Feeds

Backdoor program gets backdoored

Malware author inserts secret password

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

The author of a free Trojan horse program favored by amateur computer intruders found himself with some explaining to do to the underground last month, after his users discovered he'd slipped a secret backdoor password into his popular malware, potentially allowing him to re-hack compromised hosts.

The program in question is Optix Pro (Backdoor.OptixPro.12), a full-featured backdoor that allows an intruder to easily control a compromised Windows machine remotely, from accessing or changing files, to capturing a user's keystrokes or spying on a victim through their webcam. Though some features could make Optix Pro usable as a legitimate remote management tool, others are clearly tailored to the underground, including a function that disables a machine's anti-virus and firewall software. The program has been downloaded nearly 270,000 times, according to a counter on the distribution site.

Like other species in a genus that includes BO2K, SubSeven, and Beast, the working end of Optix Pro is a server that the hacker must insinuate into a victim's computer, either through subterfuge - by misrepresenting it as an image file or an electronic greeting card - or by uploading it to an already-compromised machine. The hacker sets a password on the Optix Pro server, so that no other would-be intruders have the ability to slip through the open backdoor.

That is, none except for the author, a coder named "Sleaze" (he spells it "s13az3"), who secretly embedded in the program a random-looking 38-character "master password" that was known only to him.

Though the password was encrypted in the binary, at some point suspicious hackers teased the cleartext version from RAM, and it began circulating quietly in the underground, possibly as early as last year. Last month it surfaced on a hacker website, forcing Sleaze into an embarrassing admission. "I have never talked about master passwords before because I thought it best not to do so until one was ever found," Sleaze wrote, in a front page posting to the Optix Pro distribution site. "However, now I feel the time is right to confirm there is [one]."

In his defense, Sleaze noted, "I have never directly denied the existence of a master pass." He added that he never used the backdoor-within-a-backdoor to take over machines properly owned up by his users. He only included it for his own security.

If the FBI ever got too close to Sleaze he had intended to release the secret password to the world, causing Optix Pro to become less popular among intruders and easing the pressure from law enforcement. "That's when a master pass could potentially save a programmer," he wrote.

Merely writing a backdoor program is not illegal under US federal law, but arrests have been made in other countries, most recently Germany and Taiwan.

Rival hackware coder and self-described grey hat hacker "illwill," himself no stranger to security company threat profiles, says untrustworthy code has beset the underground for years: the popular SubSeven backdoor also included a secret password, he said, as does the more obscure Infector. "It's kind of a big deal to the kiddies," he wrote in an IM interview. "The authors see it as a way to control what they create, or let their 'krew' get in on the victims that other people get."

In a disclaimer evocative of advisories from more mainstream software vendors, Sleaze pointed out in his posting that the backdoor password in circulation only works on an older, unsupported versions of the Trojan horse, and that the latest version of Optix Pro uses stronger encryption to protect a different master password. "So make sure you update!," he wrote.

At least one security expert says there's a lesson to be learned from the whole affair. "It obviously says you should always use open-source Trojans," says Mark Loveless, a senior security analyst with Bindview Corporation. "That's the moral. You can't even trust Windows malware."

Copyright © 2004, SecurityFocus logo

Related stories

German hate mail spam attack stuns experts
Taiwanese engineer 'assisted Chinese hackers'
Phatbot arrest throws open trade in zombie PCs

Designing a Defense for Mobile Applications

More from The Register

next story
DARPA-derived secure microkernel goes open source tomorrow
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.