, SecurityFocus 2004-06-11
The author of a free Trojan horse program favored by amateur computer intruders found himself with some explaining to do to the underground last month, after his users discovered he'd slipped a secret backdoor password into his popular malware, potentially allowing him to re-hack compromised hosts.The program in question is
Like other species in a genus that includes BO2K, SubSeven, and Beast, the working end of Optix Pro is a server that the hacker must insinuate into a victim's computer, either through subterfuge -- by misrepresenting it as an image file or an electronic greeting card -- or by uploading it to an already-compromised machine. The hacker sets a password on the Optix Pro server, so that no other would-be intruders have the ability to slip through the open backdoor.
That is, none except for the author, a coder named "Sleaze" (he spells it "s13az3"), who secretly embedded in the program a random-looking 38-character "master password" that was known only to him.
Though the password was encrypted in the binary, at some point suspicious hackers teased the cleartext version from RAM, and it began circulating quietly in the underground, possibly as early as last year. Last month it surfaced on a hacker website, forcing Sleaze into an
In his defense, Sleaze noted, "I have never directly denied the existence of a master pass." He added that he never used the backdoor-within-a-backdoor to take over machines properly owned up by his users. He only included it for his own security.
If the FBI ever got too close to Sleaze he had intended to release the secret password to the world, causing Optix Pro to become less popular among intruders and easing the pressure from law enforcement. "That's when a master pass could potentially save a programmer," he wrote.
Merely writing a backdoor program is not illegal under U.S. federal law, but arrests have been made in other countries, most recently
In a disclaimer evocative of advisories from more mainstream software vendors, Sleaze pointed out in his posting that the backdoor password in circulation only works on an older, unsupported versions of the Trojan horse, and that the latest version of Optix Pro uses stronger encryption to protect a different master password. "So make sure you update!," he wrote.
At least one security expert says there's a lesson to be learned from the whole affair. "It obviously says you should always use open-source Trojans," says Mark Loveless, a senior security analyst with Bindview Corporation. "That's the moral. You can't even trust Windows malware."