All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Strange things from eBay
PostPosted: February 17th, 2015, 3:48 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
I like to play the eBay flash lottery, and see what I get. This week was multiple wins.
First, 2 1GB "EasyDisk" flash drives with an interesting bonus.. 2 separate types of malware! One of them was an interesting one with its own VM, the other a fairly standard hidden extra set of files. Both didn't look very new and I wouldn't be surprised if the seller had no clue, and probably has malware running rampant.

the third one was quite interesting. Opening it up and I see the controllers I've started seeing around, IDE5019SN-G-2 which looks like a rebadged Alcor, or rip-off of them.
Attachment:
bl.jpg
bl.jpg [ 78.94 KiB | Viewed 12036 times ]


NAND was strange, looks like a MicroSD card that hasn't been shaped into one.. haven't done any testing on this one yet.
Attachment:
bl2.jpg
bl2.jpg [ 51.22 KiB | Viewed 12036 times ]


The last one definitely deserves a mention. opening it up and you know straight away there is Shenanigans afoot.
Attachment:
dodge.jpg
dodge.jpg [ 164.44 KiB | Viewed 12036 times ]


Definitely not what is reported!!
Attachment:
chipeasy.jpg
chipeasy.jpg [ 92.75 KiB | Viewed 12034 times ]

Testing failed.. no surprise, but what it did with files was interesting. I copied 900 or so GB to it, which succeeded, and the device showed the files on there after a re-insertion. but selecting all and asking for the size showed wrongly.

Attachment:
fakeresults.jpg
fakeresults.jpg [ 95.9 KiB | Viewed 12036 times ]

trying to copy files off it, well it did copy files, some actually were intact, but folders were empty, and most files, even though showing correct size, were full of 00 00 00's.
Attachment:
result.jpg
result.jpg [ 88.78 KiB | Viewed 12036 times ]


funnily enough, DMDE imaged it.. though full of zero's !
Attachment:
dmde1.jpg
dmde1.jpg [ 60.64 KiB | Viewed 12036 times ]

Attachment:
imaging.jpg
imaging.jpg [ 28.42 KiB | Viewed 12036 times ]

It seems like a lot of effort to go to coding up a thing like this?

Who knows what it actually did to the system, so I made sure to use one I am imaging tomorrow anyway.

all in all that was my fun for today!


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 5:02 
Offline

Joined: January 8th, 2008, 5:21
Posts: 937
Location: uk
Quote:
Shenanigans
That find was probably never sold by a retailer but was likely used for publicity. You know like flyers or handouts by some pretty young chick at a pubic event. Companies would buy them in their thousands as cheap as chips and give them out for free. Quite often some of them, the leftovers might make there way to street markets or even eBay for direct sale, often with the seller not understanding or knowing the problem.


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 6:35 
Offline

Joined: March 1st, 2011, 8:51
Posts: 78
Location: Australia
HaQue, have you seen BadUSB in the wild?


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 7:03 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 297
Location: England
Nice one HaQue
i heard of some individuals purposely infecting devices and leaving them to be "found" in order that they can be compromised later. Software and obvious tho.
Wonder if more are doing this at a lower level if that's possible.

&
Freudian Slip of the Day award goes to .... ^^

[pretty young chick at a pubic event]

:P

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 7:35 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Cris - not in the wild yet, but looking!
dick - I have one of the advertising ones, an education thing that pops a cmd prompt, types in a URL and runs browser etc. I will post a video of it - very scary actually..
I don't think it is one of those, it has all the tricks to make a filesystem look right, and even mostly work. I am going to try and read the firmware of it.
Kern, I would be gathering "schwagg" like no tomorrow in the HOPE of getting something dodgy!! if it means meeting lots BB's then, hey..what can I do?


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 8:24 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 297
Location: England
Just read Brians post re US spy prog lol.

AS: We'll need a search running..
AJ: It has already begun........

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 17th, 2015, 8:44 
Offline
User avatar

Joined: August 8th, 2014, 4:31
Posts: 37
Location: South Wales (UK)
I love seeing these things
and the creative measures that some will go to in order to sell off the 3rd tier junk NAND no-one else wants..

As for the 8 Pin ROM masquerading as a NAND.... now that's just dirty! :evil:


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 19th, 2015, 10:17 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Got a few more coming, would be interesting to see what they bring. 2 today, a 16GB Sandisk, hoping it sported a controller I didn't have, but no already have a few. the 256MB one was interesting. first I thought maybe it was on purpose, but then I remembered around 2012, every 2nd USB stick had malware on it.. literally was everywhere. So I am not reading too much into this one, and didn't bother contacting the seller.
Attachment:
drive.jpg
drive.jpg [ 18.77 KiB | Viewed 11832 times ]


interesting fies.. I am NOT opening the docx ;)
Attachment:
vir2.jpg
vir2.jpg [ 51.99 KiB | Viewed 11832 times ]


oh yes :)
Attachment:
vir.jpg
vir.jpg [ 58.85 KiB | Viewed 11832 times ]


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 19th, 2015, 18:16 
Offline
User avatar

Joined: August 26th, 2012, 19:18
Posts: 297
Location: England
hehe, another "security" issue .... http://bit.ly/1CP9m1S

SIMS this time


Attachments:
06.jpg
06.jpg [ 165.36 KiB | Viewed 11804 times ]

_________________
Когда хочется кушать – съешь всё.
Голод не тётка!
Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 19th, 2015, 18:31 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
I just don't get why they would document all this activity.

OK, We know that no computer system is safe from being hacked.. so lets go and do all this really devious stuff that will reflect badly on us and degrade any trust people have in computing and the internet... and store the details on a computer?! What could possibly go wrong!


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: February 23rd, 2015, 23:05 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Another fun one:

Hi, I am a sweet innocent looking Flash drive..
Attachment:
1.jpg
1.jpg [ 88.79 KiB | Viewed 11710 times ]


Now, looking a tad dodgy:
Attachment:
2.jpg
2.jpg [ 70.98 KiB | Viewed 11710 times ]


Flip it over and yes, more creative work:
Attachment:
3.jpg
3.jpg [ 85.14 KiB | Viewed 11710 times ]

Attachment:
4.jpg
4.jpg [ 193.91 KiB | Viewed 11710 times ]

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile :)


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: June 15th, 2015, 13:00 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2513
Location: Ontario, Canada
I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:


Attachments:
IMG_20150615_123018.jpg
IMG_20150615_123018.jpg [ 240.56 KiB | Viewed 11231 times ]
IMG_20150615_122959.jpg
IMG_20150615_122959.jpg [ 274.61 KiB | Viewed 11231 times ]

_________________
Luke
Recovery Force Data Recovery
Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: June 15th, 2015, 22:25 
Offline

Joined: July 30th, 2012, 3:37
Posts: 308
Location: Fairfield, CT USA
lcoughey wrote:
I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:

Kingston did something weird like that for their 64GB USB 3.0 Flash Drives, two PCB's sandwiched between a flex pcb.

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: June 16th, 2015, 4:13 
Offline
User avatar

Joined: August 8th, 2014, 4:31
Posts: 37
Location: South Wales (UK)
that last one....

I would say approx 2 years ago I was getting things like that quite regular.. 3-5 units a week

Those Flexi PCB / Ribbon substrate things went in and out of fashion very quickly.

and Im glad about it :)


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: June 18th, 2015, 19:02 
Offline
User avatar

Joined: April 22nd, 2015, 20:32
Posts: 396
Location: Portugal
HaQue wrote:
Attachment:
4.jpg

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile :)



This one looks like a rubber ducky for pen test!

_________________
BTC Wallet - 3AoQPTBsz9PbfoanCx44Lw76Y2TwtKa1x5
Instagram https://www.instagram.com/datarecovery_morde.pt/


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: July 3rd, 2015, 0:36 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Never seen "REFURB" lasered onto the outside of cases..
This one is 32GB, with an original Sandisk Controller and NAND chip, seems to have full capacity and works fine.

Attachment:
refurb_sandisk.jpg
refurb_sandisk.jpg [ 48.43 KiB | Viewed 10925 times ]


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: July 3rd, 2015, 4:01 
Offline

Joined: October 24th, 2009, 15:22
Posts: 843
Location: Poland
HaQue wrote:
...seems to have full capacity and works fine.


But how long? ;)

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: July 3rd, 2015, 6:13 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
Good Point!

I am trying to get as many Sandisk as Possible to build up a stockpile of all controller revisions. But alas this was a very common 82-00514-5 that's around in 1/2 of the current stocked shelves


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: July 17th, 2015, 12:45 
Offline
User avatar

Joined: July 11th, 2015, 18:20
Posts: 8
Location: Mississippi
HaQue wrote:
One of them was an interesting one with its own VM


What does that mean? It was like this: https://en.wikipedia.org/wiki/Blue_Pill_%28software%29?

_________________
- George


Top
 Profile  
 
 Post subject: Re: Strange things from eBay
PostPosted: July 17th, 2015, 18:10 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 14945
Location: Australia
High-quality high-capacity 2000GB / 2TB V250W metal hook USB flash drive / U disk / memory stick:
http://www.aliexpress.com/item/High-qua ... 77868.html

5 pieces x 2TB @ US$11 per piece.

It's just as well the capacity label is crooked, otherwise I might have fallen for it. :roll:

_________________
A backup a day keeps DR away.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 22 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 9 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group