Anatomy of a Biting Bunny – The Infected Microsoft Catalog Update

[ronjor]

by Randy Abrams

Aryeh Goretsky posted a blog about a trojan program in a Microsoft catalog update. I thought it might be a little interesting to know how this can happen and why it doesn’t happen more often.

As it turns out, it was once my job to make sure that Microsoft did not release infected software. Initially my responsibility was only for retail software, but eventually grew to encompass virtually everything that Microsoft releases and virtually everything that Microsoft hosts on Microsoft.com or in Microsoft update sites. It quickly became known that inside of Microsoft if there was an infected release it was immediately escalated to very high levels and was taken very seriously. Almost all detections I encountered at the end of the time I did scanning at Microsoft were in third party drivers.

http://blog.eset.com/2011/02/05/anat...catalog-update

Originally Posted by ronjor

http://blog.eset.com/2011/02/05/anat...catalog-update

He makes it look like it was nobody's fault. But why the hell is this dll listening on a port? A battery charger, seriously?

[Cudni]

also a prior thread in Eset forum
http://www.wilderssecurity.com/showthread.php?t=291873

[siljaline]

Also @ the ESET Blog here, here, more specifically from US CERT, Energizer DUO USB battery charger software allows unauthorized remote system access