HDD GURU FORUMS
http://forum.hddguru.com/

Strange things from eBay
http://forum.hddguru.com/viewtopic.php?f=10&t=30567		 Page 1 of 2
Author:  HaQue [ February 17th, 2015, 3:48 ]
Post subject:  Strange things from eBay
I like to play the eBay flash lottery, and see what I get. This week was multiple wins.
First, 2 1GB "EasyDisk" flash drives with an interesting bonus.. 2 separate types of malware! One of them was an interesting one with its own VM, the other a fairly standard hidden extra set of files. Both didn't look very new and I wouldn't be surprised if the seller had no clue, and probably has malware running rampant.

the third one was quite interesting. Opening it up and I see the controllers I've started seeing around, IDE5019SN-G-2 which looks like a rebadged Alcor, or rip-off of them.
Attachment:
bl.jpg
bl.jpg [ 78.94 KiB | Viewed 14655 times ]


NAND was strange, looks like a MicroSD card that hasn't been shaped into one.. haven't done any testing on this one yet.
Attachment:
bl2.jpg
bl2.jpg [ 51.22 KiB | Viewed 14655 times ]


The last one definitely deserves a mention. opening it up and you know straight away there is Shenanigans afoot.
Attachment:
dodge.jpg
dodge.jpg [ 164.44 KiB | Viewed 14655 times ]


Definitely not what is reported!!
Attachment:
chipeasy.jpg
chipeasy.jpg [ 92.75 KiB | Viewed 14653 times ]

Testing failed.. no surprise, but what it did with files was interesting. I copied 900 or so GB to it, which succeeded, and the device showed the files on there after a re-insertion. but selecting all and asking for the size showed wrongly.

Attachment:
fakeresults.jpg
fakeresults.jpg [ 95.9 KiB | Viewed 14655 times ]

trying to copy files off it, well it did copy files, some actually were intact, but folders were empty, and most files, even though showing correct size, were full of 00 00 00's.
Attachment:
result.jpg
result.jpg [ 88.78 KiB | Viewed 14655 times ]


funnily enough, DMDE imaged it.. though full of zero's !
Attachment:
dmde1.jpg
dmde1.jpg [ 60.64 KiB | Viewed 14655 times ]

Attachment:
imaging.jpg
imaging.jpg [ 28.42 KiB | Viewed 14655 times ]

It seems like a lot of effort to go to coding up a thing like this?

Who knows what it actually did to the system, so I made sure to use one I am imaging tomorrow anyway.

all in all that was my fun for today!
Author:  dick [ February 17th, 2015, 5:02 ]
Post subject:  Re: Strange things from eBay
Quote:
Shenanigans
That find was probably never sold by a retailer but was likely used for publicity. You know like flyers or handouts by some pretty young chick at a pubic event. Companies would buy them in their thousands as cheap as chips and give them out for free. Quite often some of them, the leftovers might make there way to street markets or even eBay for direct sale, often with the seller not understanding or knowing the problem.
Author:  Cris [ February 17th, 2015, 6:35 ]
Post subject:  Re: Strange things from eBay
HaQue, have you seen BadUSB in the wild?
Author:  digitalferret [ February 17th, 2015, 7:03 ]
Post subject:  Re: Strange things from eBay
Nice one HaQue
i heard of some individuals purposely infecting devices and leaving them to be "found" in order that they can be compromised later. Software and obvious tho.
Wonder if more are doing this at a lower level if that's possible.

&
Freudian Slip of the Day award goes to .... ^^

[pretty young chick at a pubic event]

:P
Author:  HaQue [ February 17th, 2015, 7:35 ]
Post subject:  Re: Strange things from eBay
Cris - not in the wild yet, but looking!
dick - I have one of the advertising ones, an education thing that pops a cmd prompt, types in a URL and runs browser etc. I will post a video of it - very scary actually..
I don't think it is one of those, it has all the tricks to make a filesystem look right, and even mostly work. I am going to try and read the firmware of it.
Kern, I would be gathering "schwagg" like no tomorrow in the HOPE of getting something dodgy!! if it means meeting lots BB's then, hey..what can I do?
Author:  digitalferret [ February 17th, 2015, 8:24 ]
Post subject:  Re: Strange things from eBay
Just read Brians post re US spy prog lol.

AS: We'll need a search running..
AJ: It has already begun........
Author:  MarkGreenwood (KE) [ February 17th, 2015, 8:44 ]
Post subject:  Re: Strange things from eBay
I love seeing these things
and the creative measures that some will go to in order to sell off the 3rd tier junk NAND no-one else wants..

As for the 8 Pin ROM masquerading as a NAND.... now that's just dirty! :evil:
Author:  HaQue [ February 19th, 2015, 10:17 ]
Post subject:  Re: Strange things from eBay
Got a few more coming, would be interesting to see what they bring. 2 today, a 16GB Sandisk, hoping it sported a controller I didn't have, but no already have a few. the 256MB one was interesting. first I thought maybe it was on purpose, but then I remembered around 2012, every 2nd USB stick had malware on it.. literally was everywhere. So I am not reading too much into this one, and didn't bother contacting the seller.
Attachment:
drive.jpg
drive.jpg [ 18.77 KiB | Viewed 14451 times ]


interesting fies.. I am NOT opening the docx ;)
Attachment:
vir2.jpg
vir2.jpg [ 51.99 KiB | Viewed 14451 times ]


oh yes :)
Attachment:
vir.jpg
vir.jpg [ 58.85 KiB | Viewed 14451 times ]
Author:  digitalferret [ February 19th, 2015, 18:16 ]
Post subject:  Re: Strange things from eBay
hehe, another "security" issue .... http://bit.ly/1CP9m1S

SIMS this time

Attachments:
06.jpg
06.jpg [ 165.36 KiB | Viewed 14423 times ]
Author:  HaQue [ February 19th, 2015, 18:31 ]
Post subject:  Re: Strange things from eBay
I just don't get why they would document all this activity.

OK, We know that no computer system is safe from being hacked.. so lets go and do all this really devious stuff that will reflect badly on us and degrade any trust people have in computing and the internet... and store the details on a computer?! What could possibly go wrong!
Author:  HaQue [ February 23rd, 2015, 23:05 ]
Post subject:  Re: Strange things from eBay
Another fun one:

Hi, I am a sweet innocent looking Flash drive..
Attachment:
1.jpg
1.jpg [ 88.79 KiB | Viewed 14329 times ]


Now, looking a tad dodgy:
Attachment:
2.jpg
2.jpg [ 70.98 KiB | Viewed 14329 times ]


Flip it over and yes, more creative work:
Attachment:
3.jpg
3.jpg [ 85.14 KiB | Viewed 14329 times ]

Attachment:
4.jpg
4.jpg [ 193.91 KiB | Viewed 14329 times ]

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile :)
Author:  lcoughey [ June 15th, 2015, 13:00 ]
Post subject:  Re: Strange things from eBay
I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:

Attachments:
IMG_20150615_123018.jpg
IMG_20150615_123018.jpg [ 240.56 KiB | Viewed 13850 times ]
IMG_20150615_122959.jpg
IMG_20150615_122959.jpg [ 274.61 KiB | Viewed 13850 times ]
Author:  jeremyb [ June 15th, 2015, 22:25 ]
Post subject:  Re: Strange things from eBay
lcoughey wrote:
I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:

Kingston did something weird like that for their 64GB USB 3.0 Flash Drives, two PCB's sandwiched between a flex pcb.
Author:  MarkGreenwood (KE) [ June 16th, 2015, 4:13 ]
Post subject:  Re: Strange things from eBay
that last one....

I would say approx 2 years ago I was getting things like that quite regular.. 3-5 units a week

Those Flexi PCB / Ribbon substrate things went in and out of fashion very quickly.

and Im glad about it :)
Author:  DRUG [ June 18th, 2015, 19:02 ]
Post subject:  Re: Strange things from eBay
HaQue wrote:
Attachment:
4.jpg

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile :)



This one looks like a rubber ducky for pen test!
Author:  HaQue [ July 3rd, 2015, 0:36 ]
Post subject:  Re: Strange things from eBay
Never seen "REFURB" lasered onto the outside of cases..
This one is 32GB, with an original Sandisk Controller and NAND chip, seems to have full capacity and works fine.

Attachment:
refurb_sandisk.jpg
refurb_sandisk.jpg [ 48.43 KiB | Viewed 13544 times ]
Author:  arvika [ July 3rd, 2015, 4:01 ]
Post subject:  Re: Strange things from eBay
HaQue wrote:
...seems to have full capacity and works fine.


But how long? ;)
Author:  HaQue [ July 3rd, 2015, 6:13 ]
Post subject:  Re: Strange things from eBay
Good Point!

I am trying to get as many Sandisk as Possible to build up a stockpile of all controller revisions. But alas this was a very common 82-00514-5 that's around in 1/2 of the current stocked shelves
Author:  GeorgeKJones62 [ July 17th, 2015, 12:45 ]
Post subject:  Re: Strange things from eBay
HaQue wrote:
One of them was an interesting one with its own VM


What does that mean? It was like this: https://en.wikipedia.org/wiki/Blue_Pill_%28software%29?
Author:  fzabkar [ July 17th, 2015, 18:10 ]
Post subject:  Re: Strange things from eBay
High-quality high-capacity 2000GB / 2TB V250W metal hook USB flash drive / U disk / memory stick:
http://www.aliexpress.com/item/High-qua ... 77868.html

5 pieces x 2TB @ US$11 per piece.

It's just as well the capacity label is crooked, otherwise I might have fallen for it. :roll:
Page 1 of 2 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/