Slashdot Mirror
Energizer USB Battery Charger Software Infects PCs
swandives writes "Researchers at US-CERT have warned that software accompanying the Energizer DUO USB battery charger contains a Trojan that gives hackers total access to a Windows PC. The product was sold in the US, Latin America, Europe and Asia starting in 2007. Upon installation, the software creates the file 'Arucer.dll,' a Trojan that listens for commands on TCP port 7777. Upon receiving instructions, the Trojan can download and execute files, transmit files stolen from the PC, or tweak the Windows registry. Uninstalling the software disables the automatic execution of the Trojan. Users can also remove Arucer.dll from Windows' system32 directory and reboot the machine to disable the backdoor component."
Interesting that Arucer.dll is (aside from an extra 'r') an anagram for Energizer's competitor Duracell. Perhaps the authors of the software thought Duracell was spelled 'Durracell'? And perhaps they decided to pick an anagram of the competitor to make it look as though Duracell is behind this?
My work here is dung.
Why does a USB-powered charger need software at all?
It's called a DUO because it can plug into the wall or into a computer. So it works without a computer. To get the computer to jack up the USB power output from the default 100mA, the device could identify itself as a hub -- no software required.
I get it that the software can monitor charging, report stuff, advertise... But how does Energizer feel now, with egg on their faces?
Its language code is Chinese.
just keeps going....and going...and going....
sig loading.......
No version for linux is a good thing.
I tried $sudo apt-get install arucer in Kubuntu, but the Trojan is not yet in the repository. Perhaps is should use $sudo dpkg and install it from the USB key it's self.
I wonder if Wine will run this?
* Carthago Delenda Est *
Some time back, when USB chargers started to appear at airports, I warned that this might happen. A public charging port is such an attractive attack vector.
Of course, the real problem is Windows's "autorun". It was a truly awful idea to have Windows run any executable that appears on any removable device or medium. That went in (in Windows 95, I think) when CDs were only manufactured by major vendors, before home CD writers or USB storage devices. So it probably seemed "safe" at the time.
Worse was making it very difficult to turn autorun off.
if only because of the giant wooden Energizer Bunny on the packaging.
If you post it, they will read.
What the... WHYY?
My battery charger takes four batteries and goes into the power socket. That’s it.
I don’t see why in the world a charged would need more than this.
It’s like having a supercomputer to control a toaster. It makes no sense at all.
In my eyes, those who bought that thing, deserve what they got.
Any sufficiently advanced intelligence is indistinguishable from stupidity.
Ubuntu does not equal Linux. Come on man! You probably have to wait for it to be packaged upstream. Besides, a DLL is a LIBRARY file. You should be looking for lib-arucer or something similar like waffles, or whatever the developer felt like naming it. If that doesn't work, try x-arucer, or switch to Gentoo. I am sure they can get it.
PS- Wine might run it, but you will probably need a patch. Try Cedega or Play-On-Linux, or qemu or dosbox.
Energizer obviously isn't the first company to be hit with this sort of embarrassment, and it's surprising to me how resistant some of these companies are to learning and adopting good QA and security practices.
If corporations feel that they must outsource production of devices like these, they damn well better be prepared to do thorough in-house testing before they release malware to the public. I'll give them the benefit of the doubt that they were probably unaware of this trojan, but that makes them no less negligent.
Facts have a liberal bias.
Not true. If it had been a giant wooden bunny, they'd have known that Lancelot, Galahad, and Bedevere had forgotten to get inside in the first place.
I am officially gone from
Just wait until you plug it into your Toyota.
This little trick will disable all autoplay features, eg. CDs, USB-memories etc. Open the registry editor, regedt32.exe, and configure the following registry value:
Hive: HKEY_LOCAL_MACHINE
Key: SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Value Name: NoDriveTypeAutoRun
Type: REG_DWORD
Value: hex: 0x03fffffff
It gives hex dumps of some of the commands. (Since some of them would obviously require arguments, they clearly can’t be full packets, but they’re signatures of each particular packet.)
All of them follow this pattern:
C2 E5 E5 E5 9E
8 bytes that are different for each command
C8
4 bytes that vary
C8 D1
3 bytes that vary
C8
4 bytes that vary
C8
12 bytes that vary
98 E5
Graphing the sequences showed very obvious trends: Lots of values clustered in approximately the 155-170 range, and lots in the 200-220 range. Also, the 3-byte field that is different for every command has a different clustering pattern.
XORing the patterns with 0-255 yielded the following at 229:
'\0\0\0{98D958FC-D0A2-4f1c-B841-232AB357E7C8}\0
'\0\0\0{F6C43E1A-1551-4000-A483-C361969AEC41}\0
'\0\0\0{783EACBF-EF8B-498e-A059-F0B5BD12641E}\0
'\0\0\0{EA7A2EB7-1E49-4d5f-B4D8-D6645B7440E3}\0
'\0\0\0{E2AC5089-3820-43fe-8A4D-A7028FAD8C28}\0
'\0\0\0{384EBE2C-F9EA-4f6b-94EF-C9D2DA58FD13}\0
'\0\0\0{4F4F0D88-E715-4b1f-B311-61E530C2C8FC}\0
Now, colour me surprised, but those look a damn awful lot like CLSIDs...
VERY INTERESTING.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
I spent the morning reverse engineering the Trojan and wrote an Nmap script to detect if a remote system is infected. Hope it helps out: http://www.skullsecurity.org/blog/?p=563.
Ron
http://www.skullsecurity.org/blog/