RE: [inbox] malware added in transit

[Nick FitzGerald <nick () virus-l demon co uk>]

Frank Knobbe <frank () knobbe us> wrote:

> However, the topic at hand doesn't lend itself to a quick switch or
> simple addition of data at the end of the stream. If you want to add
> malware to an SMTP session on the fly, you will have to intercept and
> rewrite the email.  ...

Well, that really depends on what was meant by "in transit" and on the 
Email architecture between sender and "victim"...

> ...  A plain text email will have to be converted to a
> MIME encapsulated email so that you can add the attachment on the fly.

Nah -- most "user friendly" MUAs will find UUencode "begin" lines 
arbitrarily deep in messages these days (after all, perhaps the single 
most used MUA -- OE -- still supports this format for outgoing 
attachments, though does not default to this for SMTP; only NNTP), so 
all you need to do is insert your encoded malware at the end of the 
SMTP data stream (i.e. immediately before the ".<CR><LF<CR><LF>").

That in turn is even easier if you can get to run on a machine relaying 
between sender and victim, or acting as mail server for either.

> Tricky, but very doable. It probably won't take long and you'll have an
> adware/malware adding email proxy in the wild  :)

Well, a few self-mailing viruses have already done it, if you count 
acting as a relay on the sending machine as "in transit".

The first successful self-mailer, Ska (aka Happy99) did just this, 
intercepting a couple of critical WinSock APIs (send and receive from 
memory) and interdicting an additional Email (carrying an encoded copy 
of itself) into the Email sending chain, after copying the headers of 
the victim's actual Email.  Thus, each address a Ska victim sent a 
message to (that was delivered from their PC into the Internet Email 
chain via port 25) would receive another message, apparently also from 
that person, which was actually a copy of the virus.  (Ska was 
"thoughtful" in keeping a list of addresses it had already sent itself 
to and checked the address on each outgoing message was not already in 
this list, only sending itself to those addresses not already on the 
list.)

One of the Hybris plugins also did much the same, except it added 
itself (via MIME) as an attachment to actual messages from its victims, 
and I have a vague idea some of the Klez variants may have been up to 
similar jiggery-pokery...


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html