RE: Trojan Found In New HDs Sold In Taiwan

["Larry Seltzer" <Larry () larryseltzer com>]

Doesn't everyone format new hard drives?

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blogs.pcmag.com/securitywatch/
Contributing Editor, PC Magazine
larry.seltzer () ziffdavisenterprise com


-----Original Message-----
From: funsec-bounces () linuxbox org [mailto:funsec-bounces () linuxbox org]
On Behalf Of Paul Ferguson
Sent: Monday, November 12, 2007 12:22 AM
To: funsec () linuxbox org
Subject: [funsec] Trojan Found In New HDs Sold In Taiwan

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Via The Taipei Times.

[snip]

Portable hard discs sold locally and produced by US disk-drive
manufacturer Seagate Technology have been found to carry Trojan horse
viruses that automatically upload to Beijing Web sites anything the
computer user saves on the hard disc, the Investigation Bureau said.

Around 1,800 of the portable Maxtor hard discs, produced in Thailand,
carried two Trojan horse viruses: autorun.inf and ghost.pif, the bureau
under the Ministry of Justice said.

The tainted portable hard disc uploads any information saved on the
computer automatically and without the owner's knowledge to
www.nice8.org and www.we168.org, the bureau said.

[snip]

More:
http://www.taipeitimes.com/News/taiwan/archives/2007/11/11/2003387202

Via /.
http://hardware.slashdot.org/article.pl?sid=07/11/11/2246246

Note:

While the hosts listed in this article would appear to be in China (due
to their *.cn domain), they are not -- one is in Dallas Texas
[75.126.97.113] and the other is in Korea [222.122.180.190]. The ability
for cyber criminals to register domains in China, and have the actual
hosts elsewhere geographically is a simple process.

- - ferg

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 9.6.3 (Build 3017)

wj8DBQFHN+Liq1pz9mNUZTMRAgc5AKD0yIa9tsaWzSPigz5ooyEKg5hDMACg3g/O
28C+4DyVJ9hTLKChAQaGRnc=
=4hKX
-----END PGP SIGNATURE-----




--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet  fergdawg(at)netzero.net
ferg's tech blog: http://fergdawg.blogspot.com/


_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.

_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.