full-disclosure - Backdoor in RelevantKnowledge adware (What are we fighting for?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1011472645.20060530142543@SECURITY.NNOV.RU>
Date: Tue May 30 11:25:53 2006
From: 3APA3A at SECURITY.NNOV.RU (3APA3A)
Subject: Backdoor in RelevantKnowledge adware (What are we
	fighting for?)

Authors:         YAG KOHHA (skyhole@...il.com), Lame
Title:           Backdoor in RelevantKnowledge adware (What are we fighting for?)
Vendor:          TMRG, Inc.

Description:

RelevantKnowledge  is  an  adware  distributed  with different shareware
projects, e.g. Artisian Burner.

RelevantKnowledge   was   found  to  contain  backdoor  proxy  component
rlvknlg.exe   (Marketscore  OSSProxy),  which  is  configured  to  allow
incoming  network  connections  on TCP/8254, probably acts as open proxy
and  also performs keylogging and monitoring for active windows content.
Component can not be disabled by user.

Details (by YAG KOHHA, Lame):

Recently I download freeware CD burner software to create some absolutely legal copies
from ISO image. Of cause where is adware in installer which promise to "boost your
internet Connection" and "free coupons". 
After I finished my works I uninstall burner and adware via add/remove programs and reboot
the computer. After reboot I check Windows Firewall rules. In exception tab I found
RelevantKnowledge application. I map'ed my host and found strange HTTP server on port 8254
which answers as OSSProxy. I check netstat and found that this port used by
%windir%\system32\rlvknlg.exe process which also referred in
Software\Mircosoft\Windows\CurrentVersion\Run\ key. I check this file and found that this
programs hooks keyboard, mouse, current window and post info to the
http://www.relevantknowledge.com/upgraderesult.aspx site via locally installed proxy. I
check this site and found that "privacy procedures are regularly audited and certified by
the nationally-recognized firm, Ernst & Young, who assure that we conform with the
international trust services and privacy principles developed and managed by the American
Institute of Certified Public Accountants"
(http://www.relevantknowledge.com/RKPrivacy.aspx).
So guys, may be I miss something. If I see software which doesn't get removed via Add/Remove
Programs,  breaks  my firewall settings, hook my keyboard and mouse, and has remote
management capabilities, I call it Remote Access Trojan. What should I do to be "conform
with the international trust Services" and Ernst & Young say: "This is good code, Joe,
well done!" when I write new all-in-one client for my botnet? Or this is part of anti
piracy program? And MPAA want to know which films I burn on DVD? Or this is Uncle Sam's
hand? I don't understand. 

YAG KOHHA, Lame

File with binary and disassembly can be found here:
http://www.secyrity.nnov.ru/files/ossproxybd.zip
Archive password is "backdoor".

-- 
/3APA3A
http://www.security.nnov.ru/