USB Trojan Hides In Portable Applications, Targets Air-Gapped Systems

Posted by msmash on Thursday March 24, 2016 @06:06AM from the security-woes dept.

Reader itwbennett writes: A Trojan program, dubbed USB Thief by researchers at security firm ESET, infects USB drives that contain portable installations of popular applications such as Firefox, NotePad++, or TrueCrypt, and it also seems to be designed to steal information from so-called air-gapped computers. "In the case we analyzed, it was configured to steal all data files such as images or documents, the whole windows registry tree (HKCU), file lists from all of the drives, and information gathered using an imported open-source application called 'WinAudit'," the ESET researchers said. The stolen data was saved back to the USB drive and was encrypted using elliptic curve cryptography. Once the USB drive was removed, there was no evidence left on the computer, the ESET researchers added.

1 of 83 comments (clear)

Min score:

Reason:

Sort:

Re:Air gapped by khasim · 2016-03-24 07:08 · Score: 4, Informative

Since your air-gapped computer doesn't have network capabilities (duh) the only reasonable way to do that is with a USB drive.
Not if you really do not want that key to be leaked.
USB drives are too easily compromised.
Use a CD drive instead. Yes, you CAN still buy them. And verify the CD on a different computer.