6 ms·

Both tools are "stick infected USB into air gapped device"

• stavros 2y ago
  How do they get these USB sticks to execute code, though?
  • sampullman 2y ago
    Presumably by taking advantage of an exploit on the host's USB driver.
  • gruez 2y ago
    From the linked ESET blog post: >It is probable that this unknown component finds the last modified directory on the USB drive, hides it, and renames itself with the name of this directory, which is done by JackalWorm. We also believe that the component uses a folder icon, to entice the user to run it when the USB drive is inserted in an air-gapped system, which again is done by JackalWorm.
    • stavros 2y ago
      Oh wow, I didn't expect social engineering here...
      • baxtr 2y ago
        Would you define a fake icon as social engineering?
        • stavros 2y ago
          If it convinces a human to do something they wouldn't otherwise do, yes.
    • noinsight 2y ago
      Windows hiding file name extensions by default - the gift that keeps on giving. This wouldn't work (as easily) without that.
      • vlovich123 2y ago
        Mac and Gnome do too. I think somehow overlaying that it’s an executable and double-checking if you want to execute from a removable drive might be better techniques than worrying about file extensions which only help people who know what they’re doing already (in which case it’s common to configure the UI to show those extensions)
      • masswerk 2y ago
        Color coding any executables in file managers (in an otherwise reserved color) should be a standard.
        • _dain_ 2y ago
          Colourblind employees would then become a spearphishing target.
          • mafuy 2y ago
            No. Colorblindness does not mean that one does not see any colors. There is only a tiny fraction of colorblind people who really cannot see any colors, and even they can still spot different luminances.
    • munchler 2y ago
      Allowing the user to run an executable directly off a USB drive seems like a very bad idea for an air-gapped computer. It's hard to imagine a scenario where this would be necessary.
      • zahlman 2y ago
        Copying the "folder" onto the local machine first wouldn't have helped, though. It would still be an executable, and the user would still be enticed to double-click it (because it would still appear to be a folder which the user expected to contain desired files). We could fall back to "allowing the user to use a GUI to select files seems like a very bad idea when they come from the other side of an air gap", but at some point a concession has to be made to usability. The problems here are to do with how Windows uses and presents file extensions.
    • worstspotgain 2y ago
      Just spitballing of course, but if there was a 0-day at the USB stack level, there are many possible reasons why it wouldn't be mentioned here.