Hackers Handbook - Millenium Edition/Hackers Handbook.iso/library/hack99/promail_1_21_trojan.txt

Internet Message Format | 1999-03-24 | 6.8 KB

Date: Fri, 19 Mar 1999 09:41:18 +0100
From: Aeon Labs <[e-mail]>
To: [e-mail]
Subject: security/privacy news

(Perhaps this might be of interest to Your readers.)

ProMail v1.21, an advanced freeware mail program spread through several
worldwide distribution networks (SimTel.net, Shareware.com and others),
is a trojan.
Upon discovering - through LAN sniffing - that the program would attempt
to connect to SMTP instead of POP3 when a regular mail check was performed,
we reverse-engineered the software.
ALL of the personal user data, including the user's password in encrypted
format, is sent to an account on NetAddress - a free email provider -
as soon as a valid internet connection is detected.
Apart from this "feature", the software is 100 % functional and very
well done.
Well, it seems that 1999 is the worst year for privacy...

More detailed information can be found on our web site at
http://cool.icestorm.net/aeon/news.html


  ---------------------------------------------------------------------
  Aeon Labs
  http://cool.icestorm.net/aeon

[http://cool.icestorm.net/aeon/news.html]

03.99]

ProMail v1.21, an advanced freeware mail program for Windows 95/98, is a trojan.
It has been spread through several worldwide distribution networks (SimTel.net,
Shareware.com and others) as proml121.zip.

Upon discovering - through LAN sniffing - that the program would attempt to
connect to SMTP instead of POP3 when a regular mail check was performed, we
reverse-engineered the software.

The executable, which appears to have been created with Borland Delphi, has been
packed with Petite (a shareware Win32-EXE compressor) and then "hexed" to make
disassembly harder.

ProMail v1.21 supports multiple mailboxes; every time a new mailbox is created,
an "ini" file containing the users full name, passwords, email addresses,
servers and more is generated.

Prior to doing any other action, the program performs a check for a valid
network connection which, if found, allows for the sending of ALL of the
personal user data, including the user's password in encrypted format, to an
account on NetAddress - a free email provider.

Apart from this "feature", the software is 100 % functional and very well done.

For further information or a more detailed analysis contact us. <[e-mail]>

---------------------------------------------------------------------------------

Date: Sat, 20 Mar 1999 03:51:00 -0500 (EST)
From: [e-mail]
To: [e-mail]
Subject: Re: your mail

currently our members have disassembled and analyzed the whole executable.
the only thing it appears to do as a trojan is to send the accounts data
entered by the user: full name, organization, email address, user name,
password (encrypted), smtp and pop3 servers, etc.
and since promail supports multiple accounts, each newly created account
is sent.
the data for each account is contained in a text file which is used to
initialize promail at run-time.  the same text file is used as body of
the email which is sent to the author (supposedly) of the program.
it appears that all emails are sent with same subject line: "kirio".

the program also creates the file promail.pml in its directory.  it's a
zero length file used as permanent flag to "remember" to the trojan that
one or more accounts data could not be sent in the last session (for
example, when accounts are created off-line, or when not followed by a
mail check in the same session).

we also managed to crack the mailbox to which accounts data is sent.
about ~80 emails (== accounts) were found and another dozen was
received after only ten minutes or so.
accounts for microsoft, michigan us army, old bridge chemicals and a
videogames company - amongst the others - were found.

we have merely informed a _contact_ (not the ml) in ntbugtraq and
several "underground" news/security sites.
well you can contact the various *traq mailing lists if you want.  we
don't care if people still trust anything that can be downloaded from
the net anyway.  i guess we're not exactly "white hat" hackers :P

if you need any help or further analysis on a specific part of the program
please feel free to contact us.


  ------------------------------------------------------------------------
  Aeon Labs <[e-mail]>
  http://cool.icestorm.net/aeon

---------------------------------------------------------------------------------

Date: Sun, 21 Mar 1999 09:40:26 +0100
From: Patrick Oonk <[e-mail]>
To: [e-mail]
Subject: [[e-mail]: ProMail trojan proof]

----- Forwarded message from Patrick Oonk <[e-mail]> -----

Hi,

I've tested the ProMail Trojan, it sends the info
to [e-mail] using the smtp server you
supply when creating an account.

I'll Cc: [e-mail] and [e-mail]

ProMail can still be downloaded at many sites,
just check
http://search.shareware.com/code/engine/File?archive=sim-win95&file=email%2fproml121%2ezip&size=409141

These are the queue files at my smtp server after
I installed ProMail and created an account:

$ more /var/spool/mqueue/qfPAA17183
V2
T921939650
K921939657
N1
P30435
I6/0/88205
M<[e-mail]>... reply: read error from office.pine.nl.
Fb
$rSMTP
$sfoo
$_foo.domain.com [10.0.0.1]
S<[e-mail]>
RPFD:<[e-mail]>
H?P?Return-Path: <[e-mail]>
HReceived: from foo (foo.domain.com [10.0.0.1])
        by bar.domain.com (8.9.1/8.9.1) with SMTP id PAA17183
        for <[e-mail]>; Sat, 20 Mar 1999 15:20:50 +0100 (MET)
H?D?Date: Sat, 20 Mar 1999 15:20:50 +0100 (MET)
H?F?From: [e-mail]
H?M?Message-Id: <[e-mail]>
HTo: [e-mail]
HSubject: kirio

$ more /var/spool/mqueue/dfPAA17183
Name=New Account

[From]
EMail=[e-mail]
Name=Patrick Oonk
Organization=Pine Internet B.V.

[ReplyTo]
EMail=[e-mail]
Name=Patrick Oonk

[POP3]
Server=pop.domain.com
Port=110
User=patrick
Password=1hFATUIxWOkJ3b3N3chBXZrFmZMUE
PromptPassword=0
DoPOP=1
StandardDownload=0

[SMTP]
Server=smtp.domain.com
Port=25
DoSMTP=1

[Filter]
Keep=
Delete=
--
: Patrick Oonk -    http://patrick.mypage.org/  - [e-mail] :
: Pine Internet B.V.           Consultancy, installatie en beheer :
: Tel: [phone] - Fax: [phone] - http://www.pine.nl/ :
: -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- :
: "unix is voor types zonder sociaal leven..." - Patrick van Eijk :


----- End forwarded message -----

--
: Patrick Oonk -    http://patrick.mypage.org/  - [e-mail] :
: Pine Internet B.V.           Consultancy, installatie en beheer :
: Tel: [phone] - Fax: [phone] - http://www.pine.nl/ :
: -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- :
: "unix is voor types zonder sociaal leven..." - Patrick van Eijk :
: A signature starts with "-- <enter>".                           :