Anatomy of a Biting Bunny – The Infected Microsoft Catalog Update

ronjor · Feb 5, 2011

by Randy Abrams

Aryeh Goretsky posted a blog about a trojan program in a Microsoft catalog update. I thought it might be a little interesting to know how this can happen and why it doesn’t happen more often.

As it turns out, it was once my job to make sure that Microsoft did not release infected software. Initially my responsibility was only for retail software, but eventually grew to encompass virtually everything that Microsoft releases and virtually everything that Microsoft hosts on Microsoft.com or in Microsoft update sites. It quickly became known that inside of Microsoft if there was an infected release it was immediately escalated to very high levels and was taken very seriously. Almost all detections I encountered at the end of the time I did scanning at Microsoft were in third party drivers.
Click to expand...

http://blog.eset.com/2011/02/05/anatomy-of-a-biting-bunny-–-the-infected-microsoft-catalog-update

katio · Feb 6, 2011

ronjor said:

http://blog.eset.com/2011/02/05/anatomy-of-a-biting-bunny-–-the-infected-microsoft-catalog-update
Click to expand...

He makes it look like it was nobody's fault. But why the hell is this dll listening on a port? A battery charger, seriously?

Cudni · Feb 6, 2011

also a prior thread in Eset forum
https://www.wilderssecurity.com/showthread.php?t=291873

siljaline · Feb 7, 2011

Also @ the ESET Blog here, here, more specifically from US CERT, Energizer DUO USB battery charger software allows unauthorized remote system access

Log in or Sign up

Anatomy of a Biting Bunny – The Infected Microsoft Catalog Update

ronjor Global Moderator

katio Guest

Cudni Global Moderator

siljaline Registered Member

Log in or Sign up

Anatomy of a Biting Bunny – The Infected Microsoft Catalog Update

ronjor Global Moderator

katio Guest

Cudni Global Moderator

siljaline Registered Member

Useful Searches