Date: Fri, 19 Mar 1999 09:41:18 +0100 From: Aeon Labs To: packetstorm@genocide2600.com Subject: security/privacy news (Perhaps this might be of interest to Your readers.) ProMail v1.21, an advanced freeware mail program spread through several worldwide distribution networks (SimTel.net, Shareware.com and others), is a trojan. Upon discovering - through LAN sniffing - that the program would attempt to connect to SMTP instead of POP3 when a regular mail check was performed, we reverse-engineered the software. ALL of the personal user data, including the user's password in encrypted format, is sent to an account on NetAddress - a free email provider - as soon as a valid internet connection is detected. Apart from this "feature", the software is 100 % functional and very well done. Well, it seems that 1999 is the worst year for privacy... More detailed information can be found on our web site at http://cool.icestorm.net/aeon/news.html --------------------------------------------------------------------- Aeon Labs http://cool.icestorm.net/aeon [http://cool.icestorm.net/aeon/news.html] 03.99] ProMail v1.21, an advanced freeware mail program for Windows 95/98, is a trojan. It has been spread through several worldwide distribution networks (SimTel.net, Shareware.com and others) as proml121.zip. Upon discovering - through LAN sniffing - that the program would attempt to connect to SMTP instead of POP3 when a regular mail check was performed, we reverse-engineered the software. The executable, which appears to have been created with Borland Delphi, has been packed with Petite (a shareware Win32-EXE compressor) and then "hexed" to make disassembly harder. ProMail v1.21 supports multiple mailboxes; every time a new mailbox is created, an "ini" file containing the users full name, passwords, email addresses, servers and more is generated. Prior to doing any other action, the program performs a check for a valid network connection which, if found, allows for the sending of ALL of the personal user data, including the user's password in encrypted format, to an account on NetAddress - a free email provider. Apart from this "feature", the software is 100 % functional and very well done. For further information or a more detailed analysis contact us. --------------------------------------------------------------------------------- Date: Sat, 20 Mar 1999 03:51:00 -0500 (EST) From: aeon@army.net To: packetstorm@genocide2600.com Subject: Re: your mail currently our members have disassembled and analyzed the whole executable. the only thing it appears to do as a trojan is to send the accounts data entered by the user: full name, organization, email address, user name, password (encrypted), smtp and pop3 servers, etc. and since promail supports multiple accounts, each newly created account is sent. the data for each account is contained in a text file which is used to initialize promail at run-time. the same text file is used as body of the email which is sent to the author (supposedly) of the program. it appears that all emails are sent with same subject line: "kirio". the program also creates the file promail.pml in its directory. it's a zero length file used as permanent flag to "remember" to the trojan that one or more accounts data could not be sent in the last session (for example, when accounts are created off-line, or when not followed by a mail check in the same session). we also managed to crack the mailbox to which accounts data is sent. about ~80 emails (== accounts) were found and another dozen was received after only ten minutes or so. accounts for microsoft, michigan us army, old bridge chemicals and a videogames company - amongst the others - were found. we have merely informed a _contact_ (not the ml) in ntbugtraq and several "underground" news/security sites. well you can contact the various *traq mailing lists if you want. we don't care if people still trust anything that can be downloaded from the net anyway. i guess we're not exactly "white hat" hackers :P if you need any help or further analysis on a specific part of the program please feel free to contact us. ------------------------------------------------------------------------ Aeon Labs http://cool.icestorm.net/aeon --------------------------------------------------------------------------------- Date: Sun, 21 Mar 1999 09:40:26 +0100 From: Patrick Oonk To: tattooman@ADRIC.GENOCIDE2600.COM Subject: [patrick@pine.nl: ProMail trojan proof] ----- Forwarded message from Patrick Oonk ----- Hi, I've tested the ProMail Trojan, it sends the info to naggamanteh@usa.net using the smtp server you supply when creating an account. I'll Cc: abuse@usa.net and bugs@shareware.com ProMail can still be downloaded at many sites, just check http://search.shareware.com/code/engine/File?archive=sim-win95&file=email%2fproml121%2ezip&size=409141 These are the queue files at my smtp server after I installed ProMail and created an account: $ more /var/spool/mqueue/qfPAA17183 V2 T921939650 K921939657 N1 P30435 I6/0/88205 M... reply: read error from office.pine.nl. Fb $rSMTP $sfoo $_foo.domain.com [10.0.0.1] S RPFD: H?P?Return-Path: HReceived: from foo (foo.domain.com [10.0.0.1]) by bar.domain.com (8.9.1/8.9.1) with SMTP id PAA17183 for ; Sat, 20 Mar 1999 15:20:50 +0100 (MET) H?D?Date: Sat, 20 Mar 1999 15:20:50 +0100 (MET) H?F?From: patrick@pine.nl H?M?Message-Id: <199903201420.PAA17183@bar.domain.com> HTo: naggamanteh@usa.net HSubject: kirio $ more /var/spool/mqueue/dfPAA17183 Name=New Account [From] EMail=patrick@pine.nl Name=Patrick Oonk Organization=Pine Internet B.V. [ReplyTo] EMail=patrick@pine.nl Name=Patrick Oonk [POP3] Server=pop.domain.com Port=110 User=patrick Password=1hFATUIxWOkJ3b3N3chBXZrFmZMUE PromptPassword=0 DoPOP=1 StandardDownload=0 [SMTP] Server=smtp.domain.com Port=25 DoSMTP=1 [Filter] Keep= Delete= -- : Patrick Oonk - http://patrick.mypage.org/ - patrick@pine.nl : : Pine Internet B.V. Consultancy, installatie en beheer : : Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ : : -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- : : "unix is voor types zonder sociaal leven..." - Patrick van Eijk : ----- End forwarded message ----- -- : Patrick Oonk - http://patrick.mypage.org/ - patrick@pine.nl : : Pine Internet B.V. Consultancy, installatie en beheer : : Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ : : -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- : : "unix is voor types zonder sociaal leven..." - Patrick van Eijk : : A signature starts with "-- ". :