malware.htm: How to search the web, by fravia+ malwares

~ malware.htm ~

				Malwares

Version August 2005

MALWARES
(aka spyware, aka snoopers, aka softtrojans)

Essays to help unawares understand malwares

[Examples] [Our essays]

Nothing worse than malwares, as you will see... and seekers & reversers should take great care in order to avoid such sniffers and, at the same time, to detect, investigate (read: reverse engineer) and denounce them to the unawares...

 "But take care when you find your appz, 
  or you'll not gain your just rewardz, 
  your quest will all have been in vain, 
  and you will have to start again"

(Ancient websearchers' rhime)

A "classical" must-read is ["The Anatomy of File Download Spyware"] by Steve Gibson

Check our important essays!

Malwares examples

If you want to read about some examples of Malwares (let's help the unawares understand with some famous examples) then search the web for Lotus 'secure encryption', 3com's 'debug' account, Id's Quake server backdoor (password="tms") and Borland's Interbase (ALL Interbase databases!) "politically/correct" hardcoded password... alternatively, malwares are so widespread that you may just run a 'strings' program like [strings] or [bintscan] on your binaries and see what it finds :-)
Btw, there's another advantage in running a strings program against your binaries: often enough the various command-line options (and many other options) are NOT documented properly. Hence running "strings" on a binary is the only way to discover how to run your program properly. When doing such operations on commercial software you will often see information that the programmers most probably would have preferred you NOT to see.

Another sniffing approach is to use a good [grep] program (i.e. one that does not chocke on windoze's swap files) in order to find specific strings (for instance inside the messy inferno of windows's subdirectories :-)

Various kinds of possible Malwares exploits

Hidden manipulation
Parameter tampering
Cookie poisoning
Stealth commanding
Forceful browsing
Backdoors and debug options
Third-party misconfiguration
Cross-site scripting
Buffer overflow
Published vulnerabilities

De congenito windozianicus scumware

If you are using a windoze system, it could be a good idea to install a good firewall, like sygate personal firewall pro (version 5.1 is easy to find on the web). Note, however, that if you are using MSIE as a browser, you wont be able to avoid some 'congenit' spywares, built inside windoze itself, like the start/search function in windows xp, which connects on port 80 to sa.windows.com (207.46.248.249) in order to deliver to microsoft's spyes your IP and what you are searching for on your own harddisk.
The start/search function uses in fact windows explorer itself for its spying activities, and if you have 'allowed' it to connect to the web as a browser, the firewall wont block it anymore.
Morale: DO NOT use Microsoft explorer, never, use a good browser instead.

De congenito googlianicus toolbare (February 2005)

Google has released a trial tool which is concerning because it directs people to pre-selected commercial websites.
The AutoLink "feature" comes with Google's toolbar and provides links in a webpage to Amazon.com if it finds a book's ISBN number on the site.
It also links to Google's map service, if there is an address, or to car firm Carfax, if there is a licence plate.
Google's dominant position in the search engine market place means it is giving a competitive edge to firms like Amazon.
AutoLink works by creating a link to a website based on information contained in a webpage, even if there is no link specified and whether or not the publisher of the page has given permission.
It means, for instance, that online libraries that list ISBN book numbers are directing users to Amazon.com whether they like it or not.

Our Essays

They should thank GOD that there'are crackers and reversers around... (A+heist)

[boobytra.htm]
Software that hiddendly corrupts, checks or modifies your data
by db-cooper, +Tsehp, ArthaXerXes
March 2000
[trojashop.htm]:
Trojanized Commercial Shopping Cart
'This program -deliberately- allows arbitrary commands to be executed on the victim server'
by joeATblarg.net
April 2000
[teport_2.htm]: Teleport Pro 1.29, malware galore
by Faulpelz
May 2000
[realmal1.htm]: RealNetwork's latest heavily-promoted goodie by Lauren Weinstein, part of the [malware.htm] (Mal behaving software) section
May 2000
[for_lemu.htm]: A 32-digit hexadecimal number in your URL ("URLs that bite", a first stab) by +Forseti, part of the [malware.htm] (Mal behaving software) section
October 2000
[noos_tel.htm]: Delving deeper into Teleport Pro 1.29 by Noos, part of the [malware.htm], section
October 2000
[teport_3.htm]: Teleport Pro V1.29 (Build 1107) (Delving deeper into Teleport Pro 1.29) by Faulpelz, part of the [malware.htm], section
January 2001
[cope_wot.htm]: Reversing to Enhance and Expand (754 engines into the pot)
by WayOutThere, Advanced essay, part of the [bots], and of the [essays] sections.
April 2001
[carefula.htm]: Careful With That Axe Eugine! (Exploitable Standards in the mad rush to jump on the 'file sharing' bandwagon) by Finn61, part of the [malware.htm], section
October 2001
[ab4_aure.htm]: Some fun with Aureate (Faking DLLs for our own good) by garph0, part of the [malware.htm], section
October 2001
[rea_kane.htm]: Eliminating the evil real player
by Kane, November 2002, part of the [essays], and of the [malware] sections. (it was about time that some reverser would 'solve' the problems caused by the spyware known as Real player. Here is the solution. Read and enjoy :-)
[scumware.htm]: Scumware, Spyware, Adware, Spamware, Malware, sneakware and all sorts of other 'wares...
by shinohara, January 2004 part of the malware.htm
section
[weatherbug.htm]: Weatherbug's nasty habits (Investigating spyware)
by shinohara, November 2004, part of the malware.htm section.
ritz_google_anti_snoop.htm
by ritz, August 2005
"i think this is sneaky and not very nice from mr google. also i wonder since *when* have they been doing this? i'm quite sure i looked at googles SERPs some years ago and it wasn't there"
Part of the malware section.

Far from being finished... and still awaiting +Forseti's essays...

Back to advanced