It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious".
The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually requires human analysis to draw conclusions about -- and anyone who has ever used it knows how many false positives it finds.
A better proclamation might be "cheap network adapter comes with an auto-running executable which needs further analysis".
Seems light on details. How is it executing the payload? Is it doing something like badusb where it emulates a keyboard to run the payload? Wouldn't that be super obvious? Or is it something as simple as telling the user to install a "driver"?
The dongle enumerates as a USB hub with two USB devices plugged into it. One is an ethernet dongle, which is the sort of hardware that may require a driver. The second device is a USB flash drive containing a .exe, which extracts a file called Setup.exe. It won't execute unless the user manually executes it - it's just a USB drive after all. Maybe the .exe contains malware, maybe it doesn't. Maybe antivirus scans give false positives. Maybe the manufacturer found a clever way to save money by combining the two USB devices they normally shipped together. Maybe this twitter account just made a nice paycheck from clickbait engagement.
It ain't just twitter that has armchair experts that are rude. Most social media sites allow this behavior. So many replies with horrible posts "your doing it wrong", "read the docs", etc.
I've seen so many correct responses downvoted and with horrible replies. Anyone who used old moderated email lists will see how culture changed and the decline of actual conversation. Even stack overflow has went downhill.
It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious".
The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually requires human analysis to draw conclusions about -- and anyone who has ever used it knows how many false positives it finds.
A better proclamation might be "cheap network adapter comes with an auto-running executable which needs further analysis".
Can you call it "auto-running" when they it don't even bother to pack in an autorun.inf? (based on https://x.com/evapro30/status/1878635208582562113)
The autorun.inf would be in the flash drive, not the executable they uploaded to Any.Run. Were any pics of the flash drive contents shared?
Seems light on details. How is it executing the payload? Is it doing something like badusb where it emulates a keyboard to run the payload? Wouldn't that be super obvious? Or is it something as simple as telling the user to install a "driver"?
The dongle enumerates as a USB hub with two USB devices plugged into it. One is an ethernet dongle, which is the sort of hardware that may require a driver. The second device is a USB flash drive containing a .exe, which extracts a file called Setup.exe. It won't execute unless the user manually executes it - it's just a USB drive after all. Maybe the .exe contains malware, maybe it doesn't. Maybe antivirus scans give false positives. Maybe the manufacturer found a clever way to save money by combining the two USB devices they normally shipped together. Maybe this twitter account just made a nice paycheck from clickbait engagement.
Believe it or not, but 'enumerating as a CD-ROM' drive is actually a documented feature of some Realtek USB Ethernet Interfaces: https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Rea... (6.16. Driver Auto-Install Mode, page 24).
From the replies it sounds like it mounted as a storage device and ran autorun. It was super obvious which is what caused them to take notice.
Autorun has been disabled since the release of Windows 7 in 2009.
7 replies →
Please tell me Windows doesn't STILL autorun off of external drives? I thought that was solved years ago...
Twitter is terrible and I can't remember the nitter instance that still works.
https://xcancel.com/evapro30/status/1878593145534923124
thanks!
Reverse engineering by OALabs - https://www.youtube.com/watch?v=3IfJSGWIrCo
Current verdict - not malware.
Related blog post: https://epcyber.com/blog/f/chinese-rj45-usb-with-flash-memor...
"The chinese" yeah sure. Lmao. Everybody panic, there are two chips inside!
Check out https://news.ycombinator.com/item?id=42743033#42743428 for more lulz
It ain't just twitter that has armchair experts that are rude. Most social media sites allow this behavior. So many replies with horrible posts "your doing it wrong", "read the docs", etc.
I've seen so many correct responses downvoted and with horrible replies. Anyone who used old moderated email lists will see how culture changed and the decline of actual conversation. Even stack overflow has went downhill.