Is it possible for criminals to sell electronics intentionally infected with malware?

[desura]

something I have wondered, have there been cases of criminal groups selling used laptops and smartphones with some phishing malware preloaded to steal personal info? Or would any competent antiviral program catch it? Is it a serious problem?

 

[Platypus]

Antivirus is terrible and actually a much more dangerous thing to have installed than not in most cases.

This is definitely possible but the potential for earnings is fairly limited so I doubt it's that widespread. Ransomware is more lucrative in the long run and less risk.

There are *tons* of Chinese Android devices out there that come pre-rooted with tons of malware on them though

 

[Red Squirrel]

Can't see why not. I would not really trust stuff like USB sticks from Ebay or Amazon (unless it's actually sold by Amazon themselves) for that reason. Would be fairly easy for something like a Raspberry PI with a preloaded OS to be loaded with spyware too. You plug it into your network and it starts scanning and infects everything. Basically any tech you buy you should trust the source.

Downside is even "trusted" corporations are getting into malware now and it's perfectly legal. Just look at all the data Facebook and Google collects from you and how they do it. It's crooked as hell, yet it's legal. Some TVs also listen to your conversations and sends the text to their servers. There's tons of money in this type of spyware so they can send targeted ads. Windows 10 basically IS spyware. it's free for a reason, you are the product. I would consider this type of thing just as bad as traditional viruses but virus scanners won't pick it up.

 

[Homerboy]

Downside is even "trusted" corporations are getting into malware now and it's perfectly legal. Just look at all the data Facebook and Google collects from you and how they do it. It's crooked as hell, yet it's legal. Some TVs also listen to your conversations and sends the text to their servers. There's tons of money in this type of spyware so they can send targeted ads. Windows 10 basically IS spyware. it's free for a reason, you are the product. I would consider this type of thing just as bad as traditional viruses but virus scanners won't pick it up.

LOL what? It's not "crooked as hell" it's part of their T&Cs. You sign up for the FREE service and that is the price you pay. It is in NO WAY "malware" as you stated.

 

[Pantoot]

Worry less about criminal groups; worry more about state actors.

 

[renz20003]

something I have wondered, have there been cases of criminal groups selling used laptops and smartphones with some phishing malware preloaded to steal personal info? Or would any competent antiviral program catch it? Is it a serious problem?

Wanna buy a laptop?

 

[Red Squirrel]

LOL what? It's not "crooked as hell" it's part of their T&Cs. You sign up for the FREE service and that is the price you pay. It is in NO WAY "malware" as you stated.

So you're ok with your every move online and offline being tracked by these companies? Well I'm not. You don't really "sign up" for that. Nobody reads those 2,000 page TOSes, and even if you don't use their services they still have ways to track your every move and create a shadow profile of you. It's really sad that it seems people are actually ok with this kind of stuff.

 

[Elixer]

Antivirus is terrible and actually a much more dangerous thing to have installed than not in most cases.

This is definitely possible but the potential for earnings is fairly limited so I doubt it's that widespread. Ransomware is more lucrative in the long run and less risk.

There are *tons* of Chinese Android devices out there that come pre-rooted with tons of malware on them though

It isn't just Chinese Android devices...
The bigger problem is, that there are millions of devices out there that have *known* vulnerabilities, and the OEM refuses to fix them.
Some can't be fixed either, since the OS is on a ROM.

Buyer beware.

 

[BrainEater]

The answer is yes.
I see someone covered the laptop angle ;
I have some used rooted phones for sale.

 

[Imp]

Wasn't there a report or two about the Chinese doing that... and the NSA?

Oh no, I've said too much. Whatever, you know where I live, drop by anytime.

 

[Spacehead]

No need to buy used stuff from criminals to get malware. Buy something new from a reputable company.

Superfish come to mind.

 

[AznAnarchy99]

So you're ok with your every move online and offline being tracked by these companies? Well I'm not. You don't really "sign up" for that. Nobody reads those 2,000 page TOSes, and even if you don't use their services they still have ways to track your every move and create a shadow profile of you. It's really sad that it seems people are actually ok with this kind of stuff.

https://www.youtube.com/watch?v=qslcnw-9KbI

 

[bononos]

Antivirus is terrible and actually a much more dangerous thing to have installed than not in most cases.

This is definitely possible but the potential for earnings is fairly limited so I doubt it's that widespread. Ransomware is more lucrative in the long run and less risk.
There are *tons* of Chinese Android devices out there that come pre-rooted with tons of malware on them though

Why is AV so "terrible" and "much more dangerous" if they are installed?

 

[bononos]

something I have wondered, have there been cases of criminal groups selling used laptops and smartphones with some phishing malware preloaded to steal personal info? Or would any competent antiviral program catch it? Is it a serious problem?

I don't think an AV app is able to detect malware/spyware embedded as a system app and firmware, at least not as easily as the more conventional malware.

 

[Rubycon]

Yes it's possible and yes they do.

 

[Platypus]

Why is AV so "terrible" and "much more dangerous" if they are installed?

Many reasons. For one, they run privileged and open and scan files in that context. They literally unpack/parse untrusted binaries and run in a privileged context... tons of memory corruption bugs are in these products due to the various native code utilities they employ to investigate files on your system. This means you have essentially remote code execution bugs on your system which would not exist if you did not use that software.

Another massive reason is how some of them examine web traffic on your system, opening up once again unnecessary attack surface on your host. In order to inspect encrypted data, connections are man in the middled by a certificate authority they install on your system to proxy this traffic. These poor implementations have been compromised again just recently, impacting your ability to safely use TLS.

There have been trivial exploits in these products for years and generally in my opinion this software is a bunch of snake oil and trivial to bypass. Yes it does work for some situatious, but I would never put this kind of software on literally anything that contained data I cared about personally.

 

[GagHalfrunt]

Of course it's possible, look how many computers were sold with Windows ME installed.

 

[Platypus]

It isn't just Chinese Android devices...
The bigger problem is, that there are millions of devices out there that have *known* vulnerabilities, and the OEM refuses to fix them.
Some can't be fixed either, since the OS is on a ROM.

Buyer beware.

True enough, but I buy a lot of random phones from this part of the world and most of them are so ridiculously compromised.

Most everything except the first stage bootloader in many cases can be replaced remotely on mobile devices.. so 'un-updatable' is the very small exception, not the rule, but you are correct that many of them receive minimal or no patching at all in their lifespan. The problems run deep with all involved parties. I could talk your ear off about why

 

[Red Squirrel]

No need to buy used stuff from criminals to get malware. Buy something new from a reputable company.

Superfish come to mind.

Oh right I forgot about that one. I have a feeling this is going to get more common too. Government will pay companies good money to do it. And pay AV companies even more so it does not get detected.

 

[bononos]

Many reasons. For one, they run privileged and open and scan files in that context. They literally unpack/parse untrusted binaries and run in a privileged context... tons of memory corruption bugs are in these products due to the various native code utilities they employ to investigate files on your system. This means you have essentially remote code execution bugs on your system which would not exist if you did not use that software.

Another massive reason is how some of them examine web traffic on your system, opening up once again unnecessary attack surface on your host. In order to inspect encrypted data, connections are man in the middled by a certificate authority they install on your system to proxy this traffic. These poor implementations have been compromised again just recently, impacting your ability to safely use TLS.

There have been trivial exploits in these products for years and generally in my opinion this software is a bunch of snake oil and trivial to bypass. Yes it does work for some situatious, but I would never put this kind of software on literally anything that contained data I cared about personally.

Then what is the thing to do? Is Microsoft's built in defender also another attack vector?

If AVs are that vulnerable and useless then Koret who brought this problem to light a few years ago would be advocating that ordinary end users should uninstall their AV wouldn't he? And he still thinks that smb's are 'mostly safe'. So perhaps its still not time to junk AVs/firewalls/HIPs yet.
https://sector.ca/how-safe-is-your-antivirus-software-from-attack/

 

[Red Squirrel]

The problem with AV is that it relies on definitions, ex: someone at some point had to analyze what the virus does. To me this is a poor security model because it is reactive (lot of people need to get infected) and not proactive. Software in general has terrible security these days though which does not help, just look at web browsers and all the native scripting they can do now. You can pretty much just land on a certain website and it will compromise your whole machine. This should not be possible. Or the fact that PDFs and other formats that have zero reason to even have ability to execute code, can actually be infected. Whoever thought it was a good idea to put scripting capabilities in documents/office programs is an idiot. Not only from a security perspective but from a support one. I used to hate running into crap like that when I was in IT. Some secretary decides to code something, and then when it breaks, it's suddenly IT's responsibility. Office workers should not be writing code.

 

[Elixer]

True enough, but I buy a lot of random phones from this part of the world and most of them are so ridiculously compromised.

Most everything except the first stage bootloader in many cases can be replaced remotely on mobile devices.. so 'un-updatable' is the very small exception, not the rule, but you are correct that many of them receive minimal or no patching at all in their lifespan. The problems run deep with all involved parties. I could talk your ear off about why

Where does the majority of the fault belong with?
Is it Google for not enforcing sane update polices?
OEMs for not caring?
Is it the "everyday" user being so ill informed about vulnerabilities?

I also think this is a PR problem in that, people throw a hissy fit because of windows 10 "spying", but turn a blind eye with their phones because they are under the false impression that it don't spy on them, when it does more actual spying than anything windows 10 does.

 

[XavierMace]

So you're ok with your every move online and offline being tracked by these companies? Well I'm not. You don't really "sign up" for that. Nobody reads those 2,000 page TOSes, and even if you don't use their services they still have ways to track your every move and create a shadow profile of you. It's really sad that it seems people are actually ok with this kind of stuff.

LOL. Did you even read what you just said? You not reading the ToS doesn't change the fact that, yes, you did sign up for it. Not once have I turned on my computer or phone and had it randomly go to Facebook and create an account for me on it's own. Same goes for Windows. Either through your action or inaction you let your computer have Windows on it and at some point you accepted the ToS.

I roll my eyes every time I see people marvel that their phone is smart enough to automatically create calendar events for them based off emails they received with flight confirmations and what not, then a week later complain about things spying on them. How exactly did you think it knew to create a calendar event? Magic? Ditto for devices with voice commands.

 

[JTsyo]

There were stories of thumb drives from China having malware in them.

 

[Linflas]

So you're ok with your every move online and offline being tracked by these companies? Well I'm not. You don't really "sign up" for that. Nobody reads those 2,000 page TOSes, and even if you don't use their services they still have ways to track your every move and create a shadow profile of you. It's really sad that it seems people are actually ok with this kind of stuff.

Unless some armed thug employed by Facebook or Google walked into your house and forced you at gunpoint to sign up for those services you have nothing to whine about.