lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1079627059.488.29.camel@localhost> From: frank at knobbe.us (Frank Knobbe) Subject: [inbox] malware added in transit On Thu, 2004-03-18 at 10:03, Vincent.Maes@....com wrote: > What about modifying/building an application such as dsniff on > steroids. Direct all the gateway traffic through a (dsniff) > compromised system, then watch for the target traffic and perform a > disassemble/reassemble with malware included. You could fragment the > target traffic to insert larger amounts of malware; and, by looking > for the file-type headers, proceed to target specific content. As > others have said, there is nothing available (in script kiddie > format) to do this, yet. But there are tools that can perform each of > the require functions (WinPcap, ngrep, libpcap) You just have to put > them together. I've seen tools that allow for insertion or replacement of files in a FTP stream which you can use to "swap out" a file in transit. However, the topic at hand doesn't lend itself to a quick switch or simple addition of data at the end of the stream. If you want to add malware to an SMTP session on the fly, you will have to intercept and rewrite the email. A plain text email will have to be converted to a MIME encapsulated email so that you can add the attachment on the fly. Tricky, but very doable. It probably won't take long and you'll have an adware/malware adding email proxy in the wild :) Cheers, Frank -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: This is a digitally signed message part Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040318/3e7a96d8/attachment.bin
Powered by blists - more mailing lists