full-disclosure - [inbox] malware added in transit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1079627059.488.29.camel@localhost>
From: frank at knobbe.us (Frank Knobbe)
Subject: [inbox] malware added in transit

On Thu, 2004-03-18 at 10:03, Vincent.Maes@....com wrote:
> What about modifying/building an application such as dsniff on
> steroids.  Direct all the gateway traffic through a (dsniff)
> compromised system, then watch for the target traffic and perform a
> disassemble/reassemble with malware included.  You could fragment the
> target traffic to insert larger amounts of malware; and, by looking
> for the file-type headers, proceed to target specific content. As
> others have said, there is nothing available (in script kiddie
> format) to do this, yet.  But there are tools that can perform each of
> the require functions (WinPcap, ngrep, libpcap)  You just have to put
> them together.

I've seen tools that allow for insertion or replacement of files in a
FTP stream which you can use to "swap out" a file in transit.

However, the topic at hand doesn't lend itself to a quick switch or
simple addition of data at the end of the stream. If you want to add
malware to an SMTP session on the fly, you will have to intercept and
rewrite the email. A plain text email will have to be converted to a
MIME encapsulated email so that you can add the attachment on the fly.

Tricky, but very doable. It probably won't take long and you'll have an
adware/malware adding email proxy in the wild  :)

Cheers,
Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040318/3e7a96d8/attachment.bin