Backdoor found in Energizer Duo USB battery charger
(Credit:
Amazon)
Software that can be downloaded for use with the Energizer Duo USB battery charger contains a backdoor that could allow an attacker to remotely take control of a Windows-based PC, Energizer and US-CERT is warning.
"The installer for the Energizer Duo software places the file UsbCharger.dll in the application's directory and Arucer.dll in the Windows system32 directory," the U.S. Computer Emergency Readiness Team said in an advisory on Friday. "Arucer.dll is a backdoor that allows unauthorized remote system access via accepting connections on 7777/tcp. Its capabilities include the ability to list directories, send and receive files, and execute programs."
The Windows software was made available via a download with the Energizer Duo Charger, Model CHUSB, Energizer said in a statement.
The battery maker said it does not know how the Trojan got into the software. "Energizer has discontinued sale of this product and has removed the site to download the software," the statement said. "Energizer is currently working with both CERT and U.S. government officials to understand how the code was inserted in the software."
For systems with the software installed, US-CERT recommends removing the Energizer Duo software and Arucer.dll file, as well as blocking access to port 7777 via network perimeter devices or firewall software.
The Trojan may have been in the software since it was first offered three years ago, according to Symantec.
"We were interested in finding out how long this file had been available to the public. The compile time for the file is May 10, 2007. It is impossible to say for sure that this Trojan has always been in this software, but from our initial inspection it appears so," Symantec wrote in a blog post. "The Trojan still operates whether this device is found or not, so a USB charger doesn't need to be plugged in for the Trojan to be functioning."
If the Trojan does date back to 2007, that is around the same time that there was a rash of products like digital photo frames hitting U.S. shelves infected with malware, said Marcus Sachs, director of the SANS Internet Storm Center.
"This may simply be from that time frame when all the factories in China were not clean and many were putting malware onto stuff, not intentionally but because the hygiene wasn't good," he said in an interview on Monday.
"Who knows where the server (hosting the software) is located," he said. "It could have been exposed to the unclean conditions that were rampant there."
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
*sighs* That is such an insane comment it broders on the retarded. You want to point fingers point them at the leadership. The people of china are neither good nor bad. They are simply citizens. I'm certain that if you talked to your average Chinese citizen they would say that Americans are evil incarnate in how we force our ways on other cultures. Or bully other countries. Everyone has their own take on everyone else. But that said. Yes. The leadership in China is pretty damn fracked up. As it was with Bush. The difference is we have at least some control of who runs our country....some. China? Whatever.
60 Minutes: Stealing America's Secrets
http://www.cbsnews.com/video/watch/?id=6252949n&tag=cbsnewsMainColumnArea.5
I would be less concerned about battery chargers and photo frames that we gave our next of kin retired couples in chrsitmas stockings, they are small fry.
What we should be looking at is, how have state intelligence agencies managed to infiltrate the national grid and multi-national corporations.
What I think battery chargers and photo frames, they just don't seem as a top priority to be overly concerned about.
However, electronics used in industry we should be worried about.
A back door in a router is going to be more worth while for intelligence agencies, than getting an insider to plant code in a domestic photo frame.
The photo frame issue and the battery charger are more likely to be the work of serious organised crime gangs than state actors.
Marcus blantantly doesn't know what he is talking about for mentioning China without any proof, the most powerful serious organised crime gangs are in Russia, Europe and America.
By mentioning China, he seems to be suggesting state involvement, that just simply isn't what's going on with battery chargers and photo frames, its the work of serious organised crime gangs looking to take personal data, bank info to sell to fund bigger crime operations out in the real world away from cyber.
The serious organised crime gangs only use cyber to fund their real life criminal activity's.
There simply is no conspiracy here of government involvement, its irrational, irresponsible and shows Marcus hasn't researched what he is talking about properly.
The issue here is that items are infected before hitting the store shelf, and not by end-user error. This is a big deal because if it can happen to a photo frame or USB charger, then what's to stop it from happening to those "industrial" applicances you're so worried about?
Why do you assume there was an intimation that there was government involvement? It would appear that in your sensitivity to suggestion that Chinese were involved, you make the exact same mistake you accuse others of. By assuming "Chinese" == "Government" then you also indicate that any offense made by a Chinese national is in the name of the government. Makes no sense, does it?
Man, go back and reread the article again. Think you missed something? Like where Marcus specifically states that the infections are caused by factories that had poor security measures? Man, time to go work on your reading comprehension. I believe the entire point to mentioning the Chinese is that this item was manufactured in their factories.
I'm afraid it's not Marcus who doesn't know what he's talking about.
Cnet needs to hear this from time to time.
But let us not forget the greatest bloatware and malware of all time... right here under our noses.
Hate if you must...
Apple enforces better "hygene" there (and cuter workers if you saw the iPhone girl...)
I don't know about anyone else, but I would gladly clean some malware off of my PC if it meant the Apple factory worker who was killed could be brought back to his family.
Moron.....
And even though this is consumer electronics... you know how powerful even 900 computers working together are??? as tough as any single computer on our planet. And I bet it was WAY more then 900... and for how long before we discovered? How many have we missed??? Yet how many companies are hiring them to build our drivers. MORONS!
Greed and foolish optimism will be the death of us.
America is doing the same to the rest of the world,
America has just managed to fine tune its propaganda machine against China, so that you gullible people keep ranting about China being evil against everyone under news articles and to your friends.
Think for yourself for once and stop being sucked in to what you read in news articles.
If China are doing it, then America are doing it as well and many other country's besides.
n3td3v I've seen all the pro China propaganda you spout off here. You actually believe our press doesn't do a better job keeping our governments in check than ....oh wait, there is no one in China to keep the Chinese government in check, is there?
So, who's more likely to spout the propaganda, the Chinese government with no checks and balances, or Western governments with a free press?
Don't even answer, I already know what you'll say. Just don't expect me to believe it.
You funny. You said "free" in the same country that passed the patiot act. The most anti patriotic piece of freedom restricting legilstion to hit the books in some time.
I'm not sure if this was supposed to be a joke or not but I sure did laugh.
They control everything.
So free that even your Cnet comments are now sitting on a signals intelligence database, so free your mobile phone calls are being listened into.
So free your DNA is taken even if you've only been held in custody but released without charge.
So free that your movements are watched on CCTV cameras and everytime you use a swipe card on the tube, bus or use a cash machine, or buy something.
So free you are being full body scanned at airports, the list goes on.
Protesters are harassed, monitored or even killed, like what happened in London with the G20 protests: http://www.guardian.co.uk/world/2009/apr/02/g20-protests-man-dies-london
BBC News is funded by mandatory TV licence and is enforced by the government, we are threatened if we don't pay, and even jailed.
And you only ever hear certain things on BBC News, there are some things that are never broadcast, like the gag by MI6 not to allow the release of forensic evidence into the suspicious death of the weapons expert Dr David Kelly for 70 years: http://www.dailymail.co.uk/news/article-1245599/David-Kelly-post-mortem-kept-secret-70-years-doctors-accuse-Lord-Hutton-concealing-vital-information.html never mentioned on BBC News or Sky News.
Free my backside, start living in the real world instead of reading news articles all your life on the internet.
You've got to ask yourself why certain things aren't appearing on the main stream news channels, there is no proof government agents work in the news rooms, but yeah.
Media everywhere just has a feel of being suspiciously controlled, you never get a media outlet being fair to every side of everything.
There is always media outlets that are for or against one side or the other in their reporting, there is no such thing as free media, anywhere, and there is certainly no such thing as a free country.
Yahoo and Google among others helped China build the great firewall.
Money's the problem here, naive Americans.
The big problem here is the mix of greed and a corrupt Chinese government. Also the fact that there is no watchdog or anyone to rein them in. Nothing to stop them from doing whatever they want.
Americans aren't naive, just greedy.
Simply stop buying from them. Dont trade with them and get that laser defense up to stop their 40 ICBMs from hitting the west coast. We have simply been building up our most likely competitor and next enemy with our own dollars and borrowing from them to fund our surplus.
but American sheep will never see this as the education system has fallen in stature just as our nation and its abilities have.
You can have fun telling us about all the weapons you know about on each side, but it's the ones you don't know about that will actually be winning any war, and the U.S. has been at the "secret atomic plus age weapons game" a lot longer than China has.
Of course China couldn't get started on that until they finished stealing all the tech from the west. At least all the tech we let them steal.
The fact is anything that is based on electronics is based out of China. Period. This includes Apple, Dell, Gateway, HP, etc. There is NO, absolutely NO way in hell we will ever stop buying from China as long as Americans want their stuff cheap. And that is only things like shoes and such. If you want American brand TV's and such? Expect to be paying 3K for a TV instead of $700. Because you would have to start up an entire industry from scratch again to do that, and that will NOT happen.
Everything is good.
Invest in gold and don't buy junk.
We'll never get to find out the hacker was American or 14.
And Hillary Clinton will be around for the political back up speech to make it all sound believable for CNN and Fox News viewers.
Now if you are employed by a manufacturer and you develop drivers for the manufacturer, but they pay you a very low wage and you cannot support your family, the thought of taking a small bribe of $10,000US (which could be a year or two worth of wages) is looking a lot more attractive to that person than the person who is reasonably paid and under good working conditions. Furthermore, if the government does not take these crimes seriously enough, then the penalty becomes negligible compared to the reward.
I have come across various drivers from various hardware vendors (all from overseas) which also have had trojans embedded in them. All I can say to these hardware vendors is: tough. Saving a couple thousand dollars will cost you millions in loss of reputation and lawsuits.
- by weegg March 9, 2010 6:50 AM PST
- Any gov't that filters and controls information and uses the internet to spy on their citizens is evil. Oh wait.....damn.
- Like this Reply to this comment
-
(46 Comments)