Gnutella Forums

Gnutella Forums (https://www.gnutellaforums.com/)
-   General P2P Network Discussion (https://www.gnutellaforums.com/general-p2p-network-discussion/)
-   -   Mcdonald free song thing = trap (https://www.gnutellaforums.com/general-p2p-network-discussion/28228-mcdonald-free-song-thing-trap.html)

stupididiot69er September 15th, 2004 06:19 PM

Mcdonald free song thing = trap
 
at mc donalds they sell a big mac and give you a free song to download. it's legal why not but what I've heard is that that thing was an idea to spy on your computer and record if you do download anything illegally. damn riaa got this idea and they hope to bust us with it. all I think you've got 2 do is don't download the free song and please don't share it otherwise the network will get infected with these spy files.

also I was thinking since they do that there wouldn't they try to spread. of course i might be wrong but i suspect that some songs you can legaly buy on the net might also be spy. advice: stay away from them or try not to mix legaly downloaded for copyright material with ilegaly downloaded copyright material and don't share it one the network.

I also would like to remind everyone of some advice i read before " if the file is perfectly named stay away from it it might be spy"

ps please remember to check the files you download for corruption it's anoying getting those corrupted files cause someone didn't check if it was good or not before sharing it.

please feel free to add any tips to prevent spy files from entering the network

and feel free to corredt me if I'm wrong about some things.

seya,
stupid idiot 69er @ hotmail.com

Morgwen September 16th, 2004 12:04 AM

Re: Mcdonald free song thing = trap
 
Quote:

Originally posted by stupididiot69er
I've heard is that that thing was an idea to spy on your computer and record if you do download anything illegally. damn riaa got this idea and they hope to bust us with it.
How should this work? Who told you such things, perhaps a link? Technically it isnīt possible to do such things with a MP3.

Morgwen

mstfyd September 16th, 2004 11:37 AM

Re: Mcdonald free song thing = trap
 
Quote:

Originally posted by stupididiot69er


I also would like to remind everyone of some advice i read before " if the file is perfectly named stay away from it it might be spy"

and feel free to corredt me if I'm wrong about some things.

seya,
stupid idiot 69er @ hotmail.com

ok, since you offered, I'm here to correct :D
Some people are just really perfectionist about these things (like me). None of my vinyl has fingerprints on the playing surfaces, I still have 45's neatly put away in cases dating further back than probably most people here were born. When I download I correct spelling, add the original band name to the comments section of a cover, and am working on a new comprehensive list of music . And I am the furthest thing from a spy. Somewhere out there is my opposite, who misspells the band name & lists the title as "f@$$$ fine tune, yeah!"

On the other hand, lest you think Felix Unger is alive and possessing me, I could probably use a backhoe for the clutter :eek: (shhh...I'm hiding from the "Clean Sweep" crew)!


stupididiot69er September 16th, 2004 01:51 PM

I don't know how it works. i guess they can put a program in it and it's a mix between exe and mp3. there might be some type of program that lets you do that/ or some way to do that. I also think someone got busted for that, I don't have any links, unfortunatly but one of my friends took it appart and saw these codes. of course in proof i am limited because I've lost contact with him, and I have no article. but what's the price of a big mac or anything that says it gives you a free song.

mstfyd, I know some of us like to name everything properly and are not spies, I also do rename files like you but I was setting a lookout for files that are like perfectly detailed exactly like it's on the CD, cause some of these in some casses can be fake. and most importantly a lookout for files that sound like they're from the industry and not other trusted users

Morgwen September 16th, 2004 02:23 PM

Quote:

Originally posted by stupididiot69er
i guess they can put a program in it and it's a mix between exe and mp3. there might be some type of program that lets you do that/ or some way to do that.
Impossible.

All I read are unproofen speculations, you should investigate a little before you tell us such tales... really IF your story would be only 1% true, at least 10 other well know websites or talented programmers had recodnized this and posted a story. But your my friend told me a story and now I post it in public is A BIG JOKE. Do you know anything about programming? Does your friend do? Why did you loose your contact to your friend, is he captured by the RIAA because he discovered this secret? :D

Morgwen

stupididiot69er September 16th, 2004 03:06 PM

my friend went to live in syberia, and he is very well experianced with programing. and yes I know some things and I have to say something : Nothing is Impossible
and I'm just trying to prevent infection of the network by spy files

stupididiot69er September 16th, 2004 04:14 PM

did some reasearch and hey i'm not the only one with that in mind and the spy file might come from the sony player which you need to download in order to play the song here's proof:
http://www.geek.com/news/geeknews/20...0608025474.htm
you know the file might not be inffected with the spyware but it might be unic in it's kind so all the riaa's gotta do is search for that file using their special computers and hack in your computer.

Morgwen September 17th, 2004 12:41 AM

Quote:

Originally posted by stupididiot69er
Nothing is Impossible
IT IS IMPOSSIBLE!!!

Tell me my talented friend, which extension should this new file have? .exe? No player plays .exe file! MP3? Oh yes players play .mp3 files (of course) but no player plays .exe files and donīt execute .exe files - so again HOW SHOULD THIS WORK???

Quote:

did some reasearch and hey i'm not the only one with that in mind and the spy file might come from the sony player which you need to download in order to play the song here's proof:
Proof? Yes this proofes that you are telling tales, there is no word about Sony or McDonalds are spying on us... first you "developed" a brandnew tchnique where .exe files are hidden in MP3s now you tell us the sony player might be bad.

Quote:

you know the file might not be inffected with the spyware but it might be unic in it's kind so all the riaa's gotta do is search for that file using their special computers and hack in your computer.
Heh? So the file is unic, who cares? How should the RIAA hack your computer without a trojan?

Quote:

I'm just trying to prevent infection of the network by spy files
No, you want to get attention nothing more and this sucks really because some users might believe your bullshit. :mad:

I believe you are looking to many films, calm down go sleeping and tomorrow its all good. :D

Morgwen

Morgwen September 17th, 2004 12:47 AM

P.S.:

Do you know that McDonalds can sue you for such badmouthing? Check your US law and better shut up now.

Morgwen

arne_bab September 17th, 2004 01:20 AM

Quote:

Originally posted by stupididiot69er
mstfyd, I know some of us like to name everything properly and are not spies, I also do rename files like you but I was setting a lookout for files that are like perfectly detailed exactly like it's on the CD, cause some of these in some casses can be fake. and most importantly a lookout for files that sound like they're from the industry and not other trusted users
You know the CDDB (that fragging CDDataBase, which you can't replace with the freeDB in itunes)?

That ensures, that most of my audio-files are exactly named as on the CD.

stupididiot69er September 17th, 2004 01:26 PM

fine than it'll be a bigger problem latter. I just thought we should keep this network clean

Disconnecting September 17th, 2004 05:50 PM

Quote:

Originally posted by stupididiot69er
Nothing is Impossible
Unless the laws of physics dictate otherwise.

Ive heard about this spyware problem and yes it can happen. Hell you can even get virus from pictures. But im pretty sure you get this spyware from going to the right site not downloading the music. Although, if the music was the problem you could tell by the file size.

stupididiot69er September 17th, 2004 07:04 PM

see i knew i was right
though I'm srr for losing it I don't like it when everyone turns against me and I don't want to scare the crap out of people either i would just like to worn them. if everyone fallows this rule : don't mix legal with illegal, and try to whatch out for corrupt files(this realy agravates me cause 60% of all files i download are corrupt)
anyways people don't panic just be carefull if you are it's totally safe

Morgwen September 18th, 2004 12:48 PM

Quote:

Originally posted by Disconnecting
Hell you can even get virus from pictures.
How should this work?

Morgwen

Morgwen September 18th, 2004 12:50 PM

Quote:

Originally posted by stupididiot69er
see i knew i was right
Yes you are right, you are a stupid idiot poster...

Again its not possible to combine a .exe file and a MP3, doesnīt matter what Disconnecting said.

Morgwen

stupididiot69er September 18th, 2004 04:10 PM

so I'm a poster
and I know it doesn't matter to you, but it's true... anyways I was just warning people. and trying to give them tips on hoe not to get found you don't have to believe me or disconnecting, or any of the stuff that I say, but in the end we'll find out who isd right (BTW I'm not suggesting that I'm right)

stupididiot69er September 18th, 2004 05:43 PM

morgwen I'm not trying to prove a point here ecxept that it is possible to get 2 file types in one. a long time ago my computer crached because of a virus on a pic that I downlaoded. luckily it didn't attack my ghost so I was abble to restor. so well i guess it's possible to have a file that shares 2 file types.

Morgwen September 19th, 2004 01:29 AM

Quote:

Originally posted by stupididiot69er
morgwen I'm not trying to prove a point here ecxept that it is possible to get 2 file types in one. a long time ago my computer crached because of a virus on a pic that I downlaoded. luckily it didn't attack my ghost so I was abble to restor. so well i guess it's possible to have a file that shares 2 file types.
Which files type was this pic? Perhaps this pic was in an attachment or within a zip/rar archive. I tried to explain you why you canīt get a virus through a MP3 or a pic. A virus must be activated, you can execute it directly this is an .exe file or through other software which executes files (like an attachment). Media players and pic viewers donīt execute files they just decode the known formats and show it to the user, if a file format isnīt readable (like a .exe) you will get an error message, so again its not possible to get a virus through a MP3 or a pic (jpeg, .gif etc.).

If you donīt believe me search the web for information, perhaps there is a technique which I donīt know, to proofe your point. As long you just write such bullshit and accuse companies without proofes I will call you an idiot.

Quote:

anyways I was just warning people
Warning people is good but NOT WITHOUT PROOFES, this is not a "I need attention" forum. This forum is for information which are investigated, so the next time when you try to scare the people without a proof I will delete the post!

Morgwen

Morgwen September 19th, 2004 11:42 AM

Quote:

Originally posted by Peerless
ANYTHING IS POSSIBLE...A VIRUS CAN/WILL BE ANYWHERE ITS MAD CREATOR DECIDES IT WILL BE...
No. The best programmer canīt change some rules. The links Kath posted show only that there is a problem with jped files, so the programmer discovered a security hole. But I have to repeat I never read or saw anything about a MP3 virus, actually the genius who can bend the rules donīt exists. About the pics i am also sure that all other formats are still save and that the jpeg format will be reworked.

Morgwen

Morgwen September 19th, 2004 11:47 AM

Quote:

Originally posted by KathW
A bit of info ..

http://www.sophos.com/virusinfo/articles/perrun.html

Good link, thanks Kath.

They are talking here about an attachement, I mentioned that this can happen.

Morgwen

Disconnecting September 19th, 2004 12:12 PM

KathW beat me to it:

Quote:

http://www.sophos.com/virusinfo/articles/perrun.html The virus, known as W32/Perrun-A, It spreads in the form of a traditional Win32 executable virus (usually called proof.exe), making changes to the Registry to mean that JPEG graphic files are examined by an extractor (called EXTRK.EXE) before they can be viewed. If the extractor finds viral code inside the graphic file it is executed.

As for a virus/spyware infecting your computer through an .mp3 thats just a hoax http://www.f-secure.com/hoaxes/mp3vir.shtml


If you did get spyware from anything related to mcdonalds it would be from there website wich im betting wasnt the case but I think this thread was just supposed to be a reminder to check for corrupted data and keep the networks clean.

mstfyd September 19th, 2004 12:44 PM

Quote:

Originally posted by stupididiot69er
I don't know how it works. i guess they can put a program in it and it's a mix between exe and mp3. there might be some type of program that lets you do that/ or some way to do that.
As is pretty apparent by anything I've posted, I'm not the most tech savy person, but could what you are talking about be similar to when spyware is disguised like this:
email.doc _______________.exe (w/out the line of course)
where the "exe" exceeds the space alloted for listing the email so is not visable as an exe?

Morgwen September 19th, 2004 04:58 PM

Quote:

Originally posted by Disconnecting
As for a virus/spyware infecting your computer through an .mp3 thats just a hoax http://www.f-secure.com/hoaxes/mp3vir.shtml
I think this proofes my point.

Quote:

There are no viruses to infect MP3 audio files. There is one widespread fake warning on such virus in circulation. It looks like this:
Morgwen

stupididiot69er September 21st, 2004 04:27 PM

well than I guess you proved me wrong before I could prove myself right. but I still stand by the believe of this happening. so even if you may think it is not possible, lets still be carefull about what we downlaod and what is shared on the network. all p2p networks are at risk because the riaa is pushing the limits of technology to stop us.
by the way maybe if we share these files it wouldn't matter but if we download them, we all know that it is easy to brake in someones computer, and as mentioned before when you download things you need to give your ip. maybe that's what they use and they hack in to monitor us or drop a file in our computer whixh gives them all the information they need. maybe they also search for files on the network and download them to get our ip's. contradict me if you want but what is here I know can not be contradicted as one can do this from his home computer.

mstfyd December 18th, 2005 07:54 PM

:eek: After reading the article re: Sony's depositing a rootkit on its cd's,

http://www.sysinternals.com/blog/200...al-rights.html

http://lists.webjunction.org/wjlists...er/039005.html



doesn't it make paranoia & limiting the scope of transgressions to your own experience just a little naive? They were caught and eventually had to recall the cd's (b4 the recall, the Dave Matthews Band was posting inf on how to find it), but what happens should the next one go unfound?

:) *applause & appreciation to Mark Russovich*:) . It is a blessing to have a talent which can be used to help others.

agnew December 23rd, 2005 01:45 AM

Wow,,, makes me glad I suport my local fish & chip shop!:)

Hyper-kun December 23rd, 2005 07:32 AM

You can of course infect your computer through any kind of file. Executable files are just the most blatant obvious way. Nonetheless the same is very often possible through pictures, audio files, videos etc. This is especially true on Microsoft Windows because it is the most widely deployed software and there are countless well-known exploits for this platform and its standard applications.

Also multimedia software like audio and video players for Linux and other operating systems has frequently serious bugs - actually they are just discovered, they exist all the time - that would allow compromise of your account - and thus likely your complete computer - just by playing an infected audio or video file.

Even worse, you can get your system infected by checking a file for viruses because after all the people who program this software are not really any more intelligent than any other programmer.

If people only talked about things they had a clue of, this place would be very silent.

verdyp January 17th, 2006 06:29 PM

McDonald offers = download through Sony software
 
I've seen these McDonald offers in France too. It was clearly stated that this was a free offer to promote the Sony's online music shop. So what you won was a ticket number, with which you coulddownloadthe music fromthe Sony's online music store. But to activate this number, you first needed to accept the EULA for the Sony's downloader kit, and register it with your email address and true name (verified by sending back a confirmation number through your email) which was needed to validate your number. The kit also permanently assigns you a UUID alsoassociated to a personal cookie used in your browser.

So, you could download free MP3's, but these MP3s contain watermarked fingerprints with your personal registration number or Sony transaction number encrypted in it. If you later share these MP3s on the net, your digital fingerprint is visible in it.Sony assumes that such a file present on the net is a proof that you have violated their EULA, because such fingerprint uses a strong enough cryptographic algorithm which should be impossible to generate randomly by someone else. But Sony ignores the fact that fingerprinted files may be stolen on user's harddisks by hidden softwares using the same technics that Sony used to install their rootkits.

Until it is proven that Windows is reliable for its storage, I don't think that any DRM fingerprint found in a downloaded MP3 file can be used as proof of any EULA violation by users. It can only be used within investigations to detect which users may beviolating EULA, but then the act of counterfeighting still requires other proofs, notably the correlation of other fingerprints and Internet access logs collected by ISPs.

But the bad thing is that fingerprints are also inserted within all the legitimate MP3 you create yourself with addons implemented in your player (WMP, RealOne Player, QuickTime/iTunes, WinAmp), and as well in your photos and video made by your camera, or documents created with your favorite office application. These fingerprints, are also correlated externally within undeclared databases each time you send orshare these files legally.

Today, third party databases are so powerful things that they can really spy on your whole life: just ask yourself why you start receiving personal adds in your snailmail letterbox just afewdaysafter you have moved to a new location, from merchants you evendid not know before, and you'll seethat new database recordsadded by your bank or post office or phone company or travel agency or cable TV provider (or even public services like health care, tax services) are sold to advertizers.

With so much information about you, it's not difficult to correlate many things about new contents on the net. But the dangerous way is now to use these data,often collected without your knowledge or control (whichmay contain errors or incorrect correlations) as evidences for alleged illegal activities. Media companies consider that this type of proof is insufficidently strong to create proofs, sothey want to justify this with even more spying on your daily activities, as if we were not already too much spied often illegally.

ultracross February 12th, 2006 03:22 AM

Quote:

Originally posted by Disconnecting
Hell you can even get virus from pictures.
No you can't. You are reffering to a Microsoft Windows flaw in the JPEG engine that is used to render JPEG images. The only thing that this flaw can present a problem is that a specially crafted JPEG image could create a buffer over flow and execute remote code. It cannot install a virus. And the code that can be attached to it is limited to 1028 bytes. (1KB)... for this code to present any REAL problems, it would have be larger than 1KB in size. That said, never open attachments unless you specifically requested it or knew it was being sent from a known contact prior to opening it. Most people just randomly open attachments because there name was in the email. (can i say dumbass??)

verdyp February 12th, 2006 04:08 AM

Quote:

Originally posted by ultracross
No you can't. You are reffering to a Microsoft Windows flaw in the JPEG engine that is used to render JPEG images. The only thing that this flaw can present a problem is that a specially crafted JPEG image could create a buffer over flow and execute remote code. It cannot install a virus. And the code that can be attached to it is limited to 1028 bytes. (1KB)... for this code to present any REAL problems, it would have be larger than 1KB in size. That said, never open attachments unless you specifically requested it or knew it was being sent from a known contact prior to opening it. Most people just randomly open attachments because there name was in the email. (can i say dumbass??)
1KB is much enough to call a Windows API that will download a virus from an URL available on an IRC site, and then run and install it. Don't forget that the needed DLLs toperform these calls are already linked into the JPEG renderer which is itself running in the context of the Internet Explorer process, so it has lots of capability. I'd say that danger starts only at 128 bytes of binary payload, or about 200 bytes if there are byte restrictions. But there has been exploits using even less bytes.

Don't forget that this code may also use data or code embedded within valid image file fragments (even if this part produces some "garbage" on screen if that part of the image was effectively rendered).

In addition, you can put this image on amaliciouswebsite whereit is downloaded along with multiple images containing other parts of the exploit code. This code could also be used to remove security restriction settings, that will be used immediately after by an active viral component downloaded from the same malicious page (this active viral component beingnormally blocked by security restrictions).

One common target you could perform within 1KB would be to set a domain into the "safe" security zone instead of the internet zone.

You can also control the sequencing order for these downloaded component, for example by using delayed HTTP redirects or delayed javascript redirects. With thosetypesofredirect, you have a content bodyto downloadthe first component, and later you'll goto the next page that performs the following action.

In all modern attacks, the first steps to viral infection is first to disable the security restrictions that will allow a virus or rootkit to be "trusted" by the host and then install itself without notice.

verdyp February 12th, 2006 05:24 AM

Note that the sophos-discussed technic is in factvery powerful: you can build some code that is apparently inoccuousbecauseit doesnot contain any dangerous code, or call to dangerous OS APIs.

However, if this code can be installed so that it will be able to silently scan any download image or file, just waiting for the file that will contain some valid and encrypted signature, then this code may recognize that signature and choose to extract the relevant attack code from the data, and then run it, even if you have enabled the NX-bit that prevents data to be executed (notably the CPU stack or heap which is commonly targetted by buffer overflows).

Even though the stack or heap remains protected, the "sleeping" background listener may already have enough code to allocate an executable memory block, put the extracted data in it, and then run it. What was apparently a non dangerous image (and that may appear with some minor or nearly invisible garbage noise in the image, comparable to white noise commonly found in photographs or in image scans, or in "antialiased" pixels or sound framesmay still hide enough information to contain arbitrary code.)

The solution for this problem is that the OS should not allow writing in any executable memory fragment, should not allow executing a writable memory fragment, and the API call that changes a writable block into an executable one being contantly monitored by an antivirus looking for dangerous codeinthisdata fragment before it gets a chance to be executed. If the antivirus finds malicious code in the data block, the APIthat transforms a writable block into an executable block will return an error,and the block will remain data, possibly still writable, but not executable.

Additionally the antivirus scanner should list the process as possibly infected, and any further call to change the status of a writable block should be slowed, and the antivirus should signal an alert tothe user about the possibly infected process that should be killed (this would kill the sleeping code that infects it, such as a modified system DLL or system hook). This could be part of the heuristic engine. The suspect part of code that calls the memory status change API should be reported, in order to find and detect it.

Note that in most common applications, there are very little valid code that changes a writable memory block into an executable one. This code is typically found in avery small part of "JIT" compilers (on .net or in a JVM), or in debuggers for programmers, or in program loaders (that change the block read from disk and gives it the permission to run). This code isgenerally completely isolated within a single DLL or executable, and should be digitally signed (if not, the antivirus engine should provide its own database of verification signatures for known DLLs or executables, and the antivirus company should permanently monitor updates made available to this code by the OS or VM vendor, the simplest being that the OS or VM vendor releases this code with an embedded strong digital signature, such as Authenticode).

Unfortunately, in Windows, not all executable components are digitally signed: look at the results of the "Digital signature verifier" tool, that reports somefiles provided by Microsoft itself, notably in system drivers. There are others in fixed-size bitmap fonts used today mostly in console apps (they really are DLLs containing a resource and a normally empty code, even though they display a .FON extension, and so they can contain code executed at DLL load and unload time and when the DLL is attached and detached to a process)

Notably, look into the Windows Devices Manager: most of them depend on hardware andarenot present in lots of PC, however some are constantandavailable on almost all of them, notably in the "hidden" (non Plug&Play) devices list that isused for system services: critical ones are "AFD", "HTTP", "TCP/IP protocol", "IpNat", "IpFilterDriver", or other filesystem drivers (NTFS, FAT, CDFS...) but some other are just there for devices rarely used and generally not considered dangerous such as "Serial" that manages serial COM ports, "Beep" that just performs horrible monophonic beeps to the PC speaker without any audio device, or "Null" that implements a silent/sink device (and matches the "NUL" filename). If any of those devices, that are loaded by default and given access to the kernel, are infected, they may perform arbitrary code. Most drivers work by installing system hooks for the Win32 APIs they wish to implement.

All these executable files (and notably the .SYS drivers andthe OS loader, because they are loaded very soon during boot time, before the antivirus loads, and because their files are NOT protected and NOT locked during OS execution) should be digitally signed, and their normal location stored in the registry should be protected (unfortunately, it's easy to remove the ACL protections from the critical parts of the registry: you can do it manually from any administrator account even if those ACLs normally do not include "Administrators" rights, only "SYSTEM" rights, where only Microsoft can authenticate as "SYSTEM" because SYSTEM protects your Windows licence). Unfortunately, they are not... and their location and filename on disk is constant, making them easy to attack if there's noantivirus to protect you from silent additions or changes in the list of system devices (Windows informs you only with PnP devices).

ultracross February 12th, 2006 08:04 AM

Nice explainations (albeit long). But the problem is usually not in the specification of a certain protocol, but in the implementation. As in the case of the JPEG rendering flaw, it was the microsoft code which allowed the vulnerability, not in the specification of how to render JPEG images.

Hyper-kun February 12th, 2006 10:07 AM

ultracross, it would suit you very well to accept that you were wrong. From what you write I get the strange idea that you do not even understand your own words.

You write this:
"it was the microsoft code which allowed the vulnerability"

and at the same time you claim it's impossible to get infected through pictures? Please explain what's the effective difference? The effect is exactly the same. Actually this is even more dangerous as it's very hard to protect yourself against it. Just being smart won't help.
Such flaws are of course more severe by magnitudes if they exist in Microsoft products because that's what virtually everybody uses nowadays.

There's no point in bashing Microsoft here. Such flaws exist in all kinds of software and
not just software for Windows. Software for Linux, Mac OS etc. has often the same kind of vulnerabilities. I suggest
you read bugtraq for a while:

http://www.securityfocus.com/archive/1

It is somehow ironic that just a moment after my first reply,
the now well-known WMF bug was discovered or rather published. There is really no reason to call the average user a "dumbass". With these kind of bugs the user does not have to do anything "wrong".

I beg you, ultracross and others, stop spreading your *dangerous* smattering. Finally, for those who think they can clean their systems from worms and viruses on-the-fly using some tool, read this:

http://www.microsoft.com/technet/com...mt/sm0504.mspx

Even Microsoft is smart enough to comprehend this.

ultracross February 14th, 2006 06:33 AM

@Hyper-kun
And who the hell are you to say that I was wrong? It WAS a microsoft flaw. Their implementation of the JPEG specification WAS written poorly which introduced this vulnerability. If microsoft would build to suite specifications instead of what they think would be better (e.g. MSIE), they would be a better software company.

Stop being such a lamer. Who are you, a Microsoft PR agent? Its a good practice aswell as etiquette not to start **** in threads that you know nothing about.

Hyper-kun February 14th, 2006 12:22 PM

It should be obvious that I'm neither a lamer nor a Microsoft PR agent. I also doubt that Microsoft needs your advice and that you know any kind of etiquette. You should probably improve your reading skills. I never claimed that there was no bug in code by Microsoft handling JPEG images. By the way, I know damn well what I am talking about.

I'll explain it a little simpler for you:

I wrote: "Hell you can even get virus from pictures."

You claimed: "No you can't."

That's what I referred to when I said "you are wrong". I repeat: You can infect your system through any kind of file including pictures. All it takes is an exploitable flaw in applications handling these files. Actually it doesn't require files at all. It is possible to infect a system by any kind of input as long as there is an exploitable bug in the implementation handling this input.

You wrote: "You are reffering to a Microsoft Windows flaw in the JPEG engine that is used to render JPEG images."

You are wrong again. There are far more bugs than this one. I was not thinking of any certain bug. And just to repeat myself, this problem is not unique to Windows. Windows and software for it is just the easier bait due to its popularity. Nonetheless there are inherent design flaws in Windows which make these issues a little worse than they are on other systems.

If you want me to provide an (incomplete) list of software that is exploitable I could do that. It's probably not wort the time. You can just read Bugtraq yourself:

http://securityfocus.com/archive/1

For example, the famous WMF exploit works fine for a lot of standard picture filename extensions including "jpg" and "jpeg". You just have to rename the WMF file. This might be misleading though because you probably argue that this isn't a JPEG file. WMF is still a picture format nonetheless.

Last but not least, for most users you don't have to be that smart at all since they will fall for "whatever.jpg.exe" because - nobody knows why - Windows hides known filename extensions by default. For the common user this makes it impossible to differ between a mere data file and an executable file.

In any case it's not as simple as "executables are dangerous but data files are harmless".

ultracross February 14th, 2006 04:04 PM

after phillipe posted, i pretty much gave into his explanation, quietly though. why am i even bothering to reply to you,.. oh yes, im subscribed to this thread...

*unsubscribes*

peace! im out.

*walks away all cool*

(and yes, i am always this stubborn. especially when people rub sh!t in. because then its just stupidity that propells them to further escalate something into a flame war.)

Sgt July 22nd, 2006 05:27 PM

Hyper-kun Is Right
 
Hyper-kun is right you can exploit any file written

When we were flooding the networks with corrupt Mp3, wmv, wma exct

See my other posts

we created certain code in the files that when the person trying to run them (your computer slows down as it does certain things) the files were actually writing certain other files in the windows/system32 directory (as an example)

this was done on unix, linux, windows, the mac system exct

These files were also made to scan your hard drives for P2P and any d/l program you had on your computer ie Gozilla (I Know it's old, but it's an example)

The old kazaa system was flooded by fake files ie mp3, windows media files, jpg, html, exct (see my other posts) And is now considred nearly dead

the winmx system is also considered nearly dead

bearshare is under attack now

and as I have already stated they are now starting to attack this network

If u want to spot the fakes (I have already posted how) not 100%, but near enough

Read The Posts How

Sorry can't tell you what files, and how to stop them (would be sued)

But I Can Tell You This

Any File Out There is Usable

Sgt

AaronWalkhouse July 22nd, 2006 05:35 PM

:rolleyes:

Lord of the Rings July 22nd, 2006 05:47 PM

Quote:

Originally Posted by Sgt
Sorry can't tell you what files, and how to stop them (would be sued)

WT*
Explanation would be nice. Sued by a company you no longer work for? Being constructive would be to give examples of such & some answers. Otherwise it sounds like heresay.
Quote:

Originally Posted by AaronWalkhouse
:rolleyes:

:D

Sgt July 22nd, 2006 06:08 PM

Hey lord
 
Hows it going

The reason I can't tell you which comp ect is, it was in the contract I signed

What I can tell you is this

it was a company that likes music

:cool:

Sgt

Sgt July 22nd, 2006 06:25 PM

Oh nearly forgot
 
Oh nearly forgot there

just thought of this It's not really a music file (I Know, this is cryptic, but goto be careful, can't give the the first files complete name, but, If U look for a file with ORKL in the title.

?????


Sgt

arne_bab July 23rd, 2006 01:33 AM

How comes, you run code in Linux?

Would really interest me, how you manage that (and with which user-rights).

foolofthehill July 23rd, 2006 04:08 AM

Nonsense Sgt.!!
If you really wanted to let us know, you would have gone to an internet cafe, logged in with a new psydo and would have posted it. Or you would have posted with a socket5 proxy to make sure you stay anonym. Or used the PM function telling some of the developers secretly;.......since they are the ones who have to prevent things that happened with the other clients, as you've mentioned....
But you put it the way that anyone would have to think you're about to blow the cover of a CIA agent.........gimmy a break, okay!!

http://i64.photobucket.com/albums/h1.../Smilywais.gif

Hyper-kun July 23rd, 2006 07:19 AM

I believe Gunsou err Sgt. is just a joker. We all know that filenames are rather irrelevant. You can't tell from the filename whether a file is good or evil. Though there's still some spam that's easy to recognize by simply looking at the filename. I guess that's called overkill. Even the stupider users recognize these files by now. The trick has been overused, people are more cautious and Gnutella clients have rudimentary spam filters which catches most of the simple spam anyway. It would be fairly idiotic to mark dangerous files.

Anyway, your advice, foolofthehill, to use a proxy or whatever isn't really clever. If someone has signed a NDA - which is fairly normal nowadays in many business areas and IT anyway. By saying too much one could easily expose his identity. Not to you, but to those who he is or was working for. Many business contracts nowadays have a clause that says you're not allowed to work for a business in the same area for a couple months. And of course you're not supposed to tell your next boss the trade secrets of you learned at the other business. Telling these to the public is several degrees worse of course. That has little to do with being an "secret agent" or whatever. Of course, for some people it's pretty hard to keep a secret. It's well-known that stupid hackers expose themselves and get caught this way.

Rest assured those who work against Gnutella skim through these forums too.

Further, sometimes people ridicule a topic so that it isn't taken seriously anymore. I doubt that businesses already "attack" Linux users but it might be time to get started. "file permissions" and "user privileges" are not a huge obstacle when it comes to Joe Average. The only real obstacle is that Linux is not as stream-lined as Windows and any known exploit will only work for a small portion of all Linux installations. That said, there was Mac version of the SonyBMG rootkit too and now that Apple switched to the x86, everybody predicts a huge increase in exploits for Macs simply because it's less work and x86 has some inherent flaws that make it easier exploitable than other architectures like PPC or SPARC etc.

Sgt July 23rd, 2006 07:31 AM

Hi Hyper-kun
 
Hi Hyper-kun

And you also know that to access the internet You have to go through an Isp

Which can and does, in some countries keep records of your internet activities

In the UK Their trying to make it A law that they have to hand over these records if requested by the police.

that's how their now starting to catch some of the kiddie porn freaks over here

So proxies as you know are usless

Internet cafes, smile your on camera, they also log everything you do and access, like your own computer does

Sgt

foolofthehill July 23rd, 2006 07:53 AM

I'm pretty much aware about such contracts, which I had once signed myself. However, Sgt. posted his comment in a way like "they're about to bring you <gnutella> down, one way or the other".......
If his post was meant to be helpful (in a preventing way), he would be able to find means and ways to hint into the right direction without exposing himself to the public, or his former employer.
But not doing so, or excusing himself not to do so, leaves me with 2 alternatives to think.........the first one has been implied by LOTR and the second one would be to assume that he wants to spread (intentionally) a certain kind of unease around the Gnutella network......

@Sgt.
Don't take my opinion as an offense,......rather think about how your comments are understood from people who might not be that deep into the matter as you stated to be (or were).
I don't even want to know what's going on behind certain doors in regard to P2P, my life is already exciting enough; but it will come down to how you see the approaches of certain groups (of which you say you have knowledge of), and to the conclusion you draw from this knowledge (in an ethical way).
And let me tell you, being a German, I have learned not to accept every and all because of laws and rules.........(which is actually your excuse,....)

Just my 5-cent-worth
http://i64.photobucket.com/albums/h1.../Smilywais.gif

Sgt July 23rd, 2006 08:29 AM

foolofthehill
 
Hi foolofthehill
No offence taken just looked back and seen what I had written

I did not mean to Imply that this forum was under attack, what I was supposed to have said, the record companies and Film companies are going after the people that use the P2P networks

U download a certain song or a film, you go to play this song or film

Ur computer will slow down for about 10-20 sec while certain files are being written in the background because of the code written into the song or the film

The first file that will be written has ORKL in it's title, (that's not it's full name)look for the file on your hard drive

the computer will then be checked for any P2P programs and the like

the program written to your computer, will then try and access the internet

this information will then be transmitted to the company I used to work for

that way they get an Idea of what networks they can flood with fakes

also sent at the time is the Ip address of your computer

That way they can tell who you are

I think you also asked which firewall I use on my gaurd computer that accesses the internet, I use Zone Alarm Security Suit, where all the programs have to ask for access to the internet (Don't know why you were intersted in that) :)

Sgt

foolofthehill July 23rd, 2006 08:43 AM

Quote:

Originally Posted by Sgt
I think you also asked which firewall I use on my gaurd computer that accesses the internet, I use Zone Alarm Security Suit, where all the programs have to ask for access to the internet (Don't know why you were intersted in that) :)

Sgt

You mean in the other thread where you had problems to access the forum...?
Well, that was just a thought that port 80 or HTTP might have been listed into the access block list, at a time I had by myself the same problem with other forums......; I then added whatever possible and connected to those forums to my exception list, but didn't change anything....

Two month long no problem at all, and since yesterday I have to use F5 to get access to the Vietnamese Forum I'm in.....

Thanks anyway for giving some more clearance about your comment; appreciate it....
http://i64.photobucket.com/albums/h1.../Smilywais.gif

Sgt July 23rd, 2006 09:03 AM

hi foolofthehill

Aha so now I remember, why u asked that

:) :)

Sgt

Hi all
:)

I just remembered somebody also asked me about any other security programs I could recommend

The one I Like to use is peergaurdian 2 or pg2 for short

I like to use that when using networks Like P2P

:) :)


Sgt

Sgt July 23rd, 2006 02:04 PM

Strange
 
Hi

Talking of Pg2, I can't get onto the forum and get the Dns error page In IE
and the can't connect to server In firefox

If I use block htttp

This comes up a lot
PSI Fakes PHOTOBKT Split 3.118.213.480, 62.65.118.155:1292

when i checked out the Ip
I was taken to this page
http://fpad.filefront.com/?http://www.filefront.com/

:confused:

Sgt


All times are GMT -7. The time now is 11:23 AM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
SEO by vBSEO 3.6.0 ©2011, Crawlability, Inc.

Copyright Đ 2020 Gnutella Forums.
All Rights Reserved.