{"id":4126,"date":"2017-01-28T01:20:01","date_gmt":"2017-01-28T01:20:01","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4126"},"modified":"2017-01-28T01:20:01","modified_gmt":"2017-01-28T01:20:01","slug":"beyond-good-ol-run-key-part-58","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/01\/28\/beyond-good-ol-run-key-part-58\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 58"},"content":{"rendered":"<p>I stumbled upon this persistence mechanism by chance and its nature is similar to the many I have covered before &#8211; the preset applications that are executed when a certain event happens. This time I was checking the Bluetooth Stack applications on a laptop and discovered it could be easily configured to run arbitrary programs. We can assume that many other similar Bluetooth configuration utilities developed by other companies offer similar capabilities.<\/p>\n<p>I don&#8217;t know how many people use Bluetooth on their PC laptops nowadays, but as long as the Bluetooth stack is installed, radio is enabled and applications are installed &#8211; the specific events should trigger the execution of preset applications&#8230;<\/p>\n<p>There are at least two places I found where one could add persistent malware to the Bluetooth configuration settings.<\/p>\n<p>The first one is under the SMART tab in General Options:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4127 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt1.png\" width=\"480\" height=\"516\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt1.png 480w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt1-279x300.png 279w\" sizes=\"(max-width: 480px) 100vw, 480px\" \/><\/a>Despite efforts I didn&#8217;t manage to trigger it, but I don&#8217;t have many Bluetooth devices at hand. Perhaps someone will be able to run a QC on this one.<\/p>\n<p>The setting is located inside the Registry under the following location:<\/p>\n<ul>\n<li>HKCU\\Software\\Toshiba\\BluetoothStack\\<br \/>\nV1.0\\Mng\\IasStartAplPath= EXE Path<\/li>\n<\/ul>\n<p>The second, is not just one, but it&#8217;s actually a group of individual settings assigned to each connection &#8211; here is an example of properties of such one connection where I added the c:\\windows\\system32\\notepad.exe to execute anytime the connection is established:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4128 size-full\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt2.png\" width=\"336\" height=\"467\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt2.png 336w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt2-216x300.png 216w\" sizes=\"(max-width: 336px) 100vw, 336px\" \/><\/a>This one works for sure and it was easy to test it.<\/p>\n<p>The location of these settings is as follows:<\/p>\n<ul>\n<li>HKCU\\Software\\Toshiba\\BluetoothStack\\<br \/>\nV1.0\\EZC\\DATA\\1001\\SCORIGINAL<br \/>\nAPPEXECUTE=hex:01<br \/>\nAPPFILEPATHBYTECNT=dword:&lt;Path Length in bytes&gt;<br \/>\nAPPFILEPATH=hex:&lt;Path expressed as a sequence of hexadecimal numbers&gt;<br \/>\nAPPFILEPATH2=EXE Path represented as a string<br \/>\nPSM=dword:0000000f<br \/>\nSECURITY=dword:00000001<\/li>\n<\/ul>\n<p>The key DATA\\1001\\SCORIGINAL changes to DATA\\1002\\SCORIGINAL for the second connection and increases for subsequent connections. This is how it looks like inside the Registry:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt3.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4130\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt3-300x82.png\" width=\"501\" height=\"137\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt3-300x82.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt3-756x207.png 756w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/01\/bt3.png 757w\" sizes=\"(max-width: 501px) 100vw, 501px\" \/><\/a><\/p>\n<p>It&#8217;s pretty simple, but it&#8217;s also not very convincing &#8211; I don&#8217;t think we should expect a flood of malware using it. Still, worth documenting.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I stumbled upon this persistence mechanism by chance and its nature is similar to the many I have covered before &#8211; the preset applications that are executed when a certain event happens. This time I was checking the Bluetooth Stack &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/01\/28\/beyond-good-ol-run-key-part-58\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,35,15,19,46,9],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4126"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4126"}],"version-history":[{"count":2,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4126\/revisions"}],"predecessor-version":[{"id":4131,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4126\/revisions\/4131"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4126"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}