RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior

From: ashton (ashton_at_joltmedia.com)
Date: 12/18/03

  • Next message: Paul Craig - Pimp Industries: "Subscribe Me Pro/Enterprise - Remote Code Execution via Backticked Perl Variable Injection." 
    To: <Aaron_Yemm@NAI.com>, <bugtraq@securityfocus.com>
Date: Thu, 18 Dec 2003 06:59:20 -0500

    As far as I know a skin in KaZaA is just xml and images, nothing harmful I
    could think of there.

    -----Original Message-----
    From: Aaron_Yemm@NAI.com [mailto:Aaron_Yemm@NAI.com]
    Sent: Wednesday, December 17, 2003 1:50 PM
    To: ashton@joltmedia.com; bugtraq@securityfocus.com
    Subject: RE: Edonkey/Overnet Plugins capable of Virus/Worm behavior

    I do believe that several kazaa virus/plugins are engineered in the same
    fashion and advertised through the kazaa network as "skins" or "theme
    pack" plugins.

    -Aaron

    -----Original Message-----
    From: Julian Ashton [mailto:ashton@joltmedia.com]
    Sent: Tuesday, December 16, 2003 9:00 PM
    To: bugtraq@securityfocus.com
    Subject: Edonkey/Overnet Plugins capable of Virus/Worm behavior

    I have concearns about the Plugin arhcitechture and the power given to
    all the devs out there and possible end user harm. I am writing the
    FastTrack plugin for Edonkey/Overnet and during this process have
    realized that this is by far the worst and most insecure plugin
    architechture I have ever seen in my life. Here is a short list of what
    they have given 1.14 million users(currently online) to have done on
    their machine if they are to download an "bad" plugin.

    1. Local code execution

    2. Unlimited disk access

    3. Unlimited sockets access

    4. Code propogation through the client over the networks

    5. Basically anything you can imagine in the world that can be done to a
    windows os machine.

    Why?

    Good question, I have been working on plugin systems suchs as giFT and
    Windows Media for quite a while and while they can do some neat things,
    this kind of behavoir cannot happen because of the way they were
    architechted. When I think of "plugins" I think of 1. An sdk. 2. Methods
    that you create that the "client" listens for. 3. All code in the plugin
    is sent to the "client" not the OS level. 4. Mainly COM (this plugin
    uses full use of C++/MFC in a DLL)

    Where did MetaMachine(Edonkey/Overnet) mess up?

    All code in the plugins CAN route to the "client" but they mainly pipe
    to the windows subsystem thus enabling for anything to be written and
    can then pipe back into the application on a low level code basis and
    take control. Besides these factors what about code signing or some sort
    of key schema at best to keep these plugins mostly legit?

    What could happen if malicious plugin is made available?

    I leave it up to your imagination. ;)

    What is the worst thing that could be of possibility?

    Someone could write a legit plugin like "Gnutella" for example. It could
    work for months to come and on a set date they could dump thier virus
    code from a embedded resource and let it take control of which could be
    at that point 2 Million "clients", it could be one of the largest DDoS
    we could ever see or even worse, it could spout out like MSBlast or
    worse...

    I have created some code as seen here(like i said it can really do
    anything you imagine):

    /* This would be the main call done by the "client"

     * so the best place for our test */

    void CProtocolplugin::start()

    {

            

            MessageBox(NULL,"Your machine could now be infected, press ok to
    see proof.","OPPS!",MB_OK | MB_ICONWARNING);

            CString szFileName = "Plugins//virus.exe.txt";

            CFile file( szFileName, CFile::modeCreate | CFile::modeWrite );

            CString str = _T("This could have been a virus! - ashton");

            file.Write( str, (str.GetLength()+1) * sizeof( TCHAR ) );

            file.Close();

            ShellExecute(NULL, "explore", "Plugins", NULL, NULL,
    SW_MAXIMIZE);

            
    ShellExecute(NULL,"open","notepad.exe","Plugins//virus.exe.txt","",SW_SH
    OW );

            MessageBox(NULL,"I just wrote a text file to your plugins dir,
    opened explorer to it and\nopened the .txt file, image if I was a virus
    writer. :-)","OPPS!",MB_OK | MB_ICONWARNING);

            

    }

    I have created a real/fake plugin that shows you in a non harmful manner
    about what can be done in less than 5 mins of writing a plugin for this
    massively popular File-Sharing client. You may get it here:
    http://64.78.56.209/Fake_FastTrack.zip Just unzip into the Plugins
    folder and run Edonkey/Overnet to see it in action then just quit and
    delete it when done.

    -Julian Ashton

  • Next message: Paul Craig - Pimp Industries: "Subscribe Me Pro/Enterprise - Remote Code Execution via Backticked Perl Variable Injection."

    Relevant Pages

    • Re: Putting TAO/examples/simple/chat-client into a DLL?
      ... I want to write a plugin for collaborative modelling ... ++ and modified my MSVC project (the client part) to compile into a DLL. ... ++ there is no call to CORBA in it. ... ++ Since I have no console parameters I tried both ways: ...
      (comp.object.corba)
    • Re: View DICOM (medical) images
      ... Yes, this would be client side software, sort of like a plugin. ... browsers understand, like JPG images. ... but how exactly would i find an ActiveX control to view the ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Separation of API and implementation
      ... I have an API defined in one plugin, ... interface X { ... Think about what the primary characteristic of all plugins is: it provides services that one can plug it into various client contexts. ... IOW, it isn't a plugin if any of these things is not true. ...
      (comp.object)
    • Global and file-static variables in static library
      ... The function RegisterPlugin() creates an entry in a map of strings to function pointers, which allows a factory function to create an instance of the plugin D1 from its name "D1". ... The key feature of the pattern is that the file D1.h is not #include'd anywhere except D1.cpp. ... Recently, however, using VC8, the client got it into his head to compile my code into a static library before linking it to his code. ... It seems that when a .obj file is embedded in a static library, and then linked with a client program such that the content of that .obj is apparently unused, the content of that .obj file is not contained in the image. ...
      (microsoft.public.vc.language)
    • Re: webapplication does not display tiff images
      ... >> plugin for IE. ... AlternaTiff is a client browser pluginto display tiff images in the ... This means that each client has to install this (or some ...
      (comp.lang.java.programmer)