Air-gapped systems at risk from USB Trojan

A warning has been sounded for organisations that are running systems isolated from the internet. The ‘USB Thief’ Trojan has been designed to target just such systems, taking advantage of the practice of storing portable versions of popular apps on USBs. The malware hides inside a plugin or a dynamically linked library (DLL), and when the application is executed it runs in the background. It encrypts certain files with AES-128 and with file names that have been generated from cryptographic elements. In turn, the AES encryption key is linked to the USB that the malware was loaded onto, which ensures it can’t be run from another device, making it difficult to detect and/or analyse. Furthermore, researchers have found that it can’t be copied or reverse engineered. The report warns that the Trojan is likely to have been created for attacks on air-gapped systems.

The 'USB Thief' Trojan Malware

"Well, taking into account that organizations isolate some of their systems for a good reason," explained Peter Stancik, the security evangelist at ESET. "Any tool capable of attacking these so called air-gapped systems must be regarded as dangerous."

UPCOMING WEBINAR 🔐 Mastering API Security: Understanding Your True Attack Surface Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar! Join the Session

"This is not a very common way to trick users, but very dangerous," Stancik said. "People should understand the risks associated with USB storage devices obtained from sources that may not be trustworthy."

Here's How you can Protect from being Infected:

Do not use USB storage devices from non-trustworthy sources.

Turn off Autorun

Regularly backup your data

Security researchers have discovered a new data-stealing Trojan that makes special use of USB devices in order to spread itself and does not leave any trace of activity on the compromised systems.Dubbed USB Thief ( or Win32/PSW.Stealer.NAI), the malware has the capability of stealthy attacking against air-gapped or isolated computers, warns ESET security firm.The malware author has employed special programs to protect the USB Thief from being reproduced or copied, making it even harder to detect and reverse-engineer.USB Thief has been designed for targeted attacks on computer systems that are isolated from the Internet, according to the ESET malware analyst Tomáš Gardoň.The USB Thief Trojan malware is stored either as a portable application's plugin source or as a Dynamically Linked Library (DLL) used by the portable application.Since USB devices often store popular applications like Firefox, Notepad++ or TrueCrypt portable, once any of these applications is executed, the malware starts running in the background.USB Thief is capable of stealing data from air-gapped systems – systems that are isolated from the Internet and other external networks.The malware runs from a USB removable device, so it don't leave any traces of its activities, and thus, victims do not even notice that their data had been stolen.Since the malware is bound to a single USB device, it prevents USB Thief from leaking from the infected computers.Besides this, USB Thief utilizes a sophisticated implementation of multi-staged encryption that makes the malware harder to detect and analyse.More technical details are available on ESET Ireland's official blog