Abstract

The solid-state storage device, Universal Serial Bus (USB) was forensically examined to determine the presence of any vendor malware. Results indicated the presence of firmware malware in 63% of inspected devices, located in the machine code of the unallocated spaces of the storage device. Intel x86 Microcode was identified by forensic binary examination software as being present in the binary, which has been shown to infect a host with malware.

The signatures were extracted and contained the same files and folders across several devices, with entropy scans consistent with encrypted files. Lab tests showed the infected devices performed several activities related to the presence of advanced malware, such as a modification to the Telnet client and the adding of a third-party root certificate upon connection to the internet. Vendors were contacted and registered companies researched revealing inconsistencies, suspicious trading practises with links to China in all parts of the production chain, including having 34 IP addresses associated with the SHA 1 of the third-party root certificate. The cyber-cold war with China was investigated to determine the risks associated with the findings and mitigations with education, local production, and skilled forensic product testing.

Is Vendor Malware Present in Solid State Storage Devices Available Through E-commerce?