lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1079627059.488.29.camel@localhost>
From: frank at knobbe.us (Frank Knobbe)
Subject: [inbox] malware added in transit

On Thu, 2004-03-18 at 10:03, Vincent.Maes@....com wrote:
> What about modifying/building an application such as dsniff on
> steroids.  Direct all the gateway traffic through a (dsniff)
> compromised system, then watch for the target traffic and perform a
> disassemble/reassemble with malware included.  You could fragment the
> target traffic to insert larger amounts of malware; and, by looking
> for the file-type headers, proceed to target specific content. As
> others have said, there is nothing available (in script kiddie
> format) to do this, yet.  But there are tools that can perform each of
> the require functions (WinPcap, ngrep, libpcap)  You just have to put
> them together.


I've seen tools that allow for insertion or replacement of files in a
FTP stream which you can use to "swap out" a file in transit.

However, the topic at hand doesn't lend itself to a quick switch or
simple addition of data at the end of the stream. If you want to add
malware to an SMTP session on the fly, you will have to intercept and
rewrite the email. A plain text email will have to be converted to a
MIME encapsulated email so that you can add the attachment on the fly.

Tricky, but very doable. It probably won't take long and you'll have an
adware/malware adding email proxy in the wild  :)

Cheers,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040318/3e7a96d8/attachment.bin

Powered by blists - more mailing lists