Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cheap rj45 ethernet to USB adapter contains malware

twitter.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Cheap rj45 ethernet to USB adapter contains malware

#11

Post by nirui »

elfchief wrote: post #7

It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious". The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually…

Can you call it "auto-running" when they it don't even bother to pack in an autorun.inf? (based on https://x.com/evapro30/status/1878635208582562113)

Re: Cheap rj45 ethernet to USB adapter contains malware

#12

Post by geor9e »

unsnap_biceps wrote: post #10
geor9e wrote: post #8

Earlier quoted context omitted.

Autorun has been disabled since the release of Windows 7 in 2009.

For what it's worth, I just checked on my windows 11 install and it was (somewhat) enabled. Settings -> Bluetooth & Devices -> AutoPlay -> Use AutoPlay for all media and devices Was set to on, and "Removable drive" was set to "Choose a default", which appears to be equivalent to "Ask me every time". I don't have anything (that I'm aware of) that auto-runs something, but I presume it will prompt me asking if I want to…

Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not capable of running an .exe

Re: Cheap rj45 ethernet to USB adapter contains malware

#13

Post by unsnap_biceps »

geor9e wrote: post #12
unsnap_biceps wrote: post #10

Earlier quoted context omitted.

For what it's worth, I just checked on my windows 11 install and it was (somewhat) enabled. Settings -> Bluetooth & Devices -> AutoPlay -> Use AutoPlay for all media and devices Was set to on, and "Removable drive" was set to "Choose a default", which appears to be equivalent to "Ask me every time". I don't have anything (that I'm aware of) that auto-runs something, but I presume it will prompt me asking if I want to…

Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not…

Microsoft seems to disagree with your assertion.

> An autorun.inf file is a text file that can be used by the Autorun and AutoPlay components of Microsoft Windows. When a USB drive is plugged into a USB port, an autorun USB dialog appears that prompts you to do certain operations: print images, run Windows Media Players, or open a folder. But what if you have a particular application on the USB drive and want it to be launched from the autorun USB dialog? You can put autorun.inf into the root of the USB drive and edit its commands to get the app started when the USB key is plugged.

https://answers.microsoft.com/en-us/windows/forum/all/enable...

> Created on November 17, 2022 > Applies to: Windows / Windows 11 / Files, folders, and storage

Re: Cheap rj45 ethernet to USB adapter contains malware

#14

Post by gruez »

unsnap_biceps wrote: post #13
geor9e wrote: post #12

Earlier quoted context omitted.

Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not…

Microsoft seems to disagree with your assertion. > An autorun.inf file is a text file that can be used by the Autorun and AutoPlay components of Microsoft Windows. When a USB drive is plugged into a USB port, an autorun USB dialog appears that prompts you to do certain operations: print images, run Windows Media Players, or open a folder. But what if you have a particular application on the USB drive and want it to b…

Autorun still exists, but at least on windows 10, it doesn't run the exe right away. It shows a popup box that asks you whether to run the exe or open the drive in explorer.

Re: Cheap rj45 ethernet to USB adapter contains malware

#15

Post by hulitu »

geor9e wrote: post #8
johann8384 wrote: post #5

Earlier quoted context omitted.

From the replies it sounds like it mounted as a storage device and ran autorun. It was super obvious which is what caused them to take notice.

Autorun has been disabled since the release of Windows 7 in 2009.

> Autorun has been disabled since the release of Windows 7 in 2009.

No. Microsoft just said it will disable it. On some systems, i've seen it disabled (i don't know if by default or by AD policy) but, on the majority of Windows 10, it was not disabled.

Re: Cheap rj45 ethernet to USB adapter contains malware

#16

Post by geor9e »

unsnap_biceps wrote: post #13
geor9e wrote: post #12

Earlier quoted context omitted.

Autoplay is something else. Autorun.inf was a file from the Windows 95 era that could execute an .exe of the publishers choice simply by inserting a usb stick or inserting a CD. It's where the Windows XP era advice to never pick up usb sticks in the parking lot came from. Autoplay is a Windows dialog asking the user what Windows does when media is inserted - automatically import photos, open the folder, etc. It's not…

Microsoft seems to disagree with your assertion. > An autorun.inf file is a text file that can be used by the Autorun and AutoPlay components of Microsoft Windows. When a USB drive is plugged into a USB port, an autorun USB dialog appears that prompts you to do certain operations: print images, run Windows Media Players, or open a folder. But what if you have a particular application on the USB drive and want it to b…

Thats a Microsoft community forums agent though, and in my experience they spam low effort boilerplate solutions in hopes of getting a few votes. If they searched the web specifically for how to do something only possible before 2007, then it does make sense they found instructions from that era. Here's the info from https://en.wikipedia.org/wiki/Autorun.inf that seems more up to date "For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored."

Re: Cheap rj45 ethernet to USB adapter contains malware

#17

Post by geor9e »

hulitu wrote: post #15
geor9e wrote: post #8

Earlier quoted context omitted.

Autorun has been disabled since the release of Windows 7 in 2009.

> Autorun has been disabled since the release of Windows 7 in 2009. No. Microsoft just said it will disable it. On some systems, i've seen it disabled (i don't know if by default or by AD policy) but, on the majority of Windows 10, it was not disabled.

By `autorun` we're talking about the notorious pre-2007 function of automatically running an exe — the `open` key in the `autorun.inf` file, specifically. It's ignored in all non-EOL Windows versions. It technically true that features called Autorun and Autoplay are still `enabled`, they just don't do what they did pre-2007. The `icon` key still works, but not `open`. You can re-enable `open` with registry edits, but it's not easy.

Re: Cheap rj45 ethernet to USB adapter contains malware

#18

Post by karotte »

gruez wrote: post #2

Seems light on details. How is it executing the payload? Is it doing something like badusb where it emulates a keyboard to run the payload? Wouldn't that be super obvious? Or is it something as simple as telling the user to install a "driver"?

Believe it or not, but 'enumerating as a CD-ROM' drive is actually a documented feature of some Realtek USB Ethernet Interfaces: https://www.lcsc.com/datasheet/lcsc_datasheet_2206141400_Rea... (6.16. Driver Auto-Install Mode, page 24).

Re: Cheap rj45 ethernet to USB adapter contains malware

#19

Post by steffanA »

nirui wrote: post #11
elfchief wrote: post #7

It's worth noting that there's basically zero proper evidence that there is any malware included with this device -- it runs an exe when inserted, but that exe appears, at a glance, to be a driver installer. Definitely not the right way to do things, but there's a difference between "incompetent" and "malicious". The only actual "evidence" that was provided was a link to a falcon sandbox run, something which actually…

Can you call it "auto-running" when they it don't even bother to pack in an autorun.inf? (based on https://x.com/evapro30/status/1878635208582562113 )

The autorun.inf would be in the flash drive, not the executable they uploaded to Any.Run. Were any pics of the flash drive contents shared?
Post reply on HN