Feeds

Popular packet sniffing packages contaminated by Trojan

Libpcap and Tcpdump tainted

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Users are warned to be vigilant after trojanised versions of popular packet sniffing packages were posted on well known download sites.

A detailed alert from members of the Houston Linux users group warns that trojanised versions of Libpcap, used as a packet sniffing library in programs like Snort (the open source IDS package), and Tcpdump have been posted on Tcpdump.org. These contaminated packages have also found their way onto many mirror sites, such as Wiretapped.net
.
The trojan contains modifications to the configure script for both packages. It also alters gencode.c in libpcap only.

Russ Spooner, of network security specialists Interrorem, told us that the warning is genuine and affects a wide range of widely used programmes.

"Libpcap is massively used across a wide range of platforms, programs such as ethereal use it, and of course tcpdump," he told us. "If Snort (one of the best IDS out there) is built against a trojanised lipcap, then obviously that would become vulnerable too".

"Even "hacking" tools like ettercap would be vulnerable to compromise with this, he added.

There is an important mitigating factor, however.

The backdoor component of the trojan tries to connect to a specific host (mars.raketti.net), and as such fail to open compromised systems to world+dog.

Sponner advises that, as a precaution, people should downgrade their libpcap to a trusted
version and be cautious of statically compiled pcap based programs. These programmes should be run in a sandbox to make sure they are not trying to connect to the mars.raketti.net server.

Posting version of popular applications contaminated with trojan code has become a popular tactic among denizens in the digital underground.

In October a trojanised version of Sendmail was found circulating the Internet. Experts later noted the marked similarities between this trojan to a backdoor planted in OpenSSH in late July. ®

Related Stories

Trojanized Sendmail distro circulated
Sendmail Trojan looks familiar
OpenSSH trojaned!

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.