Chinese Electronic Cigarettes Contain Malware Implanted in their Charger

IT security team has trouble identifying the attack vector

It has not been proven that smoking electronic cigarettes can give you cancer, but an indirect negative side-effect of the habit is that it can be leveraged for malware distribution.

All such products need to be charged in order to produce the vapors substituting the smoke of a real cigarette and its noxious elements. In many cases, this can be done by plugging it into to the computer, via an USB connection.

In a thread on Reddit, a user described how a data security breach at a large company was carried out by compromising the computer of an executive with malware transferred from an electronic cigarette made in China.

It appears that the malware was hard-coded in the device’s charger, giving the IT security guys trouble identifying it. No matter how many times they would clean the computer, it would still soon become infected again.

With up-to-date anti-malware protection and all usual methods of infection eliminated, the security experts were left with nothing but to investigate if any changes had occurred in the personal life of the executive that may lead to the root of the problem.



When they learned that he had quit smoking recently and used electronic cigarettes to make a smooth transition to a healthy life, the attack vector became obvious. Thus, no matter how many times the computer was cleaned, the moment the executive charged the compromised e-cigarette, it would connect to a remote server and download malicious software.

One way to protect from such a risk is to disable the data pins on the USB, thus making the cable charge-only and preventing any information from being exchanged between the devices it connects.

There are multiple solutions that can achieve this, one of them being USB Condom, a gadget that connects to the USB and makes the data pins ineffective.






Source