Slashdot Mirror
First Trojan for Windows CE Released
Tuxedo Jack writes "Symantec and The Register are reporting that the first Windows CE trojan horse, known as Brador, has been mailed to Trend Micro. This cannot spread on its own; it must be mailed or transmitted, then opened. Once opened, it opens a TCP port, allowing the remote-controller to connect and establish control over it. As expected, this will most likely be used to make new botnets, and it leads me to wonder: will we soon need firewalls for Windows Embedded?"
Interesting point that it cannot spread on its own. It appears to be following similar paths to viruses for other OS...start simple, move up in complexity and sneakiness.
Greaaaaaat.
"Work is the curse of the drinking class" Oscar Wilde
..for CE because, as usual, people will have to patch their CE-based PDA. If desktop Windows is any example, most people won't bother to download security updates, leading to exposure to other damaging varients. I'm sure the brains at Symantec are running in high gear right about now.
Don't be a looter...and yes, I know that it's spelled with an "A" instead of an "E".
that smartphones were hit by a worm before windows CE, anyone wondering the same thing?
Can you get virus/wormprotection for CE already at all?
There are more mac's than window CE devices yet there is now a virus for that platform. That argument about macs having a smaller marketshare and thus are not the target of hackers can be trown out of the window.
Can it?
Jonathanjk.com
First Trojan for WinCE? Good! Now I won't have all of these little Pocket PCs running around!
If you have ANY device connected to a network, it should be protected (firewalled) from evil-doers.
Sincerely,
GWB
using System.Awesome;
>will we soon need firewalls for Windows Embedded?
...
given how important and prevalent networking is, shouldn't every network capable device now have some sort of a firewall?
by analogy, after seatbelts were invented, instead of waiting for a car crash and asking
"do cars need seatbelsts?", then waiting for a van crash and asking
"do vans need seatbelts?", then waiting for an SUV crash and asking
"do SUVs need seatbelts", then waiting for a lorry crash and asking
"do lorrys need seatbelts"
just skip to the end - put seatbelts in all vehicles unless a very good reason not to.
IIRC everybody's favorite e-voting company Diebold uses CE for their voting machines. I wouldn't be surprised if they used it for their ATMs too. There's a pretty big market to be hit if you can get a worm onto either of those private networks.
since it doesn't even spread or do anything except accept commands over network I highly doubt that it isn't the first of it's kind.
and tell me, WHAT GOOD WOULD A FIREWALL DO AGAINST AN _INTENTIONALLY_ INSTALLED BACKDOOR PROGRAM? nothing nada zip zero.. if you _wanted_ to run it which you must(in case of this program) you would want to turn off the fw too, no?
and built for botnets? no way, are you disconnected with reality? building a botnet with these would be total idiocy.
and then it's for windows mobile, not ce(yes, a mild difference but difference anyways): " Backdoor.Brador.A will work on Windows Mobile 2003 and only affects ARM-based devices."
oh and another thing. 99% of the time these devices are behind NAT if they're on network.
world was created 5 seconds before this post as it is.
Well I would love to hear how all the people posting in this story complaining about the operating system security suggest how to prevent this trojan from working? It does not spread, you have to manually download it or get it in a mail, it does not automatically run, you have to run it yourself, just where is the operating system supposed to look to be able to tell that the user needs to protected from itself?
Wouldn't it just be easier to send them the Amish Virus instead?
Hey maybe this program is really useful? I mean does microsoft have a remote control program for windows CE? Think of it like terminal service but FREE! This program is good. Install it!
For a PDA. Why does WinCE ship with any ports open at all? What possible services should it offer in an out-of-the-box, no-user-input-required configuration? Look at OSX, no ports open by default. Look at any decent Linux distro - the daemons listen on localhost only. When will MS change their tune, or are they operating under the 'no such thing as bad publicity' theory?
I want to delete my account but Slashdot doesn't allow it.
I had a chat with my cousins husband close to a year ago and he was working with a company that was creating a firewall for windows CE because they knew this would become a problem plus there are already numerous security flaws he explained to me which i forgot over the course of a year...
so the idea of a windows CE firewall has already been in the works for some time...
i was doing a project for school and this topic came up because it was a new technology that could be exploited over time
What's the big deal about this, trojans are easy to write for any OS. This particular one opens a listening TCP port, and emails out it's IP address. Since WinCE is a fairly complete OS with a TCP/IP stack and an email client, it's rather obvious that something like this can be written. If they'd discovered a hole that can be exploited without user intervention, that would be big news.
A possible security weakness of WinCE is that it has no real user and priviledge separation (like Win9x). But what many people who argue for security through priviledge seperation forget to mention is that a standard user (both on NT and Unix) usually has quite a lot of priviledges. You don't need to be root to open ports >1024 or silently send out thousands of emails. Remember, anything YOU can do under a normal user account, a trojan can do as well. So something like this could be easily written for Linux or MacOS. The only security that priviledge separation buys you is that you normally can't change system or other users' files. Since WinCE only supports one user, and the system is in ROM (a hard reset erases all virusses), there is nothing to be gained here.
I just got a Belkin 54g ADSL router and have been dismayed by it's annoying habbit of not syncing for hours at a time then deciding to work again. Another ADSL modem works all the time.
.exe suffix. Oh oh. That means that the box itself is running some kind of MS software. This probably explains why it behaves in such a flakey manner generally.
I discovered that the admin interface called up a file with a
I wonder how long it will be before these so-called firewall boxes are turned into zombies.
Now Windows is worming its way into more and more embedded appliances people are just having to get used to a lower and lower standard of reliability from devices that never used to crash or get viruses, such as ATM machines, firewall/routers, mobile phones etc.
I hope consumers and embedded developers become aware of this and stop the rot.
If you think you are a disease, I'd say there's certainly something wrong.
To have a right to do a thing is not at all the same as to be right in doing it
Anyone know if there have been any malware for PalmOS? Go into any CompUSA, BestBuy, Staples etc and the PDA's will have PalmOS or WindowsCE. Once in a blue moon you'll find a linux based PDA, but it is still rare. So I would think a security comparison would be in order of PalmOS and WindowsCE since they are the more common PDA OS's.
Trojan: "Dude! I owned an iPAQ! Emailed to the user, he opened me up and BAM! I had root access to this...uh...little....uh...bitty....room. ....ahemm..."
"...and it leads me to wonder: will we soon need firewalls for Windows Embedded?"
Not soon, you need them now! If a device has a public network interface, it needs a firewall. It's not just a matter of Windows sucking, PalmOS, Symbian, Linux, etc. devices are going to have exploitable bugs (and therefore need firewalls) as well.
0 1 - just my two bits
A trojan requires direct user intervention.. It should not suprise anyone that one exists..
It should be a suprise that people still fall for them in this day and age.
Now if this was a worm for CE.. that would be news.
---- Booth was a patriot ----
It's not exactly difficult to make a trojan for Windows CE... just write a simplistic Win32 trojan, taking care to only use API calls supported by CE and avoiding use of the standard C library (always good advice when writing virii/worms/trojans, anyhow!)
If someone had released this trojan for the Win32 platform it would be almost laughable, not newsworthy except for its silliness. But compile it against a different set of DLLs and target a different architecture, and suddenly it's news? What gives?!?
Not to mention the fact that the heterogeneity of Windows CE instruction set architectures makes it hard for a virus or worm to spread. Even if you write a genuine virus, if you target ARM (the most popular chip for CE devices), at best you'll be able to infect 60% of the devices your virus encounters.