Slashdot Mirror
Energizer USB Battery Charger Software Infects PCs
swandives writes "Researchers at US-CERT have warned that software accompanying the Energizer DUO USB battery charger contains a Trojan that gives hackers total access to a Windows PC. The product was sold in the US, Latin America, Europe and Asia starting in 2007. Upon installation, the software creates the file 'Arucer.dll,' a Trojan that listens for commands on TCP port 7777. Upon receiving instructions, the Trojan can download and execute files, transmit files stolen from the PC, or tweak the Windows registry. Uninstalling the software disables the automatic execution of the Trojan. Users can also remove Arucer.dll from Windows' system32 directory and reboot the machine to disable the backdoor component."
Interesting that Arucer.dll is (aside from an extra 'r') an anagram for Energizer's competitor Duracell. Perhaps the authors of the software thought Duracell was spelled 'Durracell'? And perhaps they decided to pick an anagram of the competitor to make it look as though Duracell is behind this?
My work here is dung.
Heck, I can't figure out how to disable half the auto-runs on my sister's laptop.
These guys definitely know what they're doing :)
Quidquid latine dictum sit, altum videtur
Why does a USB-powered charger need software at all?
It's called a DUO because it can plug into the wall or into a computer. So it works without a computer. To get the computer to jack up the USB power output from the default 100mA, the device could identify itself as a hub -- no software required.
I get it that the software can monitor charging, report stuff, advertise... But how does Energizer feel now, with egg on their faces?
Its language code is Chinese.
IMPORTANT NOTICE,
Windows users may be infected with “Arucer.dll”, a trojan horse virus that listens for commands on TCP port 7777. To see if this trojan is installed, go to your “Windows” folder and look for the virus called “System32” (the actual system folder is just called “System”). If you find that you are infected by this virus, delete “System32” and reboot your computer. You may also need to restart the computer in safe mode before you can delete this virus because the virus will try to prevent you from deleting it.
just keeps going....and going...and going....
sig loading.......
No version for linux is a good thing.
Why would you need a USB charger when you can have the batteries charge themselves through USB?
http://www.usbcell.com/
It just goes to show you that you can't trust anything that you plug into a computer...
I mean seriously, drivers? For a battery charger? Unless they wanted to display a nifty "charge progress indicator" in the OS... But even then, do they not have a code review before it gets flashed onto the chip?
If a man isn't willing to take some risk for his opinions, either his opinions are no good or he's no good
Some time back, when USB chargers started to appear at airports, I warned that this might happen. A public charging port is such an attractive attack vector.
Of course, the real problem is Windows's "autorun". It was a truly awful idea to have Windows run any executable that appears on any removable device or medium. That went in (in Windows 95, I think) when CDs were only manufactured by major vendors, before home CD writers or USB storage devices. So it probably seemed "safe" at the time.
Worse was making it very difficult to turn autorun off.
if only because of the giant wooden Energizer Bunny on the packaging.
If you post it, they will read.
What the... WHYY?
My battery charger takes four batteries and goes into the power socket. That’s it.
I don’t see why in the world a charged would need more than this.
It’s like having a supercomputer to control a toaster. It makes no sense at all.
In my eyes, those who bought that thing, deserve what they got.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
To be honest, they just need to get used to it and others need to be prepared for it. Imagine the opportunities for counterfeiters, they now have the potential for a new revenue stream. Regardless of whether a legitimate product comes with software or not, I expect some counterfeit goods will start coming with software. Legit or counterfeit, the company will take heat from consumers. They just need to get ready for it.
--
Perpenso Calc for iPhone and iPod touch, scientific and bill/tip calculator, fractions, complex numbers, RPN
Energizer obviously isn't the first company to be hit with this sort of embarrassment, and it's surprising to me how resistant some of these companies are to learning and adopting good QA and security practices.
If corporations feel that they must outsource production of devices like these, they damn well better be prepared to do thorough in-house testing before they release malware to the public. I'll give them the benefit of the doubt that they were probably unaware of this trojan, but that makes them no less negligent.
Facts have a liberal bias.
at least that particular backdoor. Trojans, bots, virus, other backdoors, keyloggers, etc, that went in during the 3 years that you had it installed will be a bit harder to uninstall. Same for the info that you considered safe that went thru your machine (passwords, credit card info, etc).
Anyway, a proper firewall (that at the very least dont let connect to your machine thru not specifically enabled ports) should had stopped most of it.
That fucking bunny! He's gonna have to GO~!
I would kind of guess "Made In China", and the special edition to the software could easily have been added at this phase. It makes you start to wonder about a lot of products made there, and what they could also be doing. Even something like a motherboard could have all kinds of things going on at a very low level, and who would have a clue?
WWJD -- What Would Jimi Do?
(Smash amp, burn guitar, take home the groupies)
Not true. If it had been a giant wooden bunny, they'd have known that Lancelot, Galahad, and Bedevere had forgotten to get inside in the first place.
I am officially gone from
With Bunny inside!
Actually, that's a feature also referred to as "Certified Pre-Owned".
It's actually a secret file that when run through a series of complex filtering steps will give you an image of a map where the only copy of portal 2 can be found!
As noted above, because they suck in terms of capacity.
The DUO is a small battery charger anyway.
Just wait until you plug it into your Toyota.
This little trick will disable all autoplay features, eg. CDs, USB-memories etc. Open the registry editor, regedt32.exe, and configure the following registry value:
Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value Name: NoDriveTypeAutoRun
Type: REG_DWORD
Value: hex: 0x03fffffff
http://www.angryflower.com/atlass.gif
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
The Energizer Bunny exploits a backdoor and lets the world use it?
Ouch.
But...but...but...it's just a harmless bunny rabbit!
MCSE? No, sir...I don't do Windows. Yes, I am an idealist. What's your point?
Had this been Sony the comments would've been calling for immediate boycotting of all products. Everyone stop buying Duracell!
It gives hex dumps of some of the commands. (Since some of them would obviously require arguments, they clearly can’t be full packets, but they’re signatures of each particular packet.)
All of them follow this pattern:
C2 E5 E5 E5 9E
8 bytes that are different for each command
C8
4 bytes that vary
C8 D1
3 bytes that vary
C8
4 bytes that vary
C8
12 bytes that vary
98 E5
Graphing the sequences showed very obvious trends: Lots of values clustered in approximately the 155-170 range, and lots in the 200-220 range. Also, the 3-byte field that is different for every command has a different clustering pattern.
XORing the patterns with 0-255 yielded the following at 229:
'\0\0\0{98D958FC-D0A2-4f1c-B841-232AB357E7C8}\0
'\0\0\0{F6C43E1A-1551-4000-A483-C361969AEC41}\0
'\0\0\0{783EACBF-EF8B-498e-A059-F0B5BD12641E}\0
'\0\0\0{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}\0
'\0\0\0{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}\0
'\0\0\0{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}\0
'\0\0\0{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}\0
Now, colour me surprised, but those look a damn awful lot like CLSIDs...
VERY INTERESTING.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
Look damnit, if the free market thought there was an advantage to doing things your way then we'd all be growing our own battery chargers on government plantations. You presume to tell American businesses how to optimize their production lines? Nonsense and tosh! If you want something done a particular way, do it yourself! Your elitist attitude makes me sick.
I spent the morning reverse engineering the Trojan and wrote an Nmap script to detect if a remote system is infected. Hope it helps out: http://www.skullsecurity.org/blog/?p=563.
Ron
http://www.skullsecurity.org/blog/
Who leaps out of the rabbit?
I think this device will go up on the shelf right next to my virus infected picture frame...
Sometimes, real fast is almost as good as real-time.
Remember the commercial where the Energizer bunny is hooked to the UFO? That was Jeff Goldblum's idea.
Care killed the cat, but satisfaction brought it back.
"is Steve Ballmer. Enjoy. Yous In Redmond, KT"
... nice ..
score +5: funny !!!!!!
Haaa
Does OSX not recognize and attempt to run the information on a newly inserted device based on the device content?
Is it just my observation, or are there way too many stupid people in the world?
The Metasploit Framework has been updated to include both a scanner and an exploit module for this trojan. You can find a rundown of how these modules work on the Metasploit Blog: http://blog.metasploit.com/2010/03/locate-and-exploit-energizer-trojan.html
The "100% CPU" issue noted above is easy to trigger; the trojan is written poorly and closing the connection too soon leaves the process spinning. To solve this in Metasploit, we send the "nop" command prior to the disconnect.
states that "A Dedicated Charging Port is required to short the D+ line to the D- line."
A USB hub obviously doesn't do that, so some devices won't charge off a lone hub.
"National Security is the chief cause of national insecurity." - Celine's First Law
Why does a USB battery charger need software. I have a number of devices that just use the power from a USB port to charge, and they don't connect any other wirez apart from the power.
Oh. Um, I... look, if we built this large wooden badger...
This is what happens when you make everything in China.
and stealing....your info
www.RacquetUp.org - Helping Detroit Youth
If an item just needs re-charging via USB I have been just plugging them into a powered USB hub.
Not all self-powered USB hubs work as a PC-less charging station. I have one hub that gives power whenever it's plugged into the wall, and I have another that gives power only if it's plugged into both the wall and a host.
What's sadder is that I originally contacted energizer last year and was told
"Thank you for your input. Your email has been forwarded to our software team for review."
Energizer doesn't mention that part;) After auto responses and no updates I finally gave up and sent it to CERT instead.
There are always alternatives. Like this nifty thing that runs on 2 AA batteries and has no memory or software. Sure, you'll need to get an additional $40 or so of equipment (soldering iron, clamp), but like OSS and food you make from scratch, you know exactly what's going into it.
And, for bonus points, you can expand this USB power supply with neat things like lithium-polymer batteries, USB charging, and even solar cells.
"We are Microsoft. You shall be assimilated. Competition is futile."
Personally, I would like to see some of these Windows ppl SUE Energizer and other companies for selling the products that infect their machines. Force them to pay out 10-100x what they made in profit. Once western companies realize the high costs of doing business there, then and only then will they stop.
I prefer the "u" in honour as it seems to be missing these days.
The link here's a bit misleading.
There are at least two models of Energizer battery charger that use the same software...the Energizer USB charger, AND the Energizer Duo. They're pretty much the same apart from the colour, but the Duo includes a USB to wall socket adaptor allowing you to charge it from the wall, not just USB. The Energizer press release makes this clear, most of the reporting stories don't.
Can someone please change the link to:
"warned that software accompanying the Energizer DUO AND USB battery charger"
Regards,
- David.
I know the parent said XP and 2K only - do not use on Vista.
With Windows Vista, the NoDriveTypeAutoRun registry value actually has the opposite behavior than what Windows has documented. In other words, if you think that you have protected yourself by restricting AutoRun with this registry value, you have actually put yourself at additional risk. We have published details about this issue as US-CERT Vulnerability Note VU#889747. The end result here is that a user may inadvertently execute code by clicking on the icon for a device, such as a USB thumb drive.
details here
I'd hope to find some open source software that would monitor how the charging is doing under UNIX - no such luck yet.
This is the kind of scenario I found myself thinking about when reading the "US Unable to Win a Cyber War" post from a couple weeks back. That exercise seemed such a shallow attempt to drum up public fear so we would gladly support an expanding Snoopocracy and spend a few trillion dollars on emerging venture projects from the military contractors who already control half the government. Imagine -- the government prints eleventy trillion dollars at its ever-busy dollar factory to pay for doubling the size of every alphabet-soup information awareness agency; meanwhile, a few million God-fearing citizens are going to Wal-Mart and actually PURCHASING malware...
It's like, the biggest social engineering "hack" ever. And like all social engineering attacks (you could almost include the 9/11 attacks in this genre), the devastation comes from how a meatspace method simply, directly, and sometimes nearly effortlessly sidesteps an enormous byzantine technological/physical infrastructure to exploit a human weakness no one saw because we were all so busy admiring the size and thickness of our huge new fortress walls and battlements.
Hollywood, Television, has become the dream machine. We need to take that back; each of us is a Dream Machine
Not to mention that you can charge more than one battery per USB port.
I still agree with those who prefer a mains powered charger like the ones I have that do 4 AA or AAA batteries at a time but then again that's just me.
We are pointing fingers at Chinese and Energizer for this.
What I want to know is where were our army of nerds that are supposedly looking for these types of trojans or viruses and why did it take 2.5 years to find out about it?
Surely some of the big companies selling us anti-virus and anti-trojans had some of there products on infected machines. Why weren't they able to catch on to this? I'd assume that some of them were using heuristic algorithms
What I would assume is that a lot of people saw the sign but didn't act on the problem (open 7777 ports)?
But it also may be that this trojan didn't effect that many computers and that is why it wasn't seen for a long time.
When someone complained about this software and reported as a possible trojan/virus this is the answer that was given in a "Windows User Group" in 2008
I found this DLL comes from Enegizer USB Charger: http://www.energizer.com/usbcharger/language/english/download.aspx
Aside from causing reported problems, this is not a trojan.
So really looking at it, I see it as a failure of our community.
Did snort ever detect an infected machine as having malicious activity?
Why didn't we catch this sooner and how many more like this are out there?
We have now given the recipe for having a non-detectable root-kit, use something that isn't going to be used by a lot of people and infected a small number of computers, use these as stations to infect others.
Why would you ever want to charge batteries through a USB port anyway? Last I heard, PCs require a handy-dandy AC socket connection to the power supply. Which means you could charge your batteries from there without having to install any software. Why would you ever need to install software to charge a battery? There's probably a light on it somewhere that can tell you when the battery is fully charged, but of course people want yet another icon on the task-bar and another app to start up in MSCONFIG and slow down their PC and conflict with other software mad dashing to load first. This is a stupid product to begin with, double win for it being taken off the market.
The eternal struggle of good vs. evil begins within one's self.
The only reason the USB connection is needed is to provide the +5V power. At work, there were computers set to disable USB storage - and to report any attempts to the admins - since flashdrives etc were banned for these same security concerns. Had some small video cameras that needed recharging; 30 seconds with a pair of wire cutters and electrical tape resulted in a USB cable containing only the power and ground wires (no ability whatsoever for data to make it through). Sounds like this is what Energizer needs to do. There is no need for data transfer in a battery charger, and extra wires put in by a rogue factory are a lot easier to detect than malicious code.
--- You shall know the truth, and the truth shall make you mad- Neal (not Cowboy) Boortz
Wonder where the device was made?
The Chinese really seem to be into this backdoor stuff. rowwr.
That is quite shocking.
Looks like Metasploit has a payload module to go with this backdoor. Nifty!
'The tyrant will always find pretext for his tyranny.' - Aesop's Fables