Slashdot Mirror
Trojan Found in libpcap and tcpdump
msolnik writes "Members of The Houston Linux Users Group discovered that the newest sources of libpcap and tcpdump available from tcpdump.org were contaminated with trojan code. HLUG has notified the maintainers of tcpdump.org. See our reports here or here."
Who would have thought that TCPDUMP would have crap like that in it?
Trojan Found in libpcap and tcpdump
I swear, some of these source trees are worse than the canals of Venice.
I was just wondering how long these sources have been available with these many eyes making bugs shallow and so forth? I'm assuming it's less than 1 hour, because as I keep being told, everyone in the open source community checks all source code thoroughly before installing it, which is something that can't be done with closed source.
Easy. Same way it happens to OpenSSH, and the OpenBSD kernel (you know that current revisions of OpenBSD are trojaned all to hell, dont you?)... First you come up with the "killer exploit" this is known in our little community as "0day"... THEN, you exploit the tome of information,, be it openbsd.org, kernel.org, tcpdump.org etc.. and insert your code. You can prepare days in advance with your new version, so really, breaking the box is the only real hard part..
./hax0r-the-hell-out-of www.foo.com
/var/log/syslog
1. wget http://www.foo.com/useful-app.tar.gz
2. tar -xzf useful-app.tar.gz
3. vi something.c
4. tar -cf useful-app.tar.gz useful-app/
5. md5sum useful-app.tar.gz > useful-app.md5
6.
7. scp ~/useful-app.tar.gz
www.foo.com/useful-app.tar.gz
8. scp ~/useful-app.md5 www.foo.com/useful-app.md5
9. vi
10. ????
11. pr0fit.
or if you are openbsd, you bribe a developer for their commit access.. or you break the developers
box..
isn't hacking for world domination fun?
...wait...never mind.
Donate background CPU time to fight cancer.
I couldn't agree more, if those cheap-arsed hippies who write Linux would only pay up when there's a problem with their software like reputable commercial companies like Micros.. err, Oracl.. err actually, forget it.
Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
I thought the whole idea of the GPL was that you could take a program and modify it to your own needs so long as you release the source back to the community under the same license.
Sounds like that's what happened here!
well, I have not installed these sniffing proggies, so it should be okay.
Darn... apt-get even makes your box more secure than before even if you haven't actually installed the bad packages? This must be the Holy Grail! And it should be okay? Not only that you have not installed tcpdump and libpcap, what definitely makes it okay, you don't even trust apt-get to really solve your (non-existing) problem... Now I wanna join the apt-get cult... Where can I register?
I bet you recommend penicillin over other medicine even when you got no infection! Or do you use apt-get then as well? Doesn't make any difference anyway...
(For the record: I use Debian GNU/Linux among other stuff...)
And looking through his user profile, he's also a rocket scientist. Wow.
If you read the article more carefully, you will notice that the binaries aren't trojaned.
Phew, glad to hear that, I was worried the trojaned sources actually built trojaned binaries - glad you got that cleared up for us.
Try NetBSD... safe,straightforward,useful.
...as a rocket scientist I feel most compelled to answer& cid=4658776
d =4658433
i d=4658097
1 28&cid=2238414
i d=2207372
i d=2204471
i d=2204422
http://slashdot.org/comments.pl?sid=44937
...I run a successful London-based dot com
http://slashdot.org/comments.pl?sid=44933&ci
... As a lawyer myself, I can state that
http://slashdot.org/comments.pl?sid=44912&c
... I'm an avid open-source supporter
http://slashdot.org/comments.pl?sid=21
...I am an avid supported of the open-source movement [sounds familiar? that's because it is -ed]
http://slashdot.org/comments.pl?sid=20824&c
...I'm an avid supported of the open source movement [we know -ed]
http://slashdot.org/comments.pl?sid=20761&c
... I am a passionate supported of the open-source movement [geez -ed]
http://slashdot.org/comments.pl?sid=20760&c
This reminds me of this one time when I chatted this girl on IRC. Oh wait.....
I'm telling you, this is Microsoft's new tactic for attacking open source. Make people afraid of it, and they will run in terror.
Now - who has most to gain from a highly visible trojan that's in fact virtually useless - Microsoft.
No! It's John Ashcroft! This is just the first step towards the Brave New World Order, as correctly fortold on that ground-breaking show "The X-Files."
Before Chris Carter and David Duchovney were eliminated and replaced with robotic clones by the old CIA lackeys of George Bush Senior, that show was the only thing on television that really explained what was going on in the world. There was a brief attempt by the FOX network to continue feeding you important news about technology and politics, but the Lone Gunmen show was quickly eliminated by the evil forces...
Slashdot is jumping the shark. I'm just driving the boat.
Goddamn, just becuase they might be loaded with more trojans than you'll ever need, spying on all of your important works, please, please use a closed-source spell-checker, this OS one appears to be faulty.
Reading that text was just plain painful.
[Insert the obligatory joke about /. slashdotting this server too] :)
5. Get the source, audit it line by line, and then build it when you know it's safe.
;-) /me don't trust any code I don't write...guess I should get started on the kernel!
6. Don't bother downloading packages, write your own
Yeah, that girl on IRC was probably Jazzman.
Barclay family motto:
Aut agere aut mori.
(Either action or death.)