Slashdot Mirror
Earthstation5 Responds to Malware Claims
"We at Earthstation5 are not perfect, but we acknowledge that Shaun Garriok might be and thank him for helping us root out bugs.
The problem with the Earthstation5 software that Shaun Garriok found truly exists; however, the sordid motives he attributes to Earthstation5 are incorrect. The following functions were put into Earthstation5 to allow automatic, remote upgrade of the Earthstation5 software.
These functions are:
- Reload Earthstation5
- Shutdown Earthstation5
- Delete a File
We have long been admirers of Shaun Garriok's ability to superbly investigate even a fully compiled program. We believe that he is capable of finding ANY sort of trojan, worm, or bug inside a compiled program. We are relieved that all he could find was these remote upgrade functions. He didn't find any bugs that send user data anywhere, no spyware, no adware, nothing, in fact, that gives away any personal information about the user using Earthstation5.
It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer, which he states in his exploit. If you want to delete files from your own computer, we feel you have the right to do that.
We are glad he found this bug and pointed it out. We completely removed the automatic software upgrade code because as it turns out automatic upgrade is no longer popular as it once was because it gives people an uneasy feeling and rightly so.
Since Shaun Garriok seems to be concerned about everyone's security, and is not on a personal quest for revenge, we would be grateful if he would download the latest Earthstation5 (version 1.1.31), and verify that we have truly removed the remote-update function which his exploit program accessed. We think his dedication to the good of all concerned would motivate him to do this. Anyone else who is concerned can do the same; download the latest Earthstation5 and test the exploit code against it.
-- Filehoover, Lead Programmer of ES5."
On the full-disclosure list. It seems that after ES5 found out people had discovered the malware contained in it. They decided to upload a new version which will probably have those functions taken out. I see this as a suspicious move and would be very hesitant to use any of their software myself.
If the tone of that statement wasn't so sarcastic and flippant I might feel that RandomNut may have jumped the gun, but ES5 isn't making any more friends by being immature and insulting.
I am very suspicious of the claim that REMOTE deletion of a file is required when updating the software.
To me, this sounds like damage control, not an honest representation of why that code was in their program. Until the company that makes Earthstation comes up with a plausible explanation for what that code was doing in their program, I will regard Earthstation software as suspect.
How do you not notice that being able to delete files remotely is a problem? Isn't that just about the most obvious thing ever?
"by hiding your ip address" they claim that this is not exploitable?
Somone scans a network of cables users, and sends them all the packet and command to delete boot.ini. How does 'hiding' your IP address help?
If they have the feature in for automatic updates (unsigned), then clearly they expect to be able to connect to it using, what else, an IP ADDRESS, "hidden" or not.
Hard to beleive they have 15 million folks on at the same time.
Before the usual Palestinian - Isreali flame war gets going, I would like to ask just one question:
Does anyone use Earthstation and how does it compare to the other p2p networks?
...and it does seem believable. Random_Nut's comments with the exploit paper were a too influenced by his personal opinion....
Anyway, ES5 has a *baaaad* name and this last exploit is by far not the only reason of it.
Their claims of having zillions of users online(ever tried to use it???Well, not *exactly* true.), the chat snippet about DoS-ing bittorent sites(What kind of looser would do that???). A couple of "spammers" posting on the "concurrent" p2p tools boards.....
To conclude... ES5 has never been an option for me, and even if their claims on absolute privacy are a nice dream, I prefer sticking to Klite and Bittorent experimental.
1. No sig. 2. ???? 3. Profit!!!
This guy wants a patch to a closed application and would not listen to any one about exploits as the don't want to pay the $50,000 they would give to anyone finding an exploit. This guy posted Shaun's home address in the ES5 forums and threatened his family life.
This is thier network admin doing this, would you trust him with your IP and thier fancy anonymous security? If they want to keep any standing, at a minimum they need to fire that guy as his comments.. well I just don't trust him and in most places threats like he made are illegal.
This is all very nice, but if you want to convince me that EarthStation V is safe, show me the code.
J'aime mieux les méchants que les imbéciles, parce qu'ils se reposent. -- Alexandre Dumas
...unless you can explain this.
Not that I'd trust that AC either, but be on your guard anyway.
“Wait for Hurd if you want something real” –Linus
I searched for "car bomb" and got over 800 results.
"It is seldom that liberty of any kind is lost all at once." -David Hume
The following functions were put into Earthstation5 to allow automatic, remote upgrade of the Earthstation5 software.
These functions are:
Reload Earthstation5
Shutdown Earthstation5
Delete a File
All of these functions are necessary to perform when upgrading software.
Hell no.
These guys should learn something about computer security. Funny that the same guys who're using a solution that screams "EXPLOIT ME" is developing some application that's supposed to be focused on extra security.
This is how to perform a teeny bit safer automatic upgrade:
- Server sends a packet containing a field that says it's an update packet, along with a version ID to update to, i.e. 110 for version 1.10 or whatever.
- Client receives packet and uses a partial client-side URL to the place where the new version can be downloaded. For example, the client could use the partial URL "http://www.es5.com/files/es", attach the received version ID (that is: "110") to the string, and finally the file extension, to form the URL "http://www.es5.com/files/es110.zip". The client then takes care of its shutdown, auto-install, and restart sequence.
Voila! Upgraded application without a RANDOM UNVERIFIED COMPUTER sending the CLIENT a message to DELETE something and it BLINDLY AGREES to. It's amazing that such poor programmers can even design something that compiles. Or are they hired by the RIAA to fool people into downloading their "new, cool and extra safe" application?
I wouldn't recommend anyone to download the DNS-faking "we-have-more-users-than-Kazaa" dudes' software.
Beware: In C++, your friends can see your privates!
It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer, which he states in his exploit.
There are some things money can't buy, for everything else, there's netstat -i
"It is seldom that liberty of any kind is lost all at once." -David Hume
Go read about COINTELPRO and then realize that EarthStation 5 is the MPAA/RIAA version.
It's a bit different - RPMs may delete files but don't sit and listen on an open socket accepting delete requests from a remote server somewhere. That's a whole 'nother kettel of calling the fish black!
A reasonable auto-upgrade would just have code for the client to delete itself and run the new install I'd think. Also just because ES5 hides IPs doesn't mean someone can't just scan to find people running it. If anyone can connect to you and delete any file, that's a little more than an auto-upgrade feature.
..they have such a corny, geekified name. I mean doesn't Earth Station 5 sound like some lame sci-fi dream of a little geek who doesn't get out much? :)
As a rock-in-roll Physicist once said, No matter where you go, there you are.
Unfortunately, sir, you are a leech if you do that.
I am not trying to flame, but that's what the RIAA is trying to do: Make people afraid to share. If that happens, then the networks will die themselves. The RIAA doesn't give a flying fuck about downloaders, the same way cops don't really care about petty drug users. They both know that you must cut off supply.
This is the best reason I have found yet to delete all P2P applications off my system and never install one again.
Sheesh. Talk about inspiring confidence.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
Or use an open source client to connect to half a dozen p2p networks ( edonkey, overnet, bittorrent, gnutella, gnutella2, fasttrack, soulseek, direct-connect, and opennap)...
"The number of Unix installations has grown to ten, with more expected." (Unix Programmer's Manual, 2nd ed.; june 1972)
Yeh, I know that there are a lot people out there that take pride in the programs and everything, obviously Random_Nut liking his own K-Lite K++ a bit ;) But, the point was that these claims were not false, the lead programmer even admitted to them.
;) (www.shareaza.com)
Whether or not these were implemented for remote upgrading wasn't the point, Random_Nut was showing it as a vulnerability that could be exploited in an already 'shady' program. I will admit, that I haven't used ES5 though, because I simply believe it is a load of bs, 15 million users, when KaZaA, the most downloaded program (www.downloads.com) has had a PEAK of 6 million, someone is lying.
KaZaA though is in its dying days, I no longer use it due to all the fake or corrupted files, its annoying when you have to download fifty different songs just to get one that works, which is why I started using Shareaza (yes, I am a fanboy, thank you) because of the higher quality and the support of four different P2P networks, plus its just cool
Thats my little fanboy part, but, the point was that while they may have been claims, they weren't false claims, the code was present, which made the program, not so high on many people's download lists.
Automatic update my ass. No way was this a mistake, if the program needs to delete files (be it for an upgrade or other reason) it should do it itself when the new program is run and not when a remote server instructs it to by sending a suitably encoded packet (out of curiosity, how does this remote server know when to delete the file for an upgrade, so to speak, or where if the IP is truly hidden?)
Suggestion: Allow the virtual OS read-only access to your media library (presumably on the real OS). This will let your file-sharing apps share your files with no risk of affecting your system.
Vista:XPSP2::ME:98SE
These functions are: 1. Reload Earthstation5 2. Shutdown Earthstation5 3. Delete a File All of these functions are necessary to perform when upgrading software. You dont need "delete", you can just overwrite pre-existing files to upgrade.
People don't exist to serve systems, systems exist to serve people.
Overwrite the file, install a new file and ignore the old files, but why delete?
People don't exist to serve systems, systems exist to serve people.
The original client can most certainly delete itself, including all DLLs and so forth, with no help from the "new" version. It may have to unload and run a temp process so its files aren't in use, but that's a common procedure. Most auto-update are in fact initiated from the client, not the server. Usually something like
1) client looks for new version
2) client downloads new version
3) client check digital signature of download
4) client runs temp program
5) temp program uninstalls old client and installs new.
It's also possible the old client may just run the install for the new one (and let the new one run the old one's uninstaller), but in any case everything's under the old client's control as much as possible. Never does the remote server tell it what to delete.
I mean, I programmed this last month a test tool application on a LAN network, and frankly I *DO NOT* need to have a delete file command in the client. I mean,the client pretty well know which files it has to update (it is included in the update message) and it launch an updater application in background and stop itself so as to allow the files to be deleted/copied.
This is one solution, and I am pretty sure bunch of people here can come with others. But having a delete command is certainly a loosy way to do that. Heck on the net it OBVIOUSLY means that you open the door to an attacked reverse engineering your app for bad purpose and allow it a nice way to wreak havoc on a system. Either their application E.S.5 is not that great as they are hypping it (haha), or they really are searching excuse for obvious malware. If this is the second option which is true, the next malware code will be hidden behind encryption and packet won't be easily decoded.
people go away from ES5. You will from now on have now way to determine if you are not installing a trojan on your computer UNLESS they give you the source code and a compiler to compare the final binaries md5 with what you can generate...
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
Users don't really want or care about this functionality, however I'll tell you who does: administrators and programmers. In a biz environment where you may have hundreds or thousands of users version control and updating are very important issues, especially so when it comes to in-house applications or virus scan updates.
I spent about three weeks once working on a scripted install of Acrobat Reader, Netscape, VirusScan, NTSP4 and a few in-house apps; all with custom setup files/registry keys and setup for our in-house programmers to do their own "pushes" of updates to the call center computers. Over the course of a weekend 6 techs working at 3 locations (HQ, call center, print/packing center) updated over 5,000 computers by simply rebooting and letting the login script do all the work, then coming by and checking for errors. We ended up with 2 machines that had serious problems after the upgrade and another 10 or so that had minor issues, which is most likely less than we would of had if the techs would of had to do the procedure by hand on each machine.
Properly used, automatic updates are a wonderful thing. However it's alot harder to implement outside the corporate structure, since most users who are burned once by an auto-update tend to mistrust all such methods. Even companies that require all users to be patched to the latest version for the large online games such as Ultima Online or Everquest occasionally get bit by the "patch bug" and make alot of enemies in their userbase whenever it happens.
Jonah Hex
Horror & SciFi Erotic Nudes
You get sued for sharing, distributing, and/or downloading files, on any peer to peer network. The only one so far that the RIAA has attacked as of late is the Fast-Track network, due to its incomparable size. Apparently people don't seem to remember a popular service known as Napster that also disappeared from existence by being sued. So, just because you use ES5, does not make you immune from lawsuits, because you are still violating the law. Using different programs, in my opinion, do give you a bit more freedom, as you don't ever hear of someone getting sued from using the Gnutella2 network (www.shareaza.com) for which I am an advocate of. So, it would just be time until they reached the other networks, unless they are stopped here, unless they are not allowed to go further, unless they can no longer hurl subpoenas at ISPs. But then again, those are just my hopes :)
P.S. K-Lite K++ is an illegal modification of KaZaA (even though its superior for doing the oh-so-illegal things :D)
If you can't look at the source for a p2p system, then its not truly safe. It is as simple as that.
...
P2P opens up a whole different degree of responsibility for local system resource usage, and in fact the primary function of a p2p app is to manage local system resources on behalf of a 'greater good' of bigger resources provided to the community.
I wouldn't really put much faith in any p2p solution provider who didn't have full disclosure of source code as a priority in their front line for dealing with their users
I mean this as a potential professional user of p2p, as well as a personal user too.
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
How the heck do you manage to download huge files from P2P sources then?
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).