Are you a spammer

Please note, that the first 3 posts you make, will need to be approved by a forum Administrator or Moderator before they are publicly viewable.
Each application to join this forum is checked at the Stop Forum Spam website. If the email or IP address appears there when checked, you will not be allowed to join this forum.
If you get past this check and post spam on this forum, your posts will be immediately deleted and your account inactivated.You will then be banned and your IP will be submitted to your ISP, notifying them of your spamming. So your spam links will only be seen for an hour or two at most. In other words, don't waste your time and ours.

This forum is for the use and enjoyment of the members and visitors looking to learn about and share information regarding the topics listed. It is not a free-for-all advertising venue. Your time would be better spent pursuing legitimate avenues of promoting your websites.

Some versions of Unreal3.2.8.1.tar.gz contain a backdoor

Topics not related to Ultimate Edition.


Some versions of Unreal3.2.8.1.tar.gz contain a backdoor

Postby 2hot6ft2 » Sun Jun 27, 2010 9:22 pm

Naturally this isn't a problem if using the repos. but I thought that it was interesting.

Some versions of Unreal3.2.8.1.tar.gz contain a backdoor
This is very embarrassing...

We found out that the Unreal3.2.8.1.tar.gz file on our mirrors has been replaced quite a while ago with a version with a backdoor (trojan) in it.
This backdoor allows a person to execute ANY command with the privileges of the user running the ircd. The backdoor can be executed regardless of any user
restrictions (so even if you have passworded server or hub that doesn't allow any users in).

It appears the replacement of the .tar.gz occurred in November 2009 (at least on some mirrors). It seems nobody noticed it until now.

Obviously, this is a very serious issue, and we're taking precautions so this will never happen again, and if it somehow does that it will be noticed quickly.
We will also re-implement PGP/GPG signing of releases. Even though in practice (very) few people verify files, it will still be useful for those people who do.

Safe versions
==============

Official precompiled Windows (SSL and non-ssl) binaries are NOT affected.

CVS is also not affected.

3.2.8 and any earlier versions are not affected.

Any Unreal3.2.8.1.tar.gz downloaded BEFORE November 10 2009 should be safe, but you should really double-check, see next.

How to check if you're running the backdoored version
======================================================
Two ways:

One is to check if the Unreal3.2.8.1.tar.gz you have is good or bad by running 'md5sum Unreal3.2.8.1.tar.gz' on it.
Backdoored version (BAD) is: 752e46f2d873c1679fa99de3f52a274d
Official version (GOOD) is: 7b741e94e867c0a7370553fd01506c66

The other way is to run this command in your Unreal3.2 directory:
grep DEBUG3_DOLOG_SYSTEM include/struct.h
If it outputs two lines, then you're running the backdoored/trojanized version.
If it outputs nothing, then you're safe and there's nothing to do.

What to do if you're running the backdoored version
====================================================
Obviously, you only need to do this if you checked you are indeed running the backdoored version, as mentioned above.
Otherwise there's no point in continuing, as the version on our website is (now back) the good one from April 13 2009 and nothing 'new'.

Solution:
* Re-download from http://www.unrealircd.com/
* Verify MD5 (or SHA1) checksums, see next section (!)
* Recompile and restart UnrealIRCd

The backdoor is in the core, it is not possible to 'clean' UnrealIRCd without a restart or through a module.

How to verify that the release is the official version
=======================================================
You can check by running 'md5sum Unreal3.2.8.1.tar.gz', it should output:
7b741e94e867c0a7370553fd01506c66 Unreal3.2.8.1.tar.gz

For reference, here are the md5sums for ALL proper files:
7b741e94e867c0a7370553fd01506c66 Unreal3.2.8.1.tar.gz
5a6941385cd04f19d9f4241e5c912d18 Unreal3.2.8.1.exe
a54eafa6861b6219f4f28451450cdbd3 Unreal3.2.8.1-SSL.exe

These are the EXACT same MD5sums as mentioned on April 13 2009 in the initial 3.2.8.1 announcement to the unreal-notify and unreal-users mailing list.
<http://sourceforge.net/mailarchive/forum.php?thread_name=49E341E0.3000702%40vulnscan.org&forum_name=unreal-notify>

Finally
========
Again, I would like to apologize about this security breach.
We simply did not notice, but should have.
We did not check the files on all mirrors regularly, but should have.
We did not sign releases through PGP/GPG, but should have done so.

This advisory (and updates to it, if any) is posted to:
http://www.unrealircd.com/txt/unrealsec ... 100612.txt

Hope you'll all continue to support UnrealIRCd.

And more interesting stuff once you get past this ones simply giddy reaction to that announcement. I guess he's not bright enough to tell what an isolated case it was and that it's not like the millions of windows cases in the wild.
:x
Linux infection proves Windows malware monopoly is over
Meanwhile, Mac users shouldn’t get complacent either. Intego has reported two in-the-wild outbreaks of a Trojan horse program found on game sites and a gruesome piece of spyware that tags along with screen savers and other freebie apps. (And Intego says they found copies of the unwanted software even after the original distributor claimed to have removed it.)

If you think all of this sounds familiar, you’re right. Welcome to the world Windows users lived in back in 2003 or so. The good news for security professionals who use Linux or a Mac? They have years of lessons to draw on courtesy of their Windows peers.

I will give him this, he does a real good job of sounding like a idiot. At least that's what I got from it.
:roll:
Image
HP G60-125NR - AMD Turion X2 64 - nVidia GeForce 8200M G - 128 GB SSD Dual boot - Ultimate Edition, Win 10 Pro
HP G60-121WM - AMD Sempron SI-40 - nVidia GeForce 8200M G - 128 GB SSD - Dual boot - Ultimate Edition, Win 10 Pro
Custom build, Rosewill Challenger ATX Gaming Case, AMD Phenom II x4 955 C3 rev., MSI 870A-G54, 2x ATI HD4850 512MB /256bit GDDR3 & dual precision, GSkill 8GB 1600 RAM - Multi boot - Ultimate Edition, Win 10 Pro, Beta Testing
User avatar
2hot6ft2
Moderator
 
Posts: 533
Joined: Sun May 25, 2008 12:30 pm
Location: Alabama, USA
Operating System: Ultimate Edition 3.2 64 BIT

Return to General Discussion - Birthdays-Welcome to the Forums - Introduce yourself here!

Who is online

Users browsing this forum: No registered users and 4 guests