1

China / Linux / Bank / Trojan / Backdoor / Executables

Hey guys. I've got an account with a Chinese bank (I live here), and in the process of setting up an online account for the Chinese version of Amazon, I've been asked to install a plugin for the Unionpay debit card.

The question is:

Is there any way to analyze it and determine if the plugin contains malware, or what it will be doing? It's a binary executable. The ostensible purpose is to "enter your pin number during bank card verification". (This is Linux, Ubuntu 15.04, 64-bit.)

115% suspicious, naturally, and it's an option I'd avoid if there's any alternative, but this is pretty much the choice here. Other than having everything express-mailed from the States.

The UnionPay network is equivalent to Mastercard or Visa in your Western-world comparison. So, it's not some tiny Chinese bank or Mr. Chen's phishing site. However, wouldn't put it past them to backdoor everyone's computers as a general policy.

Here's a link to the Arch version of the package. https://aur.archlinux.org/packages/upeditor/

And the source: https://user.95516.com/ctrl/UPEditorLinux64_2.tar.gz

Anybody here intelligent and capable enough to dig into this a bit?

  • This is more of a Reverse Engineering SE question than security. I also think it's a bit broad, and I'm not sure if anyone there will do the analysis for you. – RoraΖ May 26 '15 at 17:12
  • Have you run it through VirusTotal yet? It should tell you a bit more about it. – Ohnana May 26 '15 at 23:14
  • You can always make a small VM for it (install QEMU and put a minimal Arch install in there) and use it whenever you need the plugin. – user42178 May 27 '15 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.