Subscribe to RSS feeds

Archive for June 4th, 2007


Jun4
by Jasper Pimentel (Advanced Threats Researcher)





TI-89_L.jpg The TI-89 series of graphical calculators being produced by Texas Instruments is considered to have a high degree of functionality, sporting advanced mathematical software and programmable features plus connectivity to your PC. In essence, the TI-89 is a small computer that is capable of running programs. In the security industry, we already know what that implies. If it’s capable of running software, then it can also be an execution point for malware.

Recently a proof of concept virus for the TI-89 calculator has been discovered. The virus is a parasitic infector and it uses an entry point obscuring technique to mask its presence in an infected file. The virus is executed whenever an infected file is run and upon gaining control, it hooks a particular function that allows it to be triggered later on when that specific function is called. The virus is known to clear the screen and display a the string “t89.GAARA”. In general, this TI-89 calculator virus behaves in the same way as the old DOS viruses of the past, which is not surprising because the TI-89’s “operating system” is built pretty much the same way as DOS was: granting full functionality to programs but very minimal security.

Security-conscious users need not be alarmed. The virus only works locally on individual calculators and does not possess any propagation methods. In order to spread, a file that is infected by the virus must be shared by a user, either inadvertently or deliberately. Still this malware is worth mentioning because it demonstrates to us that any electronic device with sufficient computing power and functionality can be utilized as an execution vector for malware.

 
Posted in Uncategorized | TrackBacks (2) »


© Copyright 2008 Trend Micro Inc. All rights reserved. Legal Notice