Strange things from eBay

[HaQue]

I like to play the eBay flash lottery, and see what I get. This week was multiple wins.
First, 2 1GB "EasyDisk" flash drives with an interesting bonus.. 2 separate types of malware! One of them was an interesting one with its own VM, the other a fairly standard hidden extra set of files. Both didn't look very new and I wouldn't be surprised if the seller had no clue, and probably has malware running rampant.

the third one was quite interesting. Opening it up and I see the controllers I've started seeing around, IDE5019SN-G-2 which looks like a rebadged Alcor, or rip-off of them.

bl.jpg (78.94 KiB) Viewed 14661 times

NAND was strange, looks like a MicroSD card that hasn't been shaped into one.. haven't done any testing on this one yet.

bl2.jpg (51.22 KiB) Viewed 14661 times

The last one definitely deserves a mention. opening it up and you know straight away there is Shenanigans afoot.

Definitely not what is reported!!

Testing failed.. no surprise, but what it did with files was interesting. I copied 900 or so GB to it, which succeeded, and the device showed the files on there after a re-insertion. but selecting all and asking for the size showed wrongly.

trying to copy files off it, well it did copy files, some actually were intact, but folders were empty, and most files, even though showing correct size, were full of 00 00 00's.

funnily enough, DMDE imaged it.. though full of zero's !

imaging.jpg (28.42 KiB) Viewed 14661 times

It seems like a lot of effort to go to coding up a thing like this?

Who knows what it actually did to the system, so I made sure to use one I am imaging tomorrow anyway.

all in all that was my fun for today!

[dick]

Shenanigans

That find was probably never sold by a retailer but was likely used for publicity. You know like flyers or handouts by some pretty young chick at a pubic event. Companies would buy them in their thousands as cheap as chips and give them out for free. Quite often some of them, the leftovers might make there way to street markets or even eBay for direct sale, often with the seller not understanding or knowing the problem.

[Cris]

HaQue, have you seen BadUSB in the wild?

[digitalferret]

Nice one HaQue
i heard of some individuals purposely infecting devices and leaving them to be "found" in order that they can be compromised later. Software and obvious tho.
Wonder if more are doing this at a lower level if that's possible.

&
Freudian Slip of the Day award goes to .... ^^

[pretty young chick at a pubic event]

[HaQue]

Cris - not in the wild yet, but looking!
dick - I have one of the advertising ones, an education thing that pops a cmd prompt, types in a URL and runs browser etc. I will post a video of it - very scary actually..
I don't think it is one of those, it has all the tricks to make a filesystem look right, and even mostly work. I am going to try and read the firmware of it.
Kern, I would be gathering "schwagg" like no tomorrow in the HOPE of getting something dodgy!! if it means meeting lots BB's then, hey..what can I do?

[digitalferret]

Just read Brians post re US spy prog lol.

AS: We'll need a search running..
AJ: It has already begun........

[MarkGreenwood (KE)]

I love seeing these things
and the creative measures that some will go to in order to sell off the 3rd tier junk NAND no-one else wants..

As for the 8 Pin ROM masquerading as a NAND.... now that's just dirty!

[HaQue]

Got a few more coming, would be interesting to see what they bring. 2 today, a 16GB Sandisk, hoping it sported a controller I didn't have, but no already have a few. the 256MB one was interesting. first I thought maybe it was on purpose, but then I remembered around 2012, every 2nd USB stick had malware on it.. literally was everywhere. So I am not reading too much into this one, and didn't bother contacting the seller.

drive.jpg (18.77 KiB) Viewed 14457 times

interesting fies.. I am NOT opening the docx

oh yes

[digitalferret]

hehe, another "security" issue .... http://bit.ly/1CP9m1S

SIMS this time

Attachments

[HaQue]

I just don't get why they would document all this activity.

OK, We know that no computer system is safe from being hacked.. so lets go and do all this really devious stuff that will reflect badly on us and degrade any trust people have in computing and the internet... and store the details on a computer?! What could possibly go wrong!

[HaQue]

Another fun one:

Hi, I am a sweet innocent looking Flash drive..

Now, looking a tad dodgy:

2.jpg (70.98 KiB) Viewed 14335 times

Flip it over and yes, more creative work:

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile

[lcoughey]

I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:

Attachments

[jeremyb]

I'm not sure where the client bought this 8GB thumb drive, but felt it was worthy to add to the wall of weird:

Kingston did something weird like that for their 64GB USB 3.0 Flash Drives, two PCB's sandwiched between a flex pcb.

[MarkGreenwood (KE)]

that last one....

I would say approx 2 years ago I was getting things like that quite regular.. 3-5 units a week

Those Flexi PCB / Ribbon substrate things went in and out of fashion very quickly.

and Im glad about it

[DRUG]

4.jpg

No malware this time, but a few pics, some chinese music and what looks like a phone Filesystem.

another cool addition to the dodgy pile

This one looks like a rubber ducky for pen test!

[HaQue]

Never seen "REFURB" lasered onto the outside of cases..
This one is 32GB, with an original Sandisk Controller and NAND chip, seems to have full capacity and works fine.

[arvika]

...seems to have full capacity and works fine.

But how long?

[HaQue]

Good Point!

I am trying to get as many Sandisk as Possible to build up a stockpile of all controller revisions. But alas this was a very common 82-00514-5 that's around in 1/2 of the current stocked shelves

[GeorgeKJones62]

One of them was an interesting one with its own VM

What does that mean? It was like this: https://en.wikipedia.org/wiki/Blue_Pill_%28software%29?

[fzabkar]

High-quality high-capacity 2000GB / 2TB V250W metal hook USB flash drive / U disk / memory stick:
http://www.aliexpress.com/item/High-qua ... 77868.html

5 pieces x 2TB @ US$11 per piece.

It's just as well the capacity label is crooked, otherwise I might have fallen for it.