Chinese PlugX Malware Hidden in Your USB Devices?

unit42.paloaltonetworks.com

3 pointsrolph3 comments

Recently bought a USB external soundcard (Mic In, 2 Headphone, 2 USB) Made in China. LEDs stayed on when PC was off so I looked up how to disable USB power when off, which worked.

Twice now, the ASCP disabled setting has reverted. Have yet to try setting a BIOS password, and I did not try this setting earlier so can not confirm it is this USB device messing with it, maybe I should update my BIOS

ifyou have access to a linux install, you should be able to see if you have files not visible to windows. they will be prefixed with an ascii[unicode] character that blinds windows file finder.

this USB exploit is a second prong to an attack and could possibly use the USB to hold a wedge into a back door, as well as snarphing files.

this is a demonstration of why firmware custody of trust must be unbroken

{sigh}

It's like we're back in 1993, with boot-sector virii spreading via floppy disks.

Sometimes I really wish there was a huge U.S. Dept. of Software Security...with no real purpose in this world beyond making life hell for Microsoft's C-suite.

Reply on news.ycombinator.com