full-disclosure - MSN Webcam / Chat Spoof

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: rms at computerbytesman.com (Richard M. Smith)
Subject: MSN Webcam / Chat Spoof

The other problem with Authenticode is that certifcates aren't
revokable.  Why doesn't IE go back to Thawte to see if the "Browser
Plugin" certificate is still valid?

Richard

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Daniel
Docekal
Sent: Monday, May 12, 2003 11:38 AM
To: 'Richard M. Smith'; full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

Sure Richard it is actually loader of dialer program itself - it even
updates itself any time it wants and it does anything it wants. And
there thousands of people who had this bad luck to "use" that kind of
software without properly realising what they are doing.

Concerning that certifitace - stop trusting things which cannot be
trusted. Would be any COmpany/Street text something you can trust? Would
it change any time that company relocates? 

It's problem of Microsoft who made this "authenticode" verification so
misguided and people that they even trust to that. Actually one should
not trust to anything that is not personally known to him...

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Richard M.
Smith
Sent: Monday, May 12, 2003 4:10 PM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

The downloaded ActiveX file can be found at this URL:
http://80.96.118.2/ac/mw/MSN_QTPieJess1.exe

I ran a strings on the file and the control is called:  TIBS Loader
module and the ProgID is LoaderCon.LoaderCon.  I can't find anything on
the Web about this particular ActiveX control, but it wouldn't surprise
me that it is part of some sort adult dialer scheme.  The control
appears to be more of a downloader program and not the adult dialer
itself.

My question:  Why can't an Authenticode certificate present the
following information to a user:

   - Company name
   - Street address
   - Phone number
   - Web site URL
   - Contact Email address
   - Company logo
   - Link to a product description page

All this information can be verified when a company applies for a
Authenticode signing tool.  The current scheme is just plain silly as
this MSN scam illustrates.  There is simply no way to verify where a
piece of software is really coming from.

Richard 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Daniel
Do?ekal
Sent: Monday, May 12, 2003 2:08 AM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

Browser Plugin is ADULT DIALER - it connects via modem to telephone
service and you pay your sexy adventure through your telephone bill. In
many cases, there are adult dialers committing fraud - they redirect
your dial-up internet connection to very expensive number without your
knowledge. 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Richard M.
Smith
Sent: Monday, May 12, 2003 3:40 AM
To: full-disclosure@...ts.netsys.com; secure@...rosoft.com
Subject: RE: [Full-Disclosure] MSN Webcam / Chat Spoof

You missed the good part.  If you actually go to the "MSN" Web site and
press the "Connect Now" button, the site tries to download some
questionable ActiveX control.  Not to worry however:

   Just press YES in the dialog box when it appears. This operation is
totally safe and certified by Microsoft Authenticode?

The control is signed by "Browser Plugin".  I guess Thawte will give
anyone an Authenticode certificate nowadays.  I wonder who "Browser
Plugin" really is?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030512/7b76dd25/attachment.html