Dangerous New USB Trojan Discovered

The Internet and the growing interconnectedness of networks have made it incredibly easy for threat actors to deliver and propagate malware. But not all cyber threats are Internet-borne.

Take USB Thief, new malware sample that researchers at security firm ESET recently discovered.  As its name implies, the malware is completely USB-borne, meaning it spreads exclusively through devices that plug into the USB port of computers.

This data-stealing Trojan could be used for targeted attacks on systems disconnected from the Internet. Some obvious examples of air-gapped systems that would fall into this category, and that would be of interest to the authors of USB Thief, would be industrial control systems controlling equipment at critical infrastructure facilities including power plants, nuclear facilities, shipyards, and elsewhere.

Based on the malware sample that ESET analyzed, the only way the malware would propagate is by the attacker installing it on other USB devices, says Bruce Burrell, a security researcher at ESET. "Users might be exposed by finding such sticks and inserting them into their computers."

The highly destructive Stuxnet worm that was used to degrade and destroy hundreds of centrifuges at Iran’s uranium enrichment facility at Natanz a few years ago was, in fact, initially introduced into the systems via an infected USB stick.

ESET did not disclose how it discovered USB Thief. But ESET describes it as very sophisticated, especially for its ability to avoid detection and reverse engineering.

The malware attaches as a plugin or a dynamically linked library (DLL) into the command chain of applications that are typically stored on USB devices, like Firefox, Notepad++, and TrueCrypt, ESET security researcher Tomas Gardon said in the blog post announcing the discovery.

Whenever these applications are executed, the malware runs in the background and steals data without giving users an inkling of what’s going on. Because it exists on a USB stick, the malware leaves no trace of its presence on any computer on which it runs. 

USB Thief’s real difference, though, lies in its self-protecting capabilities, according to Gardon. For starters, each malware sample is tied directly to the specific USB stick on which it is installed. A sample of USB Thief from one USB will not run if it is copied and pasted on another device.

That’s because of the way the authors have ensured that filenames would be different for every instance of USB Thief, Gardon said. Among other things, one of the filenames in the malware execution chain is linked to the file creation time, so any sample that is copied from an original would have a different file creation time and therefore would not work, the security researcher said.

In addition, some of the individual files in the malware are protected via AES128 encryption, where the encryption key is tied to the USB’s unique device ID and the particular disk properties of the device hosting the malware. As a result, the malware will only run on that specific device.

The file-naming techniques and encryption used in USB Thief make it extremely hard to disassemble and to study, Gardon said.

An analysis of USB Thief’s payload shows that it is designed to steal images, documents, and generally all data files on the system as well as the Windows registry tree, a complete list of files from all drives on the system. It then encrypts the stolen data.

The malware does not appear to be very widespread at the moment. But its payload can be easily changed so instead of data stealing it can be used for some other malicious purposes, Gardon said in his post.

 Related Content:

Find out more about security threats at Interop 2016, May 2-6, at the Mandalay Bay Convention Center, Las Vegas. Click here for pricing information and to register.