Live data from Hacker News

We purchased a machine from China and it came with malware preinstalled

rmcybernetics.com

301–310 of 342 posts

Re: We purchased a machine from China and it came with malware preinstalled

#301

Earlier quoted context omitted.

>the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And you cannot do that on open source either. Both cases require a chain of trust, and empirically, neither is significantly more secure.

For a whole computer stack, that's true enough. Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

> Injecting malware in a single small widely distributed program and remaining stealthy for any length of time is a lot harder if it's open source.

Citation needed.

On the other hand:

https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re: We purchased a machine from China and it came with malware preinstalled

#302
post #264

Earlier quoted context omitted.

I still have one at the shop in a box. I will look when I go there.

Curious because I do use a lot of devices from Chinese makers myself and had no issues so far. If it's from a legit brand, I'd need to take a closer look at their products before buying more.

Here are some pics of the box. Somehow I have the box but cannot find the tablet...but it doesn't exactly surprise me.

https://imgur.com/a/wllzfvj

There literally are no markings or any other type of brand/vendor on the box other than what you see.

Re: We purchased a machine from China and it came with malware preinstalled

#303
post #90
post #24

The malware is a cherry on top, but the story before that is pretty awful already, and unfortunately seems to be representative of specialized software like that: proprietary (with constant risk of malware, indeed), awkward, poorly (if at all) documented, likely the protocols to speak to the hardware without it are kept in secret, and occasional shipment of Windows machines where just software would do (but probably…

Tbf, the focus on secrecy is probably because everything in China is at risk of being copied / ripped off by competitors at the drop of a hat. Being an IP wild west has its drawbacks.

A pick and place really is one of those things that would benefit from being open source--the vision algorithms are very annoying and require high technical skill while the motion algorithms are stupid simple.

Re: We purchased a machine from China and it came with malware preinstalled

#304
post #30

The malware analysis report they've ordered ( https://www.rmcybernetics.com/files/pdf/Malware-analysis-Fly... ) is extremely light on details. Yes, some things look suspicious (packing, lack of signatures, hardcoded IP addresses/hostnames, network traffic) - but I'm not seeing any clear-cut evidence that this is malware?

I'm no expert, but I'm also not convinced that the device contained malware.

> We sent the file for proper malware analysis which did confirm that it did indeed contain malware. The malware would collect user data and send it to a remote address. Presumably it would be a way to steal company information such as designs, accounts, and so on. Pretty shady stuff!

Or, you know, it might be doing anything at all on the internet. A reasonable question is "why should this device access the internet?" Good point, but my LAN-controlled "smart plug" connects to an NTP server in France. Who knows.

From the report:

> When verifying the [executable] signature, it was identified that the malware did not have any signature assigned to it as shown in the figure below. It means that the file has a malicious activity.

Doesn't that mean that the image is not signed? Again, I'm not an expert, but to say "it means that the file has a malicious activity" smells like "I'll consider almost anything suspicious if it will convince you that this report is valuable." On the other hand, maybe that really is suspicious. I don't do this for a living.

> The process explorer and procmon helped to know that the malware created a child process and then killed the process. It was also identified that the file did not have the signature but had the company name, and the path, confirming that it is a suspicious file from a legitimate organization. The regshot helped in getting the two snapshots of the registry, one before execution and one after malware execution. Therefore, it can be concluded that the file analyzed contains a trojan spyware which creates a child process that kills the original file when run. The malware collects user information and sends it to http://freedns.afraid.org/.

Again, the conclusion does not follow from the premises. Maybe spawning a child and killing the parent is something that you wouldn't normally do unless you were malware. Maybe English is not the author's first language, fine, but it does look like a poorly edited template.

For all I know, it's totally malware built for corporate espionage originating from a country notorious for doing that, but I don't see any compelling evidence.

Re: We purchased a machine from China and it came with malware preinstalled

#305
post #188

Earlier quoted context omitted.

I don't disagree with the smartphones and WiFi, though the big 2 are highly motivated to at least secure the kernel and their own spyware. I am more thinking of these things targeting sensitive military installations or personnel. > whether or not we can make our rulers live under the same panopticon as the rest of us. Uh, nope. It's been "rules for thee and not for me" since the dawn of time.

> I am more thinking of these things targeting sensitive military installations or personnel. Ah, yes, it sure would be nice to think that they're a bit more careful, but then I think of things like the OPM leak and I go cross-eyed. ( https://en.wikipedia.org/wiki/Office_of_Personnel_Management... - I'm sure you know what I'm talking about but I figured I'd add a link for anyone who didn't.) > It's been "rules for th…

I want to be hopeful about the future, but in the large there are too many negative trends. What I've learned is to be hopeful and optimistic about the things I can change. Just about to go watch an episode of TNG. Here's hoping that the long run is better than our current trajectory. Cheers!

Re: We purchased a machine from China and it came with malware preinstalled

#306
post #15

Given that Windows 7 _Ultimate_ was installed on what is essentially an OEM machine, it's very likely that it's a pirated copy with a "home brewed" license key. I think the most reasonable explanation is that either the OS was sourced already infected, or the crack tool they used was infected.

Alright let's think about this. If equipment was entering the US with pirated Windows licenses, wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating?

Also why would Windows Ultimate indicate piracy? Wouldn't it be weird if "Windows Home" flashed up on the screen while booting an industrial machine? It's more likely to make sense that Windows Home isn't licensed for use on industrial machines.

Re: We purchased a machine from China and it came with malware preinstalled

#307

Earlier quoted context omitted.

>I'm talking about odd specialized programs shipped by hardware manufacturers (like the one TFA talks about In that case, open source rarely has even one possible replacement, so there's no comparison. >but if you have the source code, it's often reasonable to read As someone working in code daily, I disagree. I find lots of open source projects once you get out of the few big ones to be a massive mess of code. And m…

Sounds like we had quite a different experience, and picturing different things too. > In that case, open source rarely has even one possible replacement, so there's no comparison. There's usually just one program shipped by a vendor in these cases, and most of the time it's indeed closed-source -- that's what I started with. Big and widely used FLOSS projects are far from these programs shipped by small hardware man…

Something as small as a few kloc I can reverse back to compilable source in a day, so things that trivially small are not difficult to edit to your hearts content.

Heck, I suspect Ghidra nowadays makes that a single click task.

And if it's that small, it's also trivial to write. I doubt too many companies fret over stuff that small.

Re: We purchased a machine from China and it came with malware preinstalled

#308
post #15

Given that Windows 7 _Ultimate_ was installed on what is essentially an OEM machine, it's very likely that it's a pirated copy with a "home brewed" license key. I think the most reasonable explanation is that either the OS was sourced already infected, or the crack tool they used was infected.

Alright let's think about this. If equipment was entering the US with pirated Windows licenses, wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating? Also why would Windows Ultimate indicate piracy? Wouldn't it be weird if "Windows Home" flashed up on the screen while booting an industrial machine? It's more likely to make sense that Windows Home isn't licensed for use on i…

> wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating

Well, they would if they knew. I have purchased a variety of random computing hardware from Chinese suppliers and despite the product pages claiming they had no on-board OS installed, they came with cracked versions of Windows. They do it because customers want an OS but don't want to shell out for a license. It costs them nothing to pirate software (especially when they lie about it) and getting caught and actually blocked is very hard. This isn't like them intercepting a shipment of counterfeit purses where you can clearly tell by looking at the item. You'd have to boot the computers and then verify that they have an OS installed and then that it's properly licensed, which is well out of reach for a random customs officer.

> why would Windows Ultimate indicate piracy?

It's a very expensive license and, if you have any experience pirating Windows (I cough don't) that's usually what you find since if you're going to steal something, why steal the shittier, less featurefull version?

Re: We purchased a machine from China and it came with malware preinstalled

#309

Earlier quoted context omitted.

Quoted post unavailable.

You can all downvote me all u want but my thoughts and the things I type/say on HN later show to be true.

Good to see a good number of the comments here feel the same ..lots of downvotes though on my posts but who is downvoting vs. who is openly commenting and majority agreeing with my opinion that China needs to be taken care of in many ways!

Re: We purchased a machine from China and it came with malware preinstalled

#310
post #15

Given that Windows 7 _Ultimate_ was installed on what is essentially an OEM machine, it's very likely that it's a pirated copy with a "home brewed" license key. I think the most reasonable explanation is that either the OS was sourced already infected, or the crack tool they used was infected.

A bit off topic, but the last time I needed a Windows laptop for business reasons (a long time ago) I bought a laptop directly from Microsoft and it appeared to be secure and also not loaded with advertising junk. The price seemed OK, fairly competitive.

I had Surface 3 Pro and it was a nightmare. In the end, the SSD died and the way the machine is glued together, it's impossible to open without breaking the screen. Before its final death, it had problems with sleep/wake functions. A standard reinstall wouldn't fix it. Eventually had to take it back to Microsoft for a full re-image. That did the trick.
Post reply on HN