Now cyber criminals use E-cigarettes to spread malware
Many health specialists may be pushing the chain smokers in the world for E-cigarettes over normal tobacco ones. The smokers may not be embracing E-cigarettes wholeheartedly but there is one group who does. Yes, cyber criminals have take a special liking to the E-cigarettes and now electronic cigarettes have become the latest vector for injecting malware.
How is E-cigarette being used
The E-cigarettes have to be charged over USB, either with a special custom cable, or by plugging the cigarette itself directly into a USB port.
The ones that come with the USB port charging are the one that are fast becoming a favourite threat vector for the cyber criminals. The malware is apparently hardcoded into the charger for these E-cigarettes and as soon as its hooked to a PC they start their malicious work. For one they are inconspicuous, who the hell would think that a puny E-cigarette might be carrying a malware. The second point is that the USB port allows the cyber criminals to physically access your device.
Vapourizer
The use of E-cigarette for injecting malware first surfaced on Reddit. A redditor, Jockrilla posted the below comment on Reddit and that started the things moving
I have a story I wanted to share about a data security breach at a large corporation. One particular executive had a malware infection on his computer from which the source could not be determined. The executive’s system was patched up to date, had antivirus and up to date anti-malware protection. Web logs were scoured and all attempts made to identify the source of the infection but to no avail. Finally after all traditional means of infection were covered; IT started looking into other possibilities. They finally asked the Executive, “Have there been any changes in your life recently”? The executive answer “Well yes, I quit smoking two weeks ago and switched to e-cigarettes”. And that was the answer they were looking for, the made in china e-cigarette had malware hard coded into the charger and when plugged into a computer’s USB port the malware phoned home and infected the system. Moral of the story is have you ever question the legitimacy of the $5 dollar EBay made in China USB item that you just plugged into your computer? Because you should, you damn well should. Sincerely, An IT guy
The post seemed to suggest that a large corporation was subjected to a data breach because one of the exec had started smoking E-cigarette or “vapourizer” which had a malware hard coded into the charger. When the charger was plugged into the exec’s system the malware infected it.
Plausible or fairy tale?
For the looks of it, the Redditors claim looks very plausible given the fact that just recently, a security researcher, Karsten Nohl had demonstrated the virtually unpatchable attack called BadUSB with its proof-of-concept. He had further stated that more than half the USB devices available in the market may be susceptible to the BadUSB attack.
Combining the two reports gives you a plausible explanation for the malware spreading through a E-cigarette. Dave Goss, of London’s Vape Emporium, says that vapourizers can remain safe by buying from respected manufacturers such as Aspire, KangerTech and Innokin, and by checking for “scratch checkers” on the box, which mark out authentic goods from counterfeits.
“Any electrical device that uses a USB charger could be targeted in this way, and just about every one of these electrical devices will come from China,” he adds.
It is suggested to those who use such kind of USB devices, to only charge USB devices through a wall adapter (they charge faster anyway). If you really need to charge through USB then you are advised to get what is called a “USB Condoms”, which will make sure that only power is drawn and no data is exchanged.
