Security Spotlight

December 14, 2009
Security Spotlight articles discuss recent noteworthy threats that users may encounter and should be aware of while surfing the Web.
OFF-THE-SHELF MALWARE CARRIERS
Fresh-from-the-factory products are supposed to be clean and malware-free and not laden with malicious files. However, past incidents show otherwise. Just recently, Trend Micro was alerted to the latest addition to the long list of new products shipped with malwareCreative Medias Sound Blaster X-Fi Go!
New No Longer Means Secure
Trend Micro security analysts predict that we will continue to witness brandnew products get infected by malware.
While it is no longer surprising to hear news about brand-new products being infected with malware, the growing number of reported occurrences has become alarming that Trend Micro security analysts have predicted that in the coming years, we will continue to witness the occurrence of similar incidents. Creative Medias Sound Blaster X-Fi Go! is the latest product in the catalogue of infected electronic devices. Creative, which specializes in manufacturing digital entertainment products and peripherals, said in an announcement that around 3,380 units of Sound Blaster X-Fi Go! shipped to Japan since October 1 were loaded with a Trojan (Boot. exe) and a worm (Ravmon.exe) detected by Trend Micro as TROJ_CORELINK.D and WORM_RJUMP.AI, respectively. Both malware have been detected by Trend Micro as early as 2007. Upon execution, TROJ_CORELINK.D creates a rootkit detected as TROJ_AGENT.THK, which allows the malware to mask itself, making it difficult to remove. It also creates a.DLL file (LINKINFO.DLL) detected as PE_CORELINK.C-O, which connects to a site to download another malware detected as TROJ_ALMANAHE.V. PE_CORELINK.C-O also queries a registry key to extract the path of the affected systems default browser. Once found, it connects to a URL to download TSPY_LEGMIR.BNI. TROJ_CORELINK.D also drops an AUTORUN.INF file, which enables all removable media to automatically run when plugged in. When executed WORM_RJUMP.AI drops another malware detected as TROJ_AGENT.JXU and connects to a site possibly to download more malicious files. WORM_RJUMP.AI can propagate via removable (e.g., universal serial bus [USB] drives) and physical drives (e.g., D and C drives). Sound Blaster X-Fi Go! is a USB-based audio product that has a built-in 1GB flash memory. The said audio device was said to have been infected during the testing procedures conducted in the factory. Ironically, the said test did not reveal any sign of malware infection. As of this writing, Creative is working with its partners to retrieve the infected units from shops and has been raising awareness about the incident. It also promised to include malware testing for its future products to ensure that this will not happen again.
SECURITY SPOTLIGHT I OFF-THE-SHELF MALWARE CARRIERS
Sound Blaster X-Fi Go! has been found to be preloaded with TROJ_ CORELINK.D and WORM_RJUMP. AI. Each malware came with several payloads, including: TROJ_CORELINK.D creates a rootkit detected as TROJ_ AGENT.THK, which allowed the malware to mask itself, making it difficult to remove. TROJ_CORELINK.D also creates a.DLL file detected as PE_CORELINK.C-O, which connects to a site to download another malware detected as TROJ_ALMANAHE.V. TROJ_CORELINK.D also drops an AUTORUN.INF file, which enables all removable media to automatically run when plugged in. PE_CORELINK.C-O also queries a registry key to extract the path of the affected systems default browser and connects to a URL to download TSPY_ LEGMIR.BNI. WORM_RJUMP.AI drops another malware detected as TROJ_AGENT.JXU and connects to a site possibly to download more malicious files. WORM_RJUMP.AI propagates via removable and physical drives.

Figure 1. Compromised USB audio device comes preloaded with malware.
Electronic Devices: Another Malware Vector
Electronic devices such as digital photo frames, USB drives, and MP3 players have become another avenue by which cybercriminals can proliferate their malicious creations. Clearly, the Web is not the only means by which users can get malicious files into their systems. Here is a rundown of malware-infested off-the-shelf products: Proliant USB keys that carried both WORM_VB.BDN and WORM_AUTORUN.AZB. WORM_VB.BDN propagates via removable and mapped drives. It also drops a copy of itself as CTFMON.EXE. As a legitimate file in the Windows system has a similar file name, it is difficult to terminate this malware. Samsungs Frame Manager XP version 1.08, the product installer disc for SPF-85H 8-Inch Digital Photo Frames with 1GB Internal Memory, which is needed to use the digital frame as a USB monitor, has been found to be infected by a Sality worm, which is known for propagating via email. Victory LT-200, a USB media player made in China and sold by Victory Nederland also came preinstalled with a file infector detected as PE_FUJACKS.FL-O, which propagates via network shares and removable drives. iPod Video was also reported to have been infected by WORM_SIWEOL.A that has backdoor routines and propagates via mapped drives. The said worm, however, only infected Windows-based operating systems but not the Mac platform and iPods. Navigational devices like TomTom GO 910 carried TROJ_PERLOVGA.A and TROJ_GENERIC variants. Although the device is Linux-based, users who plug such devices into Windows systems will immediately get infected by the two Trojans. In 2006, around 10,000 promotional MP3 players given away by McDonalds Japan have been found to be infected by an autorun malware detected as WORM_ QQPASS.ADH. As a countermeasure, McDonalds Japan recalled the MP3 players. Seemingly harmless devices such as printers, photocopiers, and even a heart device were discovered to be vulnerable to attacks and can be compromised by hackers.
Dangers Posed by Malware-Ridden Products
The gravity of risks involving devices that come preinstalled with malware should not be taken lightly. Most of the malware found within these products are autorun worms that have the ability to propagate across network shares and various physical and removable drives, which makes them hard to terminate because they spread copies of themselves.
In Sound Blaster X-Fi Go!s case, user systems are infected by both TROJ_CORELINK.D and WORM_RJUMP.AI. Although both malware are relatively old, they are still notorious because of their routines and damaging payloads. Users who eventually run these products are left with a series of infections that involve a rootkit, a file infector, a Trojan, and a worm. If the users system does not have an antivirus product installed, chances are these malware will spread and possibly infect all of the users other removable media (MP3 players, etc.).

Most of the malware-ridden products were released during the holidays when people were most likely to shop.
It is interesting to note that most of these malware-ridden products were released during the holidays when people were most likely to shop. There is, after all, a significant increase in malware infections during this season, as the peak in the number of shoppers will most definitely be paralleled by an increase in cybercriminal attacks. That said, users are more than ever at great risk since they would not expect new products to come with any malware. To mitigate such risks, installing an antivirus product that has a device access control feature that prevents AUTORUN.INF from executing when users plug in removable devices into their systems. It would also be helpful to disable the autorun feature of any of your removable drives to prevent malware from executing. Finally, companies should malware-test all of their products before shipping them to consumers to prevent malware from hitchhiking on their products and consequently infecting systems.

References:

Avena, Eric. (January 29, 2007). TrendLabs Malware Blog. Trojans Loose on Navigation Devices. http://blog.trendmicro.com/trojans-loose-on-navigationdevices/ (Retrieved December 2009). Clemente, Aileen. (April 8, 2008). TrendLabs Malware Blog. HP Proliant USB Keys Come with Malware Surprise. http://blog.trendmicro.com/hp-proliant-usb-keyscome-with-malware-surprise/ (Retrieved December 2009). Corpin, Mayee. (January 11, 2008). TrendLabs Malware Blog. Out of the Factory, Into the USB. http://blog.trendmicro.com/out-of-the-factory-into-the-usb/ (Retrieved December 2009). Flores, Ryan. (October 18, 2006). TrendLabs Malware Blog. McDonalds Japan Recalls Promotional MP3 Players. http://blog.trendmicro.com/mcdonald27s-japanrecalls-promotional-mp3-players/ (Retrieved December 2009). Hipolito, Joahnna. (January 29, 2008). TrendLabs Malware Blog. Digital Photo Frames Frame-Up? http://blog.trendmicro.com/digital-photo-frames-frameup/ (Retrieved December 2009). Irinco, Bernadette. (December 7, 2009). TrendLabs Malware Blog. The Risks of Holiday Online Shopping. http://blog.trendmicro.com/the-risks-of-holiday-onlineshopping/ (Retrieved December 2009).
Irinco, Bernadette. (December 26, 2008). TrendLabs Malware Blog. Yet Another Digital Picture Frame Malware Incident. http://blog.trendmicro.com/yet-anotherdigital-picture-frame-malware-incident/ (Retrieved December 2009). Irinco, Bernadette. (March 18, 2008). TrendLabs Malware Blog. Help! Im Having a Hack Attack! http://blog.trendmicro.com/help-im-having-a-hack-attack/ (Retrieved December 2009). Macalintal, Ivan. (October 18, 2006). TrendLabs Malware Blog. Get Your iPod NowAnd Get a Free Worm! http://blog.trendmicro.com/get-your-ipod-now-andget-a-free-worm21/ (Retrieved December 2009). Miyanagi, Hideki. (December 8, 2009). Virus Found in USB Audio Product Sound Blaster X-Fi Go! http://internet.watch.impress.co.jp/docs/news/20091208_334208. html (Retrieved December 2009). Pimentel, Jasper. (August 7, 2007). TrendLabs Malware Blog. Attack of the Killer Xerox Machines!!! http://blog.trendmicro.com/attack-of-the-killer-xeroxmachines212121/ (Retrieved December 2009). Soriano, Jake. (January 12, 2008). TrendLabs Malware Blog. Cross-Site Printing for Spamming. http://blog.trendmicro.com/cross-site-printing-for-spamming/ (Retrieved December 2009). Trend Micro. (December 9, 2009). TrendWatch. The Future of Threats and Threats Technologies: How the Landscape Is Changing. http://us.trendmicro.com/imperia/ md/content/us/trendwatch/researchandanalysis/trend_micro_2010_future_threat_ report_final.pdf (Retrieved December 2009). Please see the Threat Encyclopedia (http://threatinfo.trendmicro.com/vinfo/) for the following entries: PE_CORELINK.C-O PE_FUJACKS.FL-O TROJ_AGENT.JXU TROJ_AGENT.THK TROJ_ALMANAHE.V TROJ_CORELINK.D WORM_AGENT.TBH WORM_AUTORUN.AZB WORM_QQPASS.ADH WORM_RJUMP.AI WORM_SIWEOL.A WORM_VB.BDN

Sound Blaster X-Fi Go! Pro
High quality Sound Blaster 3D audio on the go!
Creatives Sound Blaster X-Fi Go! Pro brings incredible enhanced 3D audio to any computer, anywhere! Designed for maximum portability, this soundcard is small enough to fit into your pocket and even fits on your key ring! Enjoy incredible 3D Surround with any headphones in movies and games, and enhance all of your PC and online audio. The Sound Blaster X-Fi Go! Pro is the fastest and easiest upgrade to THX TruStudio Pro audio technology. Portable Sound Blaster X-Fi sound card in compact USB stick format. THX TruStudio Pro Surround converts your movies and games into virtual 3D surround sound over headphones. THX TruStudio Pro Crystalizer enhances all audio especially MP3, DIVX and online movies and game audio for extra clarity and definition. Gaming support includes EAX 5.0 and OpenAL plus Creative ALchemy software to restore EAX surround to games running under Windows Vista/ Windows 7. Fits on your key ring for convenient use anytime, anywhere Creative Silencer removes ambient noise for ultimate clarity during voice chat. *Use of Creative proprietary dual-microphone headset is required.

Technical Specifications

Technical Specifications 16-bit Digital-to-Analog conversion of digital sources at up to 44.1 kHz to stereo output 16-bit Digital-to-Analog conversion of stereo digital sources at up to 44.1 kHz to stereo output Audio Inputs One 3.50 mm (1/8-inch) stereo jack for Microphone In One 3.50 mm (1/8-inch) stereo jack for Analog Line Out or Headphones Playback USB Warranty 1 year limited hardware warranty Package Contents Sound Blaster X-Fi Go! Pro USB Cable Quick Start Leaflet Installation CD
Software THX TruStudio Pro Creative Audio Control Panel Minimum System Requirements Microsoft Windows 7, Windows Vista, Windows XP (Professional x64 Edition, Service Pack 2 or above) Intel Core 2 Duo or AMD equivalent processor, 2.2 GHz or faster Available USB port 1 GB RAM 600 MB of free hard disk space Available CD-ROM or DVD-ROM drive Note:

www.creative.com

2010 Creative Technology Ltd. All rights reserved. Creative, the Creative logo, Sound Blaster, the Sound Blaster logo, X-Fi, the X-Fi logo and Creative ALchemy are trademarks or registered trademarks of Creative Technology Ltd in the United States and/or other countries. THX and the THX TruStudio Pro logo are trademarks of THX Ltd. which may be registered in some jurisdictions. All other trademarks are the property of their respective owners. All specifications are subject to change without notice. Actual contents may differ from those pictured. The software included in this packaging may not be used separately from the hardware. Before using the software, you must agree to be bound by the terms and conditions of the end user license agreement. Distributed by Creative Labs, Inc., Milpitas, CA. Contents of this box are from U.S.A, Singapore, Malaysia & China. See individual components for country of origin. Sound Blaster X-Fi Go! Pro is backed by a one-year limited hardware warranty.