Welcome Guest. | Log In| Register | Membership Benefits
Dark Reading's Security Views Weblog
Topics:   Security Views : Vulnerability Management Tech Center

  • Email this page E-mail this page
  • |  Print this page Print this page
  • |  Bookmark and Share

Energizer Bunny Gone Bad


Posted by Wolfgang Kandek, Mar 10, 2010 07:55 PM

Along with the usual security alerts covering the March bulletins from Microsoft and various content management systems flaws, US CERT published an unusual security alert about a product from Energizer, the battery company. It turns out that the charge monitoring software for its Duo Charger (Duo = charge with USB and wall socket) for Windows PCs installs a backdoor on your machine that allows an attacker to read and write arbitrary files on your PC. The Trojan horse is a simple, straightforward design and is defeated by any external NAT'ing firewall. It opens a listening port on the infected machine and waits for incoming commands, rather than reaching out to a server and retrieving commands.

The alert is newsworthy because of the delivery method:
  • A well-known company, Energizer, produces the software.
  • Energizer digitally signs the software.
  • The software is advertised on the packaging in English, French, and Spanish (see photo, below), as well as in the product manual.
This would have easily fooled me and other IT professionals because we habitually agree to the installation of software and device drivers whenever we connect new devices to our machines. The common antivirus scanners are only now catching up with their signatures, after the product has been pulled from store shelves, so they would have been of no help in this case. When the software runs for the first time, it requests an firewall exemption, which might have made me question its validity, but is actually a component by Microsoft that fields the request on behalf of the Energizer software, further inducing trust.

This case illustrates one of the big challenges of the Internet: who to trust to provide our information and digital goods. A number of companies are attempting to address this challenge, but we are still far away from mature and accepted solutions.



-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2010.

« New Analysis Tools For Windows Memory | Main | Cyberwarfare: Play Offense Or Defense? »



Sign up now for the weekly InformationWeek Blog Newsletter.


This is a public forum. United Business Media and its affiliates are not responsible for and do not control what is posted herein. United Business Media makes no warranties or guarantees concerning any advice dispensed by its staff members or readers.

Community standards in this comment area do not permit hate language, excessive profanity, or other patently offensive language. Please be aware that all information posted to this comment area becomes the property of United Business Media LLC and may be edited and republished in print or electronic format as outlined in United Business Media's Terms of Service.

Important Note: This comment area is NOT intended for commercial messages or solicitations of business.


  1. Finding Exposed Devices On Your Network
  2. Anticipating The First Car Virus
  3. Gaining A Foothold By Exploiting VxWorks Vulns
  4. Suspected Child Porn Hub Taken Offline
  5. The Case For Zero-Day Penetration Testing
  1. String Of Deals Shows Demand for Cloud-Based Authentication
  2. Tech Insight: Retooling Vulnerability Scanning, Penetration Testing For IPv6
  3. Five Ways To Stop Mass SQL Injection Attacks
  4. IPv6 Transition Poses New Security Threats
  5. Networked Scanners Offer A Window Into The Enterprise, Researcher Says
  6. U.S. Businesses Could Lose Up To $1 Billion In Online Banking Fraud This Year
  1. Ten Questions to Identify Compliance Risks When Sharing Information
  2. Data Encryption 101: Pragmatic Guide to PCI-DSS Requirements
  3. Extend Security to the Edge with Web App Security
 
 


 
  Ars Technica
Boing Boing
Channel 9 Forums
CRN Blogs
Dr.Dobb's Portal: Blogs
Engadget
Gizmodo
GrokLaw 		  Lifehacker
Schneier on Security
Slashdot
TechCrunch
Techdirt
Techmeme
Valleywag
 
  OCTOBER 2008
SEPTEMBER 2008
APRIL 2008
NOVEMBER 2007 		  OCTOBER 2007
AUGUST 2007
MARCH 2007
OCTOBER 2006