Home page logo

fulldisclosure logo Full Disclosure mailing list archives

RE: [inbox] malware added in transit
From: Frank Knobbe <frank () knobbe us>
Date: Thu, 18 Mar 2004 10:24:20 -0600

On Thu, 2004-03-18 at 10:03, Vincent.Maes () aps com wrote:
What about modifying/building an application such as dsniff on
steroids.  Direct all the gateway traffic through a (dsniff)
compromised system, then watch for the target traffic and perform a
disassemble/reassemble with malware included.  You could fragment the
target traffic to insert larger amounts of malware; and, by looking
for the file-type headers, proceed to target specific content. As
others have said, there is nothing available (in script kiddie
format) to do this, yet.  But there are tools that can perform each of
the require functions (WinPcap, ngrep, libpcap)  You just have to put
them together.

I've seen tools that allow for insertion or replacement of files in a
FTP stream which you can use to "swap out" a file in transit.

However, the topic at hand doesn't lend itself to a quick switch or
simple addition of data at the end of the stream. If you want to add
malware to an SMTP session on the fly, you will have to intercept and
rewrite the email. A plain text email will have to be converted to a
MIME encapsulated email so that you can add the attachment on the fly.

Tricky, but very doable. It probably won't take long and you'll have an
adware/malware adding email proxy in the wild  :)


Attachment: signature.asc
Description: This is a digitally signed message part

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]