Double Whammy! Another Sony Case (And it's Not BioShock)（F-Secure : News from the Lab:）

Sonyの指紋認証USBスティックにrootkitまがいが入っているそうです。確かにこれ刺して起動するとNo system diskとか言われるなぁ。

We received a report that our F-Secure DeepGuard HIPS system was warning about a USB stick software driver. The USB stick in question has a built-in fingerprint reader. The case seemed unusual so we ordered a couple of USB sticks with fingerprint authentication. We installed the software on a test machine and were quite surprised to see that after installation our F-Secure BlackLight rootkit detector was reporting hidden files on the system.

USM-Fって機種らしいですけど、c:\windowsってディレクトリが存在するそうです。そしてそれをWindowsAPIからは消しているそうです。

The Sony MicroVault USM-F fingerprint reader software that comes with the USB stick installs a driver that is hiding a directory under "c:\windows\". So, when enumerating files and subdirectories in the Windows directory, the directory and files inside it are not visible through Windows API. If you know the name of the directory, it is e.g. possible to enter the hidden directory using Command Prompt and it is possible to create new hidden files. There are also ways to run files from this directory. Files in this directory are also hidden from some antivirus scanners (as with the Sony BMG DRM case)  depending on the techniques employed by the antivirus software. It is therefore technically possible for malware to use the hidden directory as a hiding place.

---