I mentioned various laptop/touchpad software in my older posts in this series (Synaptics, Alps). I recently came across yet another production from the Alps which is installed on some of the Toshiba laptops. Browsing through the available options of the Alps Pointing-device Driver software I discovered two potential exotic persistence locations which probably will never be abused, but are still worth mentioning – for completeness, and because the software is somehow vintage and hilarious at the same time.
First, the vintage part. Alps offers a tray-icon based Easy Launcher. I think the software was designed really long time ago, way before Windows XP and 7 existed (let alone newer versions) and at that time it was probably a nice extension to have. In today’s Window’s user interface world there are so many better ways of achieving the same goal that it is really funny to see an archaic-looking Easy Launcher at work (let alone being installed on laptop from 2015; touche Toshiba).
Let’s see:
- To launch the Easy launcher, we need to click the Touchpad icon in the tray icon (notification) area
- We will see the following user interface:
- We then need to click the Easy Launcher which shows us… an old-school menu
- Selecting Specified Files will show the available options, including one item which I defined for demonstration purposes – a menu element that launches Calculator
All the data that Easy Launcher shows is taken from the following registry location:
as seen below:
where:
- C01 = A command being executed by the menu item #1
- I01 – A path to a file that the icon shown by Easy launcher will be taken from
- T01 – A title, as seen in the Easy Launcher menu
It is pretty obvious that we can modify the C01 entry (and other, relevant Cxx entries) in the Registry to point to some man-in-the-middle malicious executable that will execute calculator (in our case) when launched, or we can simply hijack the whole entry.
For example: changing C01 to point to C:\Windows\System32\notepad.exe will launch Notepad anytime Calc is selected from the menu. Interestingly, since it is the I01 entry that holds an information about the source of the icon presented on UI, there will be no visible clue that the entry now points to Notepad.
Such malicious hijacking effort certainly won’t fool an experienced power-user of the Easy Launcher who will be able to swiftly discover the modifications by exploring the modified settings as shown below:
The second best exotic persistence mechanism I am going to describe is like the second best exotic Marigold Hotel – it is certainly promising, but to deliver, will require a lot of effort; and this time not from the attacker, but from the attackee. This is the hilarious bit.
There is a mysterious gesture function that Alps touchpad offers called 3-Fingers Press which relies on a simultaneous caress delivered to the touchpad with a power of 3, precisely synchronized fingers. The gesture is so subtle and refined that any threat actor considering this maneuver as a way to persist on the targeted system is definitely the Sun Tzu of all APT actors, both the real ones and those imagined. Despite many efforts, boot camps and 1000 hours on the touchpad simulator, I yet have to accomplish the mission of mastering this unique fingering stance – and for that reason (and one more reason mentioned below) I name this APT persistence mechanism the self-touch of death.
On a technical note, the secret setting enabling the magic gesture is hidden in Advanced options:
There, one can enter the Settings dialog box and – lo and behold – add multiple executables in one go:
In an attempt to understand the logic behind the design of this feature, I came up with a hypothesis that I cannot unfortunately share on a public forum. The ability to run multiple executables with a single stroke is certainly a stroke of genius. And as such, a perfect reason to call it the self-touch of death.
Last, but not least, the settings that manage this feature are stored in the following location:
- HKEY_CURRENT_USER\Software\Alps\Apoint\Mouse
Due to a unique nature of this persistence mechanism and APT actors potentially hidden behind it I do not recommend developing regripper plug-in for it.
