Trojan virus spreads via PC mouse

Think your computer or network can get a Trojan virus or malware only via a malicious website or an infected flash drive? Think again: even a mouse can get the job done, too.

A modified mouse —and almost any hardware device that can be plugged into a computer— can potentially infect a network, as shown in a recent hack by security firm Netragard.

"(We used) electronics which include a teensy microcontroller, a micro USB hub, a mini USB cable (we needed the ends) a micro flash drive (made from one of our Netragard USB Streamers), some home-grown malware (certainly not designed to be destructive), and a USB device like a mouse (or) whatever else someone might be tempted to plug in. When they do plug it in, they will be infected by our custom malware and we will use that point of infection to compromise the rest of the network," Netragard said in a blog post.

Netragard said the challenge had been to penetrate a network with a single IP address bound to a firewall that offered no services.

Other limitations included no use of social networks, telephone, email or physical access to the network to be penetrated.

For its project, Netgard used a fancy Logitech USB mouse fitted with a microcontroller and a tiny USB flash drive where the malware is stored.

But even without the flash drive, Netragard noted it "could still instruct the mouse to fetch the malware from a website."

Netragard also created custom malware for the antivirus software that the target computer is using.

"We wanted our malware to be able to connect back to (us) but we needed more than that. We needed our malware to be fully undetectable and to subvert the 'Do you want to allow this connection' dialogue box entirely. You can’t do that with encoding," it said.

Netragard then shipped the mouse to the target, making it look like a promotional gadget so the victim will use it.

"Sure enough, three days later the mouse called home," it said.

Public unaware of threat

Infoworld's Roger Grimes said that many are unaware that hardware, especially a mouse, can be used to deliver auto-launching exploit code.

"IT security admins must understand that a computer can be compromised by almost any hardware device plugged into it. Hardware is hardware —the instructions coded into it and its firmware takes precedence over software. When we talk trust boundaries in computer security, you always have to remember the hardware boundary must be discussed and defended," Grimes said.

"If I, as the attacker, can convince a victim to plug in some sort of hardware or if I plug it in myself, then it is, for all intense purposes, game over. If I can plug something into your USB, DMA, FireWire, and now mouse port, I'll likely succeed in carrying off a malicious action," he added.

Grimes said end-user education is always worth the effort.

"Let your end-users know that anything they plug into their computer could launch malicious code. That free USB key at the conference show? They shouldn't plug it in, nor should they attach free mice, free keyboards, or whatever if they are at elevated risk of physical attack," he said. — TJD, GMA News

Loading...

Editor’s note:Yahoo Philippines encourages responsible comments that add dimension to the discussion. No bashing or hate speech, please. You can express your opinion without slamming others or making derogatory remarks.

  • Indonesia defiant as UN leads condemnation of looming executions
    Indonesia defiant as UN leads condemnation of looming executions

    Indonesia on Sunday signalled it was determined to push ahead with the execution of eight foreign drug convicts, despite a growing wave of global condemnation led by United Nations chief Ban Ki-moon. Authorities on Saturday gave formal notice to the eight -- from Australia, Brazil, Nigeria and the Philippines -- that they would be executed by firing squad imminently, along with an Indonesian prisoner. The group have been moved to the high-security prison island of Nusakambangan, where …

  • Philippines calls on ASEAN to urge China to halt land reclamation
    Philippines calls on ASEAN to urge China to halt land reclamation

    The Philippines called on its Southeast Asian neighbours to unite in urging China to halt reclamation of land in the South China Sea, but the call failed to raise widespread support ahead of a regional summit. China claims 90 percent of the South China Sea, which is believed to be rich in oil and gas. Its claims overlap with those of Brunei, Malaysia, the Philippines, Vietnam and Taiwan. Recent satellite images suggest China has made rapid progress in filling in land in contested territory …

  • Philippines urges ASEAN to stop China in South China Sea
    Philippines urges ASEAN to stop China in South China Sea

    KUALA LUMPUR, Malaysia (AP) — The Philippines on Sunday urged its fellow Southeast Asian countries to take immediate steps to halt land reclamation by China in the disputed waters of the South China Sea, warning that failure to do so will see Beijing take "de facto control" of the area. …

  • Philippines urges Southeast Asia to rally to halt China reclamation in disputed waters
    Philippines urges Southeast Asia to rally to halt China reclamation in disputed waters

    The Philippines on Sunday called on neighbouring Southeast Asian nations to push for an immediate halt to China's reclamation in the disputed South China Sea ahead of a regional summit. China claims 90 percent of the South China Sea, which is believed to be rich in oil and gas, with overlapping claims from Brunei, Malaysia, the Philippines, Vietnam and Taiwan. Recent satellite images suggest China has made rapid progress in building an airstrip suitable for military use in contested …

  • President to appeal for Filipina's life at Malaysia summit
    President to appeal for Filipina's life at Malaysia summit

    The Philippine president said Sunday he would appeal for mercy for a Filipina who is due to be executed in Indonesia in two days' time. President Benigno Aquino said he would take the opportunity to seek clemency for Mary Jane Veloso, who is due to be put to death on Tuesday, while in Malaysia for a regional summit Monday. "Once I am there, I will try to speak to President Joko Widodo of Indonesia to appeal once more for her case," Aquino said. She was arrested in 2009 with 2.6 kilograms …

  • U.N. chief appeals to Indonesia not to carry out executions
    U.N. chief appeals to Indonesia not to carry out executions

    United Nations Secretary-General Ban Ki-moon appealed to Indonesia on Saturday not to execute 10 prisoners, including two Australians, for drug-related crimes. Indonesia has so far informed seven of the 10 death row inmates, including the Australians and one Nigerian, that they will be executed in a matter of days, possibly as soon as Tuesday. Nationals from Brazil, Ghana and the Philippines are also on Indonesia's death row. A temporary reprieve was granted to a French citizen who will not …

  • Beijing 'poised to take de facto control' of S. China Sea'
    Beijing 'poised to take de facto control' of S. China Sea'

    Beijing is poised to take "de facto control" of the South China Sea, the Philippines warned Sunday, but its call for a robust Southeast Asian response at a regional summit was shot down. Vietnam, the Philippines, Malaysia and Brunei claim parts of the strategic body of water, but Beijing claims nearly all of it, and its increasingly strident territorial assertions have caused concern in the region and beyond. "(China) is poised to consolidate de facto control of the South China Sea," …

  • US eyes access to Phl bases in 8 locations
    US eyes access to Phl bases in 8 locations

    The United States has asked for access to Philippine military bases in eight locations to rotate troops, aircraft and ships as Washington shifts its forces to Asia and as China expands its military presence in the South China Sea. US Defense Secretary Ash Carter, in a speech in Arizona, has outlined Washington’s next phase in its Asia “pivot,” deploying its most sophisticated destroyers, bombers and fighters to the region. The Asia “pivot” has already seen US Marines rotating through the …

POLL

Should Aquino be held accountable over the Mamasapano operations?

Loading...
Poll Choice Options