2

I got some hardware from China that comes with a RAR archive containing a "driver installer" exe, as well as a file, lpk.dll, which appears to be a Trojan that infects RAR files.

I'm now quite concerned about installing the drivers, but I would like to use the hardware. Is there a way I can set up the divers without infecting my computer? Is it sufficient to just remove the file?

Temporary note: I also have a spare, if anyone is interested!!!

  • 1
    wut? So you got hardware from someone who, probably deliberately, tried to infect your computer? And instead of burning that, you want to use it? I'm kind of tempted to ask you to step away from your computer and live a life in the woods, where you can do no harm :) – Marcus Müller Jan 6 '17 at 20:52
  • 1
    I mean seriously, even if that was not intentional, you obviously can't trust any software coming from that vendor, so you clearly must not install any driver from them; everything else would just be irresponsible. Depending on the type of the device, you might be able to use a substitute driver – Marcus Müller Jan 6 '17 at 20:55
  • Also note that you grant devices that you plug in to your computer physical access to your computer. If they're malicious, it's game over. – Marcus Müller Jan 6 '17 at 21:00
  • What kind of hardware is it? The obvious solution would be to search for a trusted driver online. – Arminius Jan 6 '17 at 21:03
  • @Arminius I'd argue that at this point, it doesn't matter. From the top of my head, I can't find any hardware type that could not be easily abused for malicious intent, and a supplier that doesn't even make sure to send non-virus-ridden drivers simply can't be trusted. – Marcus Müller Jan 6 '17 at 21:05
0

As a suggestion... When I want to test something with virus I use a Vmware Virtual Machine. I create an snapshot first... then, I do the "dangerous stuff" and see the result.

If possible and depending of your needs you can cut network service first... so a trojan is not going to work. After extracting, install driver or whatever you need... you can try to clean... or extract or analyze your possible infected files. You can try your driver even with the possible virus if is that what you want.

The point is to use a vm as a "some kind of sandbox". And then you can safely recover your snapshot before all dangerous activity.

1

That depends on the sophistication of the attack.

The likely scenario is that the vendor just added a malicious file to the driver archive. You could search for compatible drivers online to obtain a trusted version of the software and you'd be fine. (Does that piece of hardware actually need that custom driver or can you just use it without installing extra software?)

The bad case scenario is that the vendor went one step further and also modified the firmware of the device. That's something you can't easily verify and your only option would be dumping driver and hardware altogether. The BadUSB project was a good demonstration of how straightforward it is to hide malware in the firmware of peripherals, in that case reprogramming the controller chips of USB devices.

Most members of Sec.SE would probably advise you to assume the latter and not use the hardware at all. I'd say it depends on the situation and type of hardware on which you didn't give additional info.

  • My thinking is that the person who made the driver file had an infected PC. I've looked around for a generic driver, but I can't find anything. – Lucas Jan 6 '17 at 22:06
  • I have plugged it in with a USB analyser turned on, it didn't seem to be doing anything weird. – Lucas Jan 6 '17 at 22:07
  • @Lucas you still owe us the info what kind of device it is. Also, USB is dangerous exactly because of what the BadUSB project tried to demonstrate: It can turn into a keyboard without you noticing, execute arbitrary commands and then go back into acting like a normal device. (Other types of devices are even more dangerous, but I won't go into that) – Marcus Müller Jan 6 '17 at 22:24
  • 3
    @MarcusMüller It an "Android and PC Endoscope ... so powerful and smart" which allows one to "see what you can't see and touch". Needless to say, it's top of the range. – Lucas Jan 6 '17 at 23:24
  • 1
    @Lucas That made me laugh quite hard. – Arminius Jan 6 '17 at 23:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.