-2

I believe that I have several USB drives infected with trojan(s). The memory sticks are data drives (not bootable). They appear to be carrying the binary code of a trojan in its inactive, uninstalled, form. They were collected in the course of cleaning-up a major security incident.

More about the USB drives: The USBs are flash drives containing thousands of files, so distinguishing between user files and the executable trojan's machine code is difficult. This is essentially a big-data problem of finding the trojan in the filesystem. I have already run virus scanners that cannot detect the trojan---this may be because it is a zero-day exploit.

Are there any open source protocols for identifying all the machine code of a trojan on an infected USB? This must include both the instructions to execute the trojan on mount and the body of the trojan itself. I want to discover a signature for virus scanners and I want to determine what USB mounting vulnerability led to the trojan being installed.

Some answers have suggested ways to find the body of the trojan. How do I find the instructions that execute the trojan when it installs itself?

5

Answering Misconceptions

I believe that I have several USB memory sticks infected with trojan(s). The memory sticks are data drives (not bootable).

A memory stick is a stick used for computer memory. In this case, what you have is a USB flash drive that works much like a hard drive, not your RAM.

The USBs are flash drives containing thousands of files, so distinguishing between user files and the executable trojan's machine code is difficult.

Since there are thousands of files, you can likely get rid of .txt, and other weird extensions. Stuff like .pdf, .docx, .doc, .rtf, .exe and anything else that requires some form of execution when opened would be the most likely candidates here.

This is essentially a big-data problem of finding the trojan in the filesystem.

This is too broad, really. It's going to take a lot of trial and error to find the trojan, especially since you don't know where it is. We can't help with that.

I have already run virus scanners that cannot detect the trojan---this may be because it is a zero-day exploit.

No, a zero-day doesn't really matter here. A trojan could use any number of zero-days. What matters is if the trojan itself can be detected.

Are there any open source protocols for isolating the exploit code on an infected USB? By isolating the exploit, I mean to identify exactly the machine code involved in both the hook and the trojan.

This involves a lot of reverse-engineering. You will first need to identify the piece of malware. Where is it? There are some things I can help you with, though.

I wish to find every byte of machine code on the USB that is related to the exploit. I want to discover a signature for virus scanners and I want to determine what USB mounting vulnerability led to the trojan being installed.

What do you mean by "USB mounting vulnerability"? BadUSB? So there is something wrong with the device's firmware? If so, please see: How do I extract a copy of an unknown firmware from a hardware device?

If you just mean that you have an auto-run USB device which automatically executes the trojan file, that's the fault of the System Administrator or Security team that doesn't know how to properly secure a machine. If the USB device asks you to run a program, then that's also the fault of the person who clicked it.


The Protocol

I don't know of a "protocol," or a "standard" for this. I am the kind of person who will just do whatever it takes to get the job done, and who doesn't have time to read systematic approaches - unless it's for a problem I can't solve on my own.

However, I'll be more than happy to share some of the methods I've used. These methods assume you've decided to infect yourself. It's a bit of a Spray-n-Pray method that I've found works pretty well.


If using a Virtual Machine, mask it.

There exist dozens of ways to mask the fact that a guest operating system is running, so that the trojan itself won't fail to do anything if it detects it's running inside of a VM.

Unfortunately, this is beyond the scope of the answer. I am putting this here in the hopes that it will point you in the right direction.


Isolating Trojans that create, modify, or remove files on the File System

If you're handy with programming, you can develop a little application that monitors and logs all changes to the file system. Unless it's a deeply hidden trojan that infests your machine's firmware and effectively hides itself, you should be able to find out what is what, but it will take some effort.

This is the method I routinely use to isolate and reverse engineer trojans:

  1. Get yourself a test machine. Install your operating system. No webcam or microphone allowed. Boot it up.
  2. Activate your file system watching application
  3. Put the USB drive in the computer.
  4. Watch for any changes to the file system. Did anything happen on auto-run? You may have found it. Did anything happen after being asked to run the auto-run program by windows, and after you agreed to run it? You may have found it.

Even if you found it, it may just be a loader or dropper. You'll then need to discover what the loader/dropper is trying to do next. And there may be multiple steps beyond that.


Monitoring the Trojan Activity on the Network

Wireshark, or any kind of packet capturing software, can be very, very good for this. You can set up a machine that intercepts all network traffic coming to and from a machine, so it doesn't look like anything out of the ordinary is happening.

A good way to detect the presence of network firmware trojans is to compare the intercepted data to the data you're logging on your machine. If there is a discrepancy, then you've made great steps towards finding the culprit, and finding the connection information.

The next step would be to find the malicious file connecting to that specified IP address and port. That's your trojan. However, the trojan may have been put there by a dropper, and is therefore not part of the dropper itself.


What to do once you've found it

I wish to find every byte of machine code on the USB that is related to the exploit.

This part generally requires assembly knowledge. And knowledge of hex viewing/editing tools as well. If you have found the executable/dll itself, you can open it inside IDA Pro. Bonus points if you have the Decompiler Plugin to make it a lot more readable. Note that the decompiler plugin generates extra fluff because of dependencies. If you can't afford IDA Pro, use OllyDbg or something open source.

This is far beyond the scope of a reasonable answer, but you can learn about Assembly and IDA Pro. Have a look at various reverse-engineering topics such as these:

  1. Reverse Engineering Stack Exchange
  2. Reverse Engineering on Wiki Books

The bottom line is...

You need assembly knowledge. You really do. And you need programming knowledge as well. There's only so much you can do with a file watching approach.

And even if you do isolate the trojan's signature, what if it's different with every single infection? What if it's only a dropper that downloads an additional infection that happens to be encrypted?

Isolating the signature may not be the right approach unless the infections are static. It's certainly very possible to create dynamically-generated infections that bypass hashing methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.