We purchased a machine from China and it came with malware preinstalled

We purchased a machine from China and it came with malware preinstalled(rmcybernetics.com)

543 points by truxs 4 years ago | 316 comments

defanor 4 years ago |

The malware is a cherry on top, but the story before that is pretty awful already, and unfortunately seems to be representative of specialized software like that: proprietary (with constant risk of malware, indeed), awkward, poorly (if at all) documented, likely the protocols to speak to the hardware without it are kept in secret, and occasional shipment of Windows machines where just software would do (but probably it's written to just barely work on a given system, and won't run on others easily).

I think the main and annoying problem is those general practices, not just a single instance of malware.

Edit: Apparently some focus on the "Chinese" part, but I suspect that hardware being specialized and software being shipped by the hardware manufacturer are larger factors here: at least all the awkwardness before the malware part I've observed to be approximately similar with hardware+software produced by Chinese, European, and US companies.

toyg 4 years ago | |

Tbf, the focus on secrecy is probably because everything in China is at risk of being copied / ripped off by competitors at the drop of a hat. Being an IP wild west has its drawbacks.

dathinab 4 years ago | | |

The problem is this approaches tend to not really prevent the rip of as any of this obscuring methods tend to not hold against someone with expertise in subverting them. Which companies which do this kind of rip-offs tend to have...

bsder 4 years ago | | |

A pick and place really is one of those things that would benefit from being open source--the vision algorithms are very annoying and require high technical skill while the motion algorithms are stupid simple.

StreamBright 4 years ago | |

> proprietary (with constant risk of malware, indeed)

being proprietary has nothing to do with risk of malware, indeed

defanor 4 years ago | | |

To be precise, I had in mind closed-source software: the software you can't inspect with reasonable effort/time before running, to ensure that it's not malicious. And especially in case of specialized software, that wasn't inspected by others either. Though these terms seem to be used interchangeably quite commonly [1], likely because of a strong correlation.

[1] https://en.wikipedia.org/wiki/Proprietary_software

Edit: wording.

mrunkel 4 years ago |

Given that Windows 7 _Ultimate_ was installed on what is essentially an OEM machine, it's very likely that it's a pirated copy with a "home brewed" license key.

I think the most reasonable explanation is that either the OS was sourced already infected, or the crack tool they used was infected.

mark_l_watson 4 years ago | |

A bit off topic, but the last time I needed a Windows laptop for business reasons (a long time ago) I bought a laptop directly from Microsoft and it appeared to be secure and also not loaded with advertising junk. The price seemed OK, fairly competitive.

wlesieutre 4 years ago | | |

When buying a Windows machine, you can purchase "Signature Edition" versions through Microsoft which will come with only the crapware selected by Microsoft, and not by the manufacturer

https://www.microsoft.com/en-gd/store/b/signaturepcs

emiliosic 4 years ago | | |

I had Surface 3 Pro and it was a nightmare. In the end, the SSD died and the way the machine is glued together, it's impossible to open without breaking the screen. Before its final death, it had problems with sleep/wake functions. A standard reinstall wouldn't fix it. Eventually had to take it back to Microsoft for a full re-image. That did the trick.

raverbashing 4 years ago | |

Or it's just malware that's "around" the company since nobody cares what they download, which USB keys they plug, etc

Autorun USB malware is very common

fpgaminer 4 years ago | | |

> Or it's just malware that's "around" the company since nobody cares what they download, which USB keys they plug

There's a fun story documented on Darknet Diaries (https://darknetdiaries.com/transcript/22/) about a wind farm that got hacked. The "malicious" actor had found his way into their infrastructure and installed some idle cryptominers. But he was also taking the time to maintain all the infrastructure; applying updates and patches on a regular basis in an effort to keep other would-be hackers out. The security consultant discloses all of this to the company. Well, the story ends with the company making a business decision to leave things as they are. They were effectively getting free IT.

gruez 4 years ago | | |

>Autorun USB malware is very common

that hasn't worked since windows xp sp2.

phendrenad2 4 years ago | |

Alright let's think about this. If equipment was entering the US with pirated Windows licenses, wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating?

Also why would Windows Ultimate indicate piracy? Wouldn't it be weird if "Windows Home" flashed up on the screen while booting an industrial machine? It's more likely to make sense that Windows Home isn't licensed for use on industrial machines.

Sirened 4 years ago | | |

> wouldn't Microsoft ask customs enforcement to block them until the manufacturer stopped pirating

Well, they would if they knew. I have purchased a variety of random computing hardware from Chinese suppliers and despite the product pages claiming they had no on-board OS installed, they came with cracked versions of Windows. They do it because customers want an OS but don't want to shell out for a license. It costs them nothing to pirate software (especially when they lie about it) and getting caught and actually blocked is very hard. This isn't like them intercepting a shipment of counterfeit purses where you can clearly tell by looking at the item. You'd have to boot the computers and then verify that they have an OS installed and then that it's properly licensed, which is well out of reach for a random customs officer.

> why would Windows Ultimate indicate piracy?

It's a very expensive license and, if you have any experience pirating Windows (I cough don't) that's usually what you find since if you're going to steal something, why steal the shittier, less featurefull version?

klondike_ 4 years ago | | |

>why would Windows Ultimate indicate piracy?

Microsoft sells an embedded, stripped down version of Windows with extended support life for industrial machines like this. Ultimate is intended for workstations and power users.

3pt14159 4 years ago | |

You know what? I don't care anymore. When this type of thing happens it's almost always China. Whether it's intentional malware or a lack of QA, how could one tell? They have such a reputation for both I don't know why we still let their electronics into our countries.

Aperocky 4 years ago | | |

> When this type of thing happens it's almost always China.

It could only happen in China - because the author bought dubious stuff from unknown third party on AliExpress. Craiglist scams happen mostly in US because people don't use it elsewhere.

Sort of like how you shoot the arrow first and then draw a target around it, 100% bullseye.

Dah00n 4 years ago | | |

So most of this happens in products made where most of these products are made? Seems logically. Besides it doesn't seem any better in the US. By far the most backdoored internet equipment producer is Cisco.

danieltanfh95 4 years ago | | |

it's because chinese goods are consistently good that anything bad is news. ironic isn't it

literally everything is made in china, if the quality is as bad as you say the world would have fallen apart.

It seems critical thinking is rare among news outrage these days. The same comments were said of Japanese products back in the day, "IP thieves", "shitty quality", and here we are decades later praising Japanese products. Its hilarious at this point.

pphysch 4 years ago | | |

The malware described in the article is script kiddy stuff. Probably part of a ripped Win7.

Stuxnet, Pegasus, Vault 7 tech are far more dangerous with that capacity to cause real harm to actual people. Who developed these?

0xbadc0de5 4 years ago |

The story here is not the fact of the malware - it is the purpose of the malware: industrial espionage. China is well-known in industry for its sheer volume and brazenness of industrial espionage. A pick-and-place machine is especially well placed for this since it will, by necessity, have access to PCB designs and BOMs.

RunSet 4 years ago | |

I have seen enough stories of supply-line sabotage to think that if you are going to build your infrastructure with Chinese hardware, air-gapping it is a necessity.

Probably a good idea to air-gap your pick and place machine even if it is not Chinese.

ed25519FUUU 4 years ago | | |

Airgapping wouldn’t be enough here since it infects any USB device plugged in. You’ll have to run the USB through some antivirus any time you want to use a new design from a “good” computer.

3pt14159 4 years ago | | |

It's really tough to air-gap these days. Are you really going to set up a perimeter where every phone, watch, and computer is dropped off before entry?

csmpltn 4 years ago |

The malware analysis report they've ordered (https://www.rmcybernetics.com/files/pdf/Malware-analysis-Fly...) is extremely light on details.

Yes, some things look suspicious (packing, lack of signatures, hardcoded IP addresses/hostnames, network traffic) - but I'm not seeing any clear-cut evidence that this is malware?

akireu 4 years ago |

A decade ago, an article [1] was published in the Russian "Hacker" magazine where the author alleged that a Russian OEM manufacturer's motherboard sourced from China had a BMC chip (which should've been disabled as per the mobo spec) inject a hypervisor into the host machine.

It was, again, allegedly, discovered because the author was developing some kind of distributed computing software that required a hypervisor of its own, and this exact mobo was crashing in a way that was consistent with a hypervisor being already present. The author goes further to describe how he devised a way to consistently detect hypervisors by measuring platform register access timings, and tried to report the findings to the FSB (Russian CIA/FBI) to no avail.

I personally don't put much stock in the story, as the magazine was a rag and I could come up with something like that at the time, but there it is.

[1] https://xakep.ru/2011/12/26/58104/

titzer 4 years ago |

I am more than a little concerned that since the miniaturization and commoditization of spy hardware (miniature microphones, cameras, and wireless communication), that run-of-the-mill consumer electronics are being bugged by default. Given the cost is pennies or just a couple dollars, from an espionage perspective, it'd be worth it to spend a few hundred million or even billion putting bugs into literally everything and letting the market put them into the homes of all your political targets in other countries. Then the problem is just sifting the data, which is easy with the massive amount of computational power that every nation state has these days. That's a great dystopia.

mrunkel 4 years ago |

https://archive.is/DIrdx

avnigo 4 years ago |

> AliExpress Says Malware is OK [...] They stated that it does not breach their terms and that no action will be taken.

I'm sure many things don't explicitly breach their terms, but surely I expected there to be a catchall that would include malware. Of course, their terms are to protect AliExpress, and not the consumer, so it doesn't look like they'd wanna go above and beyond on that end, but I hoped they'd at least care about customer satisfaction.

jcims 4 years ago |

I've bought systems off of Amazon that had pirated Windows licenses on them (otherwise a great little fanless box)

In a previous life I was an infosec consultant. We did some work for a hospital that found malware on the control hosts shipped with a brand new turnkey MRI system from a German manufacturer.

capableweb 4 years ago | |

What did the malware do precisely? The definition is so broad and context-sensitive, that just saying malware doesn't really say anything. Some people would consider TPM and it's code malware, others would consider anything they don't like malware (like telemetry collection in Windows or whatever).

jcims 4 years ago | | |

It was one of the big Microsoft worms from ~10 years ago plus a few random ones.

Wingman4l7 4 years ago | |

I've seen plenty of stick PCs on Amazon that definitely have pirated copies of Windows on them. I continue to be a bit surprised that Microsoft hasn't gone after Amazon for "aiding & abetting" this, but they probably have bigger fish to fry.

flatiron 4 years ago | | |

they dont make their money on Windows licenses anyway. they make it on all the crap they shove in your face when you use windows.

you've been able to pirate windows 10 using their "windows 7 free update" key even after they discontinued it. and everyone who got a free upgrade from 7->10 uses the same key so its not like you are gonna get caught.

PragmaticPulp 4 years ago |

If you can’t load the article, the machine is a desktop pick-and-place for populating PCBs and the malware is flagged as a backdoor/Trojan for remote access.

As these desktop pick and place machines come down in price, I hope that the OpenPnP software package becomes more developed: https://openpnp.org/ It was originally intended for full DIY PnP machines, but it’s a perfect candidate for converting these existing machines to open source software control.

jjuel 4 years ago |

So they bought a machine from a brand they have never heard of off AliExpress to save a little money, and it was infected with malware. Color me surprised...

kgeist 4 years ago |

Chinese phones sold here were found to not only send telemetry to Chinese IP's, some of them send SMS' to paid services, register Telegram accounts, etc. It's like a botnet.

Here's the article: https://habr-com.translate.goog/ru/post/575626/?_x_tr_sl=ru&...

jeroenhd 4 years ago |

I do wonder if this really was sabotage or if someone building these machines accidentally got their installer USB infected with some unrelated malware. If this was a targeted attack, I'd expect the manufacturer to ship the infection in the zip file with the replacement program as well.

The old components and the lack of modern drivers is a problem many industrial tools seem to suffer from. It's crap like the bad capture card that keeps Windows XP and 7 around. I don't expect there ever to be any modern drivers for an outdated capture platform unless a hobbyist writes their own open source version, so unless a compatible enough alternative card with modern drivers can be installed, I assume this machine is doomed to run Windows 7 for years to come.

Damogran6 4 years ago | |

Is that any kind of excuse? Supply Chain infection is a sidechannel way to infect YOUR network...what's your intellectual property worth? What's it worth if through the unintentional infection you find yourself figuring out how to get cash into bitcoin to pay a ransom?

Relying on an ancient card and drivers seems like a cop-out...they managed to create the solution once, they're obligated to do it again, lest your company's bottom line hinge on a house of cards an intern cobbled together for another company 12 years ago, that only works with the September 2008 drivers.

jeroenhd 4 years ago | | |

Of course intent matters. Accidents can happen and don't necessarily soil an entire brand name, but intent definitely does.

You'll be surprised how common these "house of cards an intern cobbled together for another company 12 years ago, that only works with the September 2008 drivers" situations really are when it comes to specialised hardware. As long as the machine keeps working, it can be sold, software security and maintenance be damned. There's a reason hospitals and factories pay Microsoft for the last few Windows 7 updates it'll release this year and it's not that management doesn't like the theme Microsoft put on Windows 10.

That's even more likely to be the case for industrial machines purchased off AliExpress, where hardware is often either old, second hand stuff or made as cheaply as possible from available parts. The standard of quality there is minimal, I'm surprised they risked buying this thing through AE in the first place.

disgu 4 years ago |

> Presumably it would be a way to steal company information such as designs, accounts, and so on.

Does it collect user metrics like a lot of software does or does it actually steal designs? The report is absolutely not clear about this. I have not read many reports like this but are they all like the one they link to? Is that what a malware analysis looks like?

I'm completely behind the idea of calling every single software that collects user data and sends it off to a server malware but this is just not the case. We don't say Windows comes with malware, we in the West call it telemetry data to improve the user experience.

PragmaticPulp 4 years ago | |

> Does it collect user metrics like a lot of software does or does it actually steal designs?

The reports mark it as a Trojan/backdoor. This means it gives the company remote access to the machine. They can do whatever they want with it.

This isn’t anything like analytics reporting.

megous 4 years ago | | |

Anything with remote updates falls into that category.

me_me_me 4 years ago | |

malware is any software that hides its existence from user.

The windows telemetry is on edge of being malwere, even if its of no consequence to you. You cant say it will always stay that way.

tremon 4 years ago | | |

I'm going to broaden your definition to "malware is any software that hides its existence or its behaviour from the user". There's little value in knowing that a certain piece of software exists on your machine if you don't know what it's for.

rightbyte 4 years ago | | |

Why is it not malware? The Wikipedia definition of malware lists "steals data".

Last time I tried the amount of deep registry hacks to turn everything(?) of was silly.

Windows obviously ships with malware nowadays. I think you need enterprise edition for a supported way to turn all the BS off.

drclau 4 years ago |

I always wondered, how safe from tampering during manufacturing are devices 'designed in US/Europe/etc' that are built in China? Can anyone shed some light on the processes/practices that keep these devices safe, both from HW and SW points of view?

jeroenhd 4 years ago | |

Measures could be put in place, like installing the OS only when it arrives from the Chinese construction site or shipping pre-installed SSDs with Bitlocker enabled (with unique keys per customer) so that the drives cannot be tampered with unnoticed.

In practice, I've never heard of companies actually investing in these checks. There are a few "assembled in the USA" products that probably flash their install image outside China, but who says the American intelligence agencies in turn won't tamper with those? They've done it before, after all.

I'm a little surprised there aren't any viable open source programs for what is essentially a precise plotter with a complicated plot head. A bunch of plants could work together to construct a system free of vendor lock-in and expensive replacement parts if they would just work together.

nimbius 4 years ago |

"The malware would collect user data and send it to a remote address."

unpopular question, but how is this any different than mistakenly forgetting to disclose 'telemetry' in your code? or backdoors that routinely get disclosed in US embedded hardware products like firewalls and routers? or Discord scanning your entire hard disk? Ill admit the product seems pretty poorly designed from the get-go, but the tactics at work here are pretty standard when you consider things like Alexa and Ring get a pass for similar chicanery.

marginalia_nu 4 years ago | |

It isn't, and those things are just as bad.

As a concrete example of just how far the creeping acceptance of surveillance has come. Remember BonziBuddy[1], and the absolute shit storm over that and the lawsuits and all that?

Well what they did nearly indistinguishable from what Alexa does, and Cortana, and Siri, and Google Assistant. But it's just the way things are now. And no, it's not fine because everyone is doing it. It's still just as bad as it was then.

[1] https://www.youtube.com/watch?v=L958sMz1kWs

PragmaticPulp 4 years ago | |

It’s marked as a “Trojan/backdoor”, meaning remote access tool, and it tries to spread itself by inserting files to any USB stick inserted into the computer.

Giving someone full remote control over a computer and trying to spread that control as a computer virus is nothing like anonymous analytics collection.

IggleSniggle 4 years ago | |

Alexa and Ring don't get a pass though, do they? For these very reasons.

I know this is the HN crowd and not the general population, but I think most of HN would agree that undisclosed telemetry is super bad / malicious, and that disclosed / configurable telemetry is much better...but still often must be disabled because the Well is Poisoned by inappropriately utilized telemetry.

matheusmoreira 4 years ago | |

It's not really any different but these are "legitimate" companies with "legitimate" interests in people's data so nobody says anything. Governments do the same things that many hackers have gone to jail for at much larger scales and they award themselves medals for it. They literally stockpile exploits and don't help patch vulnerabilities, allowing their own citizens to remain insecure. The FBI once let a child abuse case fall apart because the judge ordered them to disclose the vulnerability and they refused.

Ccecil 4 years ago |

About 8 years ago one of our devs purchased a couple Android tablets from China to test if they would work as a host for Smoothieware (and/or 3d printers). It had malware prebundled at the ROM level. You could not remove it by wiping Android (IIRC..our dev that tracked the issue said he had to block what it was doing). The tablet forced your homepage...regardless of what you set it to...and I believe he said it was phoning home info...likely wifi credentials...etc.

It started me off on the thought process of "How many other things can be compromised?" SD cards with fake/hidden partitions? MCU counterfeits with entire subsystems?

IMHO...anything with an ethernet port, wifi, bluetooth...or anything that is able to at any time connect to those things needs to be watched.

300bps 4 years ago |

Bought a system on Ali Express to save money, the parts don't match what they ordered, it is infected with a virus designed to steal their data and infect executables on any USB device plugged into it to spread the infection. Ali Express says computers with viruses on them aren't against terms of service. They for some reason continue to use the system and try to get it to work.

£4k GBP...relatively low cost compared to a branded competitor...We sent the file for proper malware analysis which did confirm that it did indeed contain malware. The malware would collect user data and send it to a remote address.

flibberbit 4 years ago |

As much as that sucks, it's not all that surprising. You decided to try to undercut everyone else who desired a living wage. That's not to say getting infected with malware is "what you deserved", nobody should have their security compromised. What I'm saying is that you compromised your security by not working with people you can trust, people who are asking for a living wage and thus don't have to resort to putting malware into the products they create.

People in China aren't bad people, they're just people put into a tough situation. It's plenty easy to get good quality products out of China, just like anywhere else. The problem is that few people are willing to pay the real price for products, they want cheap regardless of consequences.

As someone also in the electronics design and manufacturing space I find this type of behavior very troubling. I demand what I consider a fair wage for my work and in return I also try to support other people in the industry also getting a fair wage. If all you do is buy the cheapest possible services you are really telling others they should do the same and not support you. The only solution I see is to stop pushing the costs of your business onto others that can't afford it. Go buy quality used hardware from people you can trust rather than complaining that a former colony of yours is trying to steal something from you.

sandworm101 4 years ago |

I bought a laptop once. It came with windows pre-installed. And a bunch of bloatware. And 101 things that phoned home under the guise of checking that a driver was up to date. And Norton. The definition of malware is open to large interpretation.

npteljes 4 years ago | |

>I bought a laptop once. It came with windows pre-installed

Some would say, not without merit in my opinion, that the malware part started with Windows itself.

https://www.gnu.org/proprietary/malware-microsoft.html

But even if we aren't that stringent with the definition of malware, we had malware preinstalled on our computers quite some time.

https://en.wikipedia.org/wiki/Lenovo#Security_and_privacy_in...

https://en.wikipedia.org/wiki/Dell#Self-signed_root_certific...

VoidWhisperer 4 years ago |

Since the site seems to have been hugged to death, here is the link to an archived version from a few days ago: https://archive.md/DIrdx

hereforphone 4 years ago |

Moving manufacturing back to our home countries (assuming a mostly Western audience here) is important not just for economic reasons but also for health, safety, and security. Trying to do so might get you called a racist, but it might depend on what political party is giving it a shot. This is an old problem and too little is being done about it.

hdjjhhvvhga 4 years ago |

I remember I bought a few phones from Aliexpress once for one of my IoT projects. I was somewhat surprised they don't really hide the malware, it's preinstalled. These are not just the usual bloatware you can't install but also the main web browser already modified injecting random crap.

nyolfen 4 years ago |

https://archive.fo/DIrdx

iancmceachern 4 years ago |

Hackaday covered this recently too:

https://hackaday.com/2022/01/22/zhengbang-pick-places-your-c...

amelius 4 years ago |

Is this anything new?

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

southerntofu 4 years ago | |

I'm a little bothered by the article title because it implies it's related to the manufacturer being from China, despite ample evidence that pretend-reputable software vendors like Google, Amazon and Microsoft all bundle universal backdoors with their systems.

Google infamously pushed settings changes on their phone lines without user consent via the Google Play Services backdoor. Amazon removed the (bought) book 1984 from all Kindles. Microsoft proudly bragged about their remote app "kill switch".

Let's not even talk about about CPU vendors embedding "anti-theft" solutions which are nothing more than RCE-as-a-service on a hardware/firmware level. Or hardware vendors bundling rootkits like Lenovo on some laptop series, and most phone manufacturers on all their devices.

692 4 years ago | | |

I was royally pissed off when I suspected my brand new Lenovo laptop was acting strange. The only in the end to stop it was to reinstall the OS, I then later found out it was the superfish issue

https://slate.com/technology/2015/02/lenovo-superfish-scanda...

I will never buy Lenovo again

the_dripper 4 years ago | | |

Do you perhaps have a link about the story of amazon removing the 1984 book on all kindles? It sounds very interesting, partly because it seems so absurd.

jacknews 4 years ago | | |

Do any of them steal IP, as is alleged here, and has certainly happened in other cases involving Chinese, often state-controlled, companies?

natch 4 years ago | | |

China is next level though. If that bothers anyone, that’s understandable; it should.

pftburger 4 years ago |

China isn’t a single thing… treating it as such creates a tribalistic atmosphere that’s good for no-one at all…

drno123 4 years ago |

Thank you! We receiced ZhengBang pick and place machine last week and did nit have the time to unpack it yet. We will definitely be careful now.

aembleton 4 years ago |

Website is returning an error. Here's a web archive link

https://web.archive.org/web/20220125124520/https://www.rmcyb...

vultour 4 years ago |

The “proper malware analysis” had me cracking up. I really hope they didn’t pay any significant amount of money for that.

contingencies 4 years ago |

I've just passed the 20 year anniversary of my arrival in China. Having lived in at least eight cities over that period and traveled broadly, I would strongly caution against assuming this is a deliberate attack by the vendor, much less the government. The vast majority of Windows instances in China are sourced from pirated distribution media and it is usual for those to be infected. This affects everyone domestically, not just machines shipped out. Furthermore, most apps are pirated with the same issues. Finally, many people's thumb drives touch a plethora of dirty machines (printing shops that support the still largely paper-driven bureaucracy, photography shops, work and home PCs, etc.) and thus are excellent vectors for malware. As usual, Hanlon's razor: resist over-attribution to malice.

Jwarder 4 years ago |

At this point how can they trust any installers they get from the company?

The risk the manufacturer bundling some "legitimate" remote access tool that won't show up as a virus seems high to me. Once burned twice shy.

dave333 4 years ago |

The author's website also has an interesting collection of science gadgets - tesla coils etc.

https://www.rmcybernetics.com/science/diy-projects

AlwaysRock 4 years ago |

Incredible. How many people are using this exact machine without being aware of this?

Iwan-Zotow 4 years ago |

See? You don't have to install malware yourself - that's the service!

duxup 4 years ago |

If I have a choice I generally try to limit my purchases from “non free” countries.

It’s not always easy, the line is hardly easy to see, but it is a choice I will go out of my way to make.

jokoon 4 years ago |

I'm curious how the Chinese government is able to install malware in chinese-made android phones.

It's hard to know which brands to avoid, and which brands are more trustworthy.

Even brands that are not chinese are still based in China...

kautzz 4 years ago |

or maybe they don’t give a fuck about your tiny company that’s too cheap to buy a decent pic n’place? maybe the malware was actually intended getting ip from the company that manufactured machines like yours in the thousands. why do you always assume US companies are the only ones being copied from?

dynamohk 4 years ago |

got a usb on ebay with malware for windows.

tharne 4 years ago |

In 2019 the Chinese covered up the early spread of COVID then later repeatedly stonewalled anyone doing serious research into the disease's origin. By letting COVID spread for months unchecked the Chinese effectively ensured that there was no way to stop this thing from going global, which it did, ultimately killing over 5M people and counting.

If we're unwilling to hold the Chinese to account for that in any meaningful way, I can't imagine we're going to do anything whatsoever about a little (or even a lot of) industrial espionage.

We'll gladly let the Chinese run roughshod over us and humiliate us repeatedly if it means we can still by our iPhones on the cheap.

luckyorlame 4 years ago |

Cool, talk about value add!

JediPig 4 years ago |

20 years ago, china hide 2nd network card that was in listener mode, transmitting documents at random times, mostly peek. This was at a research company. How it was discovered. We put a card on listening/prem mode and mirror everything for that subnet the printer was on. I thought I screwed it up with the double mirror/traffic.

when investigating why the issue, we found nothing wrong with the config, only when we plugged it to another network, we discovered it was something on the network. We narrow it down quickly to the printer. We told head of security (we were hired for an audit ) and it soon became known it was stealing trade secrets and sending them overseas.

that was 20 years ago, and till this day, I remember anytime someone says china doesn't steal technology... I remember this printer. this was done at the state level and was caught.

01acheru 4 years ago |

Hug of death probably so I cannot read the article.

Anyway that's the reason why I don't buy Chinese crap anymore. I'm not saying that I don't buy anything made in China, almost everything is made in China, but everyone should avoid Chinese crapware.

If something doesn't match the description send it back, if you find random executables that you cannot identify send it back, if you are asked to register on some weird Chinese website send it back, if you are asked to download a sketchy application with a Chinese readme send it back, etc...

After a while you'll notice you are sending everything back.

And it is not only Aliexpress or other Chinese marketplaces or websites, Amazon is full of Chinese crapware just the same.

edit: read the article from archive, well it just confirms to me what I wrote earlier.

iqanq 4 years ago |

Talk to afraid.org, perhaps they'll take down the subdomain.

oversocialized 4 years ago |

good thing every local and state government institution in the united states is using Zoom because it is "free"

encryptluks2 4 years ago |

I bought an HP machine in the US with malware deployed from Windows Updates.

Maxburn 4 years ago |

I can't read the article from here but attacking the supply chain isn't new. It is something that requires constant vigilance.

caaqil 4 years ago |

The malware now has 60/67 rating [1] on VT. Their analysis [2] is pretty good too.

[1]: https://www.virustotal.com/gui/file/1679b086f649d92456b2f600...

[2]: (PDF) https://www.rmcybernetics.com/files/pdf/Malware-analysis-Fly...

gruez 4 years ago | |

>Their analysis [2] is pretty good too.

seriously? It's rather poor.

>It was identified the malware is packed with Borland Delphi 6.0 - 7.0 as shown in the figure below

Borland Delphi is a compiler. It's not a packer. Saying that it's "packed with Borland Delphi" makes as much sense as "it's packed with visual c++".

>The strings of interest are as shown in the figure below

But if it's packed (as previously suggested), then any strings of interest won't be visible. All we see is a bunch of strings related to dynamically linked libraries. That also doesn't tell you much, because you can dynamically load libraries so all the evil APIs you use don't show up on the list.

The rest of the report seems to be reciting outputs from various reverse engineering tools, with little analysis added. The whole report gave the impression the author is a script kiddie.

caaqil 4 years ago | | |

I mean sure, the analysis isn't thorough and has some oopsies, but from my POV it's not a report written by malware analysts or experts (rather, by someone you wouldn't expect to analyse it at all), so I'm not setting the bar too high.