Backdoor program gets backdoored

Malware author inserts secret password


The author of a free Trojan horse program favored by amateur computer intruders found himself with some explaining to do to the underground last month, after his users discovered he'd slipped a secret backdoor password into his popular malware, potentially allowing him to re-hack compromised hosts.

The program in question is Optix Pro (Backdoor.OptixPro.12), a full-featured backdoor that allows an intruder to easily control a compromised Windows machine remotely, from accessing or changing files, to capturing a user's keystrokes or spying on a victim through their webcam. Though some features could make Optix Pro usable as a legitimate remote management tool, others are clearly tailored to the underground, including a function that disables a machine's anti-virus and firewall software. The program has been downloaded nearly 270,000 times, according to a counter on the distribution site.

Like other species in a genus that includes BO2K, SubSeven, and Beast, the working end of Optix Pro is a server that the hacker must insinuate into a victim's computer, either through subterfuge - by misrepresenting it as an image file or an electronic greeting card - or by uploading it to an already-compromised machine. The hacker sets a password on the Optix Pro server, so that no other would-be intruders have the ability to slip through the open backdoor.

That is, none except for the author, a coder named "Sleaze" (he spells it "s13az3"), who secretly embedded in the program a random-looking 38-character "master password" that was known only to him.

Though the password was encrypted in the binary, at some point suspicious hackers teased the cleartext version from RAM, and it began circulating quietly in the underground, possibly as early as last year. Last month it surfaced on a hacker website, forcing Sleaze into an embarrassing admission. "I have never talked about master passwords before because I thought it best not to do so until one was ever found," Sleaze wrote, in a front page posting to the Optix Pro distribution site. "However, now I feel the time is right to confirm there is [one]."

In his defense, Sleaze noted, "I have never directly denied the existence of a master pass." He added that he never used the backdoor-within-a-backdoor to take over machines properly owned up by his users. He only included it for his own security.

If the FBI ever got too close to Sleaze he had intended to release the secret password to the world, causing Optix Pro to become less popular among intruders and easing the pressure from law enforcement. "That's when a master pass could potentially save a programmer," he wrote.

Merely writing a backdoor program is not illegal under US federal law, but arrests have been made in other countries, most recently Germany and Taiwan.

Rival hackware coder and self-described grey hat hacker "illwill," himself no stranger to security company threat profiles, says untrustworthy code has beset the underground for years: the popular SubSeven backdoor also included a secret password, he said, as does the more obscure Infector. "It's kind of a big deal to the kiddies," he wrote in an IM interview. "The authors see it as a way to control what they create, or let their 'krew' get in on the victims that other people get."

In a disclaimer evocative of advisories from more mainstream software vendors, Sleaze pointed out in his posting that the backdoor password in circulation only works on an older, unsupported versions of the Trojan horse, and that the latest version of Optix Pro uses stronger encryption to protect a different master password. "So make sure you update!," he wrote.

At least one security expert says there's a lesson to be learned from the whole affair. "It obviously says you should always use open-source Trojans," says Mark Loveless, a senior security analyst with Bindview Corporation. "That's the moral. You can't even trust Windows malware."

Copyright © 2004, SecurityFocus logo

Related stories

German hate mail spam attack stuns experts
Taiwanese engineer 'assisted Chinese hackers'
Phatbot arrest throws open trade in zombie PCs


Other stories you might like

  • Moscow court fines Pinterest, Airbnb, Twitch, UPS for not storing data locally
    Data sovereignty is more important than Ukrainian sovereignty

    A Moscow court has fined Airbnb, Twitch, UPS, and Pinterest for not storing Russian user data locally, according to Russian regulator Roskomnadzor.

    The decision was handed down by the Tagansky District Court of Moscow after the four foreign companies allegedly did not provide documents confirming that the storage and processing of Russian personal data was conducted entirely in the country.

    Twitch, Pinterest and Airbnb were fined approximately $38,500 while UPS received a fine of roughly $19,200.

    Continue reading
  • Israel plans ‘Cyber-Dome’ to defeat digital attacks from Iran and others
    Already has 'Iron Dome' – does it need another hero?

    The new head of Israel's National Cyber Directorate (INCD) has announced the nation intends to build a "Cyber-Dome" – a national defense system to fend off digital attacks.

    Gaby Portnoy, director general of INCD, revealed plans for Cyber-Dome on Tuesday, delivering his first public speech since his appointment to the role in February. Portnoy is a 31-year veteran of the Israeli Defense Forces, which he exited as a brigadier general after also serving as head of operations for the Intelligence Corps, and leading visual intelligence team Unit 9900.

    "The Cyber-Dome will elevate national cyber security by implementing new mechanisms in the national cyber perimeter, reducing the harm from cyber attacks at scale," Portnoy told a conference in Tel Aviv. "The Cyber-Dome will also provide tools and services to elevate the protection of the national assets as a whole. The Dome is a new big data, AI, overall approach to proactive defense. It will synchronize nation-level real-time detection, analysis, and mitigation of threats."

    Continue reading
  • Intel to sell Massachusetts R&D site, once home to its only New England fab
    End of another era as former DEC facility faces demolition

    As Intel gets ready to build fabs in Arizona and Ohio, the x86 giant is planning to offload a 149-acre historic research and development site in Massachusetts that was once home to the company's only chip manufacturing plant in New England.

    An Intel spokesperson confirmed on Wednesday to The Register it plans to sell the property. The company expects to transfer the site to a new owner, a real-estate developer, next summer, whereupon it'll be torn down completely.

    The site is located at 75 Reed Rd in Hudson, Massachusetts, between Boston and Worcester. It has been home to more than 800 R&D employees, according to Intel. The spokesperson told us the US giant will move its Hudson employees to a facility it's leasing in Harvard, Massachusetts, about 13 miles away.

    Continue reading
  • Start using Modern Auth now for Exchange Online
    Before Microsoft shutters basic logins in a few months

    The US government is pushing federal agencies and private corporations to adopt the Modern Authentication method in Exchange Online before Microsoft starts shutting down Basic Authentication from the first day of October.

    In an advisory [PDF] this week, Uncle Sam's Cybersecurity and Infrastructure Security Agency (CISA) noted that while federal executive civilian branch (FCEB) agencies – which includes such organizations as the Federal Communications Commission, Federal Trade Commission, and such departments as Homeland Security, Justice, Treasury, and State – are required to make the change, all organizations should make the switch from Basic Authentication.

    "Federal agencies should determine their use of Basic Auth and migrate users and applications to Modern Auth," CISA wrote. "After completing the migration to Modern Auth, agencies should block Basic Auth."

    Continue reading

Biting the hand that feeds IT © 1998–2022