Re: Edonkey/Overnet Plugins capable of Virus/Worm behavior

From: Eric Anderson (anderson_at_cs.uoregon.edu)
Date: 12/17/03

  • Next message: SGI Security Coordinator: "SGI Advanced Linux Environment security update #7"
    Date: Wed, 17 Dec 2003 14:54:23 -0800
    To: Julian Ashton <ashton@joltmedia.com>
    
    
    

    I'm not familiar with the Edonkey/Overnet plug-in mechanism, so I'm a
    little bit unclear on what your concern is: Are you worried about
    malicious plug-ins doing destructive things to the systems on which they
    were (knowingly) installed, or that malicious code could propagate from
    infected systems to clean ones? Neither is good, but the second one
    would concern me a lot more than the first.

    Thus spake Julian Ashton (ashton@joltmedia.com):

    >
    >
    > I have concearns about the Plugin arhcitechture and the power given to all the devs out there and possible end user harm. I am writing the FastTrack plugin for Edonkey/Overnet and during this process have realized that this is by far the worst and most insecure plugin architechture I have ever seen in my life. Here is a short list of what they have given 1.14 million users(currently online) to have done on their machine if they are to download an "bad" plugin.
    >
    > 1. Local code execution
    > 2. Unlimited disk access
    > 3. Unlimited sockets access
    > 4. Code propogation through the client over the networks
    > 5. Basically anything you can imagine in the world that can be done to a windows os machine.
    >
    >
    > -Julian Ashton

    -- 
    Eric W. Anderson - anderson@cs.uoregon.edu
    University of Oregon Network Security Research Lab
    PGP fingerprints:
    D3C5 D6FF EDED 9F1F C36D 53A3 74B7 53A6 3C74 5F12
    9544 C724 CAF3 DC63 8CAB  5F30 68AE 5C63 B282 2D79
    
    



  • Next message: SGI Security Coordinator: "SGI Advanced Linux Environment security update #7"