Subscribe to EDN

Energizer battery charger opens backdoor on unwary owners

March 9, 2010

If you can’t trust the Energizer Bunny, who can you trust?

Energizer BunnyThe Energizer DUO USB battery charger contains a backdoor that allows unauthorized remote system access. The United States Computer Emergency Response Team (US-CERT) warns that the installer for the Energizer DUO software places the file UsbCharger.dll in the application’s directory and Arucer.dll in the Windows system32 directory, and then – presto – the bad guys have a backdoor that allows unauthorized remote system access to your machine.

“An attacker is able to remotely control a system, including the ability to list directories, send and receive files, and execute programs. The backdoor operates with the privileges of the logged-on user.”

Here’s Symantec’s description of the Trojan discovery. Energizer has issued a statement acknowledging the issue.


Energizer Buo
From the point of view of a user it’s wise to always be wary before plugging in anything into a USB port – I’ve heard of several cases where <$100 picture frames come with malware installed, just waiting for you to plug it in and open the backdoor.

And from the POV of system designers, it’s a good idea to check out any USB drivers that you ship with your systems.

[Via Hacker News, via ZDNet.]

Posted by Margery Conner on March 9, 2010 | Comments (11)

March 24, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
CLS commented:

So when will we learn not to trust anything that comes from the likely country that produced this product? Time and again consumers have been burned by poor reliability, virus software, toxic materials, etc. Is the cost worth the risk and potential lawsuits not to mention a company reputation.


March 23, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
Datacomm commented:

The USB ports on your computer are subject to failure. I've had quite a few usb port failures on the systems I support. Why anyone would want to use their USB port for anything other than what you need it for is like using your computers open DVD drawer as a cup holder...Great idea until it breaks. There is no way that this 'feature' wasn't put in this software or firmware by accident or that it's in there simply to support advertised functions of the battery charger. Pacemaker sourced cellphone chargers anyone? It's the power source that's always handy as long as you are!


March 23, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
Brian OConnell commented:

1. LinuxMint - Unbuntu has had some serious security holes over the years, so do not feel too smug. A real stud-muffin would be using Slack, or better yet BSD. 2. Getting power from a USB port is NOT inherently safe from fire hazards. Many USB chargers are rated as Class III units, but some USB hubs and/or port allow well over Class 2 limits. 3. The USB standard states 500mA max current, but this is no test requirements to verify this limit when the assesment of the box is done to IEC 60950-1.


March 23, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
The Mad Zapper commented:

There is, of course, the Apple USB charger that comes with your iPhone or iPod Touch. That would be a much more appropriate device to charge batteries than the PCs USB port. But wait, if I connect this to my MacBook Pro, there isn't any issue either, since the UNIX OS that runs on the Mac is much smarter about what it will allow a port to do.


March 11, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
jimvandamme commented:

Nothing wrong with using a USB port for charging batteries or any peripheral that you can dream up. Just another handy power port when you can't find a convenient AC outlet. The driver malware problem has nothing to do with battery chargers or frivolous uses of the USB port; it could happen to any mouse, printer, or wireless dongle. (I'm not so worried right now, since I'm using LinuxMint.) When I get to work tomorrow, I'll take apart my mouse to make sure there isn't a microphone inside that's sending audio to China.


March 11, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
woodla commented:

The idea of monitoring the state of battery charge via your computer might have some possible merit, especially for us tech types. I suppose that really depends on the appearance and functionality of this particular app. That said, I agree with Mr. Ketel that it seems best to use a wall wart. I guess the maker thought they could save some $ by stealing power from the usb port. The mis-use of the intended purpose of this port is already so rampant. From cup warmers to hand massagers. I'm suspicious as well that the chinese maker or a rogue employee was responsible here.


March 11, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
William Ketel commented:

This is a good example of the unintended consequences of something that seemed like a good idea at the time. In the search for a universal power interconnect, as an alternative to the 49 different sizes of the more common style power connector, some fool adopted the USB connection as a source for 5 volts DC, except for when the connection is 3.3 VDC. The cheap and easy fix is to use one of the USB equipped small wall-wart supplies that has no capability of running any software. Better, yet, though, would be to use some other connector and a plain old wall wart and not even bother with the USB style connector.


March 11, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
bunny **** commented:

Why in the world is Energizer adding software to steal power for charging the batteries??!!


March 11, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
DLD commented:

@Skeptic: No, I ain't taken that bet.


March 10, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
John P. Guckel - Milwaukee, WI U.S.A. commented:

Let's expand on the thoughts of "Policebox". Besides all the gateways he described, the power cord is also a connection to the outside world. Maybe we should all be running our computers on battery, and only charge THEM through a simple power cord connected to an external, not computer connected, charger. The technology to transmit data over power lines already exists. Kind of think of it as DSL running in the "Silent" background of a normal "POTS" telephone line.


March 10, 2010
In response to: Energizer battery charger opens backdoor on unwary owners
Doubter commented:

WHY does a battery charger need a connection of any kind to a computer?

POST A COMMENT
Display Name
captcha

Before submitting this form, please type the characters displayed above. Note the letters are case sensitive:

Advertisement
Advertisement
Advertisement
About EDN   |   Site Map   |   Contact Us   |   Subscription   |   RSS
© 2011 UBM Electronics. All rights reserved.
Use of this Web site is subject to its Terms of Use | Privacy Policy

Please visit these other UBM Canon sites

UBM Canon | Design News | Test & Measurement World | Packaging Digest | EDN | Qmed | Pharmalive | Appliance Magazine | Plastics Today | Powder Bulk Solids | Canon Trade Shows