RE: [inbox] malware added in transit

[Frank Knobbe <frank () knobbe us>]

On Thu, 2004-03-18 at 10:03, Vincent.Maes () aps com wrote:
> What about modifying/building an application such as dsniff on
> steroids.  Direct all the gateway traffic through a (dsniff)
> compromised system, then watch for the target traffic and perform a
> disassemble/reassemble with malware included.  You could fragment the
> target traffic to insert larger amounts of malware; and, by looking
> for the file-type headers, proceed to target specific content. As
> others have said, there is nothing available (in script kiddie
> format) to do this, yet.  But there are tools that can perform each of
> the require functions (WinPcap, ngrep, libpcap)  You just have to put
> them together.


I've seen tools that allow for insertion or replacement of files in a
FTP stream which you can use to "swap out" a file in transit.

However, the topic at hand doesn't lend itself to a quick switch or
simple addition of data at the end of the stream. If you want to add
malware to an SMTP session on the fly, you will have to intercept and
rewrite the email. A plain text email will have to be converted to a
MIME encapsulated email so that you can add the attachment on the fly.

Tricky, but very doable. It probably won't take long and you'll have an
adware/malware adding email proxy in the wild  :)

Cheers,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part