Some of the microSD cards that shipped with the first batch of Elecrow M9 handsets carried a piece of Windows malware. It was picked up at the factory during the step where the map data is written to the cards, and it travelled out on the cards themselves. If you have an M9 from that batch, this post is for you. If you do not, the tool is still worth knowing about.
What it is, and what it is not
It is an old style autorun worm. It only means anything to Windows. There is an autorun.inf file, a small executable with a random four letter name, and a shortcut file dropped into every folder on the card so that a curious double click runs the executable instead of opening the folder.
The important part: your radio cannot run it. The M9 and the T-Deck have no idea what a Windows executable is. The files just sit there taking up a few kilobytes. Nothing on the radio is infected, nothing is being sent anywhere, and the mesh is not affected.
The risk is to a Windows PC. Put the card in one with autorun still enabled, or double click one of those shortcut files, and it will do what it was written to do. Mac and Linux are not affected either.
On the M9 that is largely academic, because the card is embedded inside the unit rather than sitting in a slot on the outside. For most people it will never come out, and never go near a computer at all.
Plugging the radio into a PC with the USB lead does not expose it either. MeshOS presents a serial connection and nothing else, so the card is never offered to the computer as a drive. Windows never sees those files and cannot run them. Put plainly, the malware cannot travel from the radio to your PC down the USB lead. That is how MeshOS behaves. Other firmware may do things differently, so treat it as a MeshOS guarantee rather than a general one.
Now the radio can clean it itself
The obvious advice for a card you can actually get at is to put it in a computer and clean it there, but that means having a computer you trust, a card reader, and a bit of nerve. On the M9 it is not even an option. So the radio does it instead. MeshOS 1.7.4 added a Storage screen, and it is all on the device.
From the main menu, open Tools, then Storage.
Main menu, then Tools, then the green Storage icon.
The Storage screen opens with the card itself: what type it is, how big it is, and how much of it you have actually used. Underneath are the three things you can do with it.
Running the scan
Pick Scan for malware and leave it alone for a moment. It walks the whole card looking for the autorun file, the executables and the shortcut files that go with them. Large cards with a lot of map data take longer, and the screen tells you what it is doing rather than just sitting there.
If the card is clean you get told so plainly.
If it finds something, it lists what it found and offers to remove it. The clean up only touches the files it identified. Your MeshOS settings, your messages and your map tiles are left alone, so you are not trading one problem for another.
If you would rather start clean
There is also Format SD card on the same screen, which writes a fresh FAT32 file system. That is the belt and braces option and it does exactly what it says: everything goes, including your downloaded map tiles. It is there for people who would simply rather not wonder.
Getting the maps back afterwards is easy and does not need a computer. Turn WiFi on, open the map, and pan around the areas you care about. The radio downloads the tiles it needs straight onto the card as you go.
Update to 1.7.5 first
If you are on 1.7.4, update before you scan. The first version of the scanner found everything correctly but could not delete the shortcut files where the name was very long, so it left a handful behind and the result looked like the clean had failed. It had not, but 1.7.5 finishes the job properly and reports honestly. It is a two minute update from the configurator.
Short version
- Your radio was never at risk, and neither was the mesh.
- A Windows PC is the only thing that cares, so do not go putting the card in one until it is clean.
- Update to 1.7.5, then Tools, Storage, Scan for malware.
- If in doubt, format the card and let the maps download again.