting

DarkFiber Consulting is aware of public reports of an increase in malicious code propagating via USB flash drive devices. Currently, there are two popular methods by which USB flash drives are being infected with malicious code. Please note that these are not the only two methods available.

The first of these methods is referred to as simple file copy. This means that the malicious code initially resides on an infected computer and copies itself to all the storage devices connected to the affected computer. This method requires the user to access the USB flash drive and execute the malicious code.

The second method is referred to as AutoRun.inf modification. This means that the malicious code alters or creates an autorun.inf file on targeted storage devices connected to the affected computer. When an infected USB flash drive is connected to another computer, the malicious code can be automatically executed with no additional user interaction.

DarkFiber Consulting encourages users to do the following to help mitigate the risks:

  • Install antivirus software and keep the virus signatures up to date.
  • Do not connect an unknown or untrusted USB drive to your computer.
  • Disable AutoRun or AutoPlay features for removable media.
  • Review the Using Caution with USB Drives Cyber Security Tip for more information on protecting your USB flash drive.
  • Review The Dangers of Windows AutoRun Vulnerability Analysis Blog entry for more information regarding AutoRun.

Torpig Trojan Horse Attack Activity

November 6th, 2008 . by DarkFiber Consulting

DarkFiber Consulting is aware of public reports of a high volume of financial accounts compromised by the Torpig (also known as Sinowal or Anserin) Trojan horse. This Trojan horse uses HTML injection to add fields to web pages in order to convince users to provide additional user credentials or financial account information. Systems compromised by this Trojan horse are being used by attackers to obtain FTP credentials, email addresses, and digital certificates of the current user.

This Trojan horse uses an MBR rootkit known as Mebroot. This rootkit contains configuration information for the Trojan horse as well as techniques used to keep the Trojan horse undetectable.

DarkFiber Consulting encourages users to do the following preventative measures to mitigate the security risks:

  • Install antivirus software, and keep the virus signatures up to date.
  • Investigate anomalous or slow-running machines, looking for unknown processes or unexpected Internet connections as this may be a sign of malicious programs operating in the background.
  • Examine firewall logs of systems for connections to or from anomalous IP addresses.
  • Consider traffic analysis to identify compromised systems that are exfiltrating data.