Amiga.org
The "Not Quite Amiga but still computer related category" => Amiga Emulation => Topic started by: scholle on March 31, 2005, 07:22:16 AM
-
Dear Friends of the Amiga!
Tonight I found some sort of proof that this machine,
currently runnig UAE was corrupted by some sort of backdoor
program. As we all know, for AmigaOS there is no really
good firewall software, OS3.9 has no memory protection,
so...
I'm still learning to configure my Personal Firewall
(Sygate) correctly for the Windows 2000 side, I guess
the machine was wide open until now.
What I found first was a strange behaviour for SFSSalv.
SFSCheck (SmartFileSystem 1.236) reported a bad partition:
Lass jucken> sfscheck hd1
Partition start offset : 0x00000000:445d5e00 End offset : 0x00000003:45b30400
Surfaces : 7 Blocks/Track : 255
Bytes/Block : 512 Sectors/Block : 1
Total blocks : 25209555
Device interface : NSD (64-bit)
Checking RootBlocks
...okay
Checking AdminSpaceContainers at block 2
...okay
Checking NodeContainers at block 7
ObjectContainer at block 27543 doesn't contain node 95797
...damaged
I thought it would be best to save all data to
a free partition. SFSSalv is installed in C:,
but when I try to run it, I always get a
"Unknown command" error. This is true for
SFSSalv 0.17 and SFSSalv0.16, no matter where
they reside. I also found a very old version
somewhere, but it didn't work properly.
I tried to find the problem with SnoopDOS,
but nothing. Strange thing was that whenever
I ran VirusZ, it presented me a suspicious
CPU interrupt vector, level 6 pointing to
to a destination outside the system area.
After a while I found a file with the
the string "sync" of zero bytes length
in SYS:
It was obvious that it didn't belong
there, so I deleted it. Then I began
to fix the security holes on the Windows
side. At this point I was not sure where
the problem came from, but at the end of
a night fuddling and restarting another
strange occurance in SYS: caught my eye.
It is a binary called uae_rcli, the size
is 8956 bytes. I'm presume it can be
used to open a remote connection to a
UAE-System, but I'm not good at coding
myself. However, a fast look with a HEX-Editor
is always worth it, right? So here's
some of the ASCII data that was contained
in it:
Usage: [-h|?] [-debug] [-nofifo] []
fifo:uae_rcli/wmke -> Starting fifo-handler
run nil: l:fifo-handler -> Reopen fifo
-> Spawning shell
run execute fifo:uae_rcli/rsk echo "-> Remote cli running"
-> No fifo found
endcli endshell quit -> Exiting
If someone wants to take a further look
at this thingy, I'm willing to send it
to a trustworthy person for further analysis.
The display of the altered CPU vector
has vanished, but I don't know wether
this is due to my actions or due to
some advancement of data residing on
the HD. We will see...
I just hope this system will survive long
enough to be taken to OS4.0 somewhen. :-)
Take care!
-
SFSSalv failing and VirusZ reporting modified vectors is probably no way connected to this.
However, UAE is wide open to malware, I spotted this years ago. In fact, the host system filesystem is wide open for access from within the emulation, too. So "amiga" apps could well plant x86 files to host system.
Anyway, if you want this thing to be analysed, just mail it to me.
UPDATE:
another strange occurance in SYS: caught my eye. It is a binary called uae_rcli, the size is 8956 bytes. I'm presume it can be used to open a remote connection to a UAE-System,
uae_rcli is standard part of UAE. uae_rcli.c (http://cvs.sourceforge.net/viewcvs.py/*checkout*/uaedev/uae/amiga/source/uae_rcli.c?rev=1.1.1.1)
It could still be abused, naturally. But as of itself it isn't viral or backdoor.
-
I'm quite sure that the host system is compromised, too.
But it's harder to fix, because changes to the system are not
so "visible" as in AmigaOS, at least to me.
uae_rcli may be part of the original UAE, but I've never installed it to my system for sure. So it must have come from outside.
The Sygate FW constantly shows strange traffic from constantly changing IPs with a faked domainname/WWW-Adress, but all owned by AKAMAI.
The problem is with sending the file is, I don't trust my ISPs DNS & Mail server; I've lost several important emails for unknown reasons. But I'll give it a try, thx!
Best regards,
Scholle
-
Don't bother with uae_rcli. It's just compile of the source code I posted before.
To me it looks like your system is infected by either spyware/adware or virus, and I seriously doubt WinUAE has anything to do with it.
I recommond you scan your system with good AV (if you don't have any, try for example AntiVir (http://www.free-av.com/)), Ad-Aware (http://www.lavasoftusa.com/software/adaware/) and Spybot (http://security.kolla.de/).
-
Piru wrote:
Don't bother with uae_rcli. It's just compile of the source code I posted before.
To me it looks like your system is infected by either spyware/adware or virus, and I seriously doubt WinUAE has anything to do with it.
I recommond you scan your system with good AV (if you don't have any, try for example AntiVir (http://www.free-av.com/)), Ad-Aware (http://www.lavasoftusa.com/software/adaware/) and Spybot (http://security.kolla.de/).
Aswell as using the programs Piru mentioned, also install Microsoft Anti-Spyware (http://www.microsoft.com/athome/security/spyware/software/default.mspx)
Spyware Blaster (http://www.javacoolsoftware.com/sbdownload.html) - As reccomended by Spybot to block stuff it can't immunize
Bad IP Updater v1.5 (http://www.aldostools.com/badipupdater.html) - Site down atm, but this blocks known bad IP's from your machine.
Also run windowsupdate and get any critical security fixes is suggests to have.
-
Hum,
I’ve had no problems with winuae.
Though I’m aware of the potential problems too.
I’ve got Prevxfirewall (http://www1.prevx.com/) (which is a, er, Firewall), but it also monitors for registry changes, program & task launches, and any unauthorised changes to the original system.
If anything changes then you’ll know immediately.
But first, you got to make sure you’ve got a clean system...
-
Don´t do what I tried to do, remove spyware/virus from within UAE. I marked some files I shouldn´t have marked and then hit delete in DOpus. XP didn´t start without those drivers imagine that. And when I attempted a repair/install over the old system it just froze.
Luckily I had an empty 120GB HD lying around(was gonna be file-backup)and clean install(propably around time my XP-installation was 2 years old) and I was up and running again.
Workbench was so much easier, just do a straight copy to another disk/partion and then rename/use early bootmenu if anything weny wrong.
Luckily I had learned the lesson back in the Amiga days:
Never save your work on the same disk as the OS!
-
Hi Blob,
I'm always looking for another good firewall, I wanted to try the one you mentioned, but the link doesn't work.. Seems the FTP is emty. Any other links ? Google isn't that helpfull, just a link to your site.
Edit; Hm..
Is it this one ?
here ? (http://www.freeware4pc.com/utilities/prevxhome.shtml) (Same link to the download..)
Which leads us to here (http://www.prevx.com/)... :lol:
-
Yeah,
Thats the one.
the software brain gets updated quite often....
changed my link to:
http://www1.prevx.com/ (http://www1.prevx.com/)
:-)
-
This was really worth it; AdAware alone found 15 entries. Bad, bad Alexa! ;-)
Many thx!
Scholle
-
scholle wrote:
This was really worth it; AdAware alone found 15 entries. Bad, bad Alexa! ;-)
Many thx!
Scholle
Make sure you don't rely on AdAware alone. The others will find things AdAware won't and vice-versa.
-edit
Peer Guardian (http://www.methlabs.org/) must have tool if you value your privacy/security under Windows.
-
Thanks, I've used most of the other recommended tools as well, maybe my choice of English words is not thus correct.
However, the problem with SFSSalv not working is the same as before...
Best regards,
Scholle
-
Use snoopdos to find what the problem is.
-
@Scholle
Just a hunch, but try:
Protect C:SFSSalv +e
and run it again.
-
It would have been nice if it was that easy. :-)
But I tried PROTECT C:SFSSalv -e, and the error
"File is not executable" occurred. So it is there
but does not want to be started.
Appended is a full Snoopdos.log, for me it does not
help much...
SnoopDos-Log started am Samstag, 09-Apr-05 um 17:58:38
Prozess Name Aktion Ziel Name Optionen Res.
------------ ------ --------- -------- ----
SnoopDos aktiviert um 17:59:04
[2] Workbench #DISK_INFO 4029124 CD0 OK
[2] Workbench #DISK_INFO 4029138 ENV OK
[2] Workbench #DISK_INFO 402914C RAM OK
[2] Workbench #DISK_INFO 4029160 HD0 OK
[2] Workbench #DISK_INFO 4029174 DF0 OK
[2] Workbench #DISK_INFO 4029188 HD1 OK
[2] Workbench #DISK_INFO 402919C HD2 OK
[2] Workbench #DISK_INFO 40291B0 DF1 OK
[2] Workbench #INFO 4149506, 406A222 HD1 OK
[2] Workbench #INFO 4129E9C, 406A222 HD0 OK
[2] Workbench #DISK_INFO 4029124 CD0 OK
[2] Workbench #DISK_INFO 4029138 ENV OK
[2] Workbench #DISK_INFO 402914C RAM OK
[2] Workbench #DISK_INFO 4029160 HD0 OK
[2] Workbench #DISK_INFO 4029174 DF0 OK
[2] Workbench #DISK_INFO 4029188 HD1 OK
[2] Workbench #DISK_INFO 402919C HD2 OK
[2] Workbench #DISK_INFO 40291B0 DF1 OK
[2] Workbench #INFO 4149506, 406A222 HD1 OK
[2] Workbench #INFO 4129E9C, 406A222 HD0 OK
[4] Shell Process FindVar sfssalv Alias Fehl
[4] Shell Process *Lock HD0:WBStartup/sfssalv Read OK
[4] Shell Process #LOC_OBJECT 412B224, 412B17B, FFFFFFFE HD0 OK
[4] Shell Process #COPY_DIR 412B224 HD0 OK
[4] Shell Process #EXAM_OBJEC 4156B16, 412B0F8 HD0 OK
[4] Shell Process #PARENT 4156B16 HD0 OK
[4] Shell Process #FREE_LOCK 4156B16 HD0 OK
[4] Shell Process #EXAM_OBJEC 4156C0A, 412B0F8 HD0 OK
[4] Shell Process #PARENT 4156C0A HD0 OK
[4] Shell Process #FREE_LOCK 4156C0A HD0 OK
[4] Shell Process Lock HD0:WBStartup/sfssalv Read Fehl
[4] Shell Process *Lock RAM:sfssalv Read Fehl
[4] Shell Process #LOC_OBJECT 4030715, 412B17B, FFFFFFFE RAM Fehl
[4] Shell Process #COPY_DIR 4030715 RAM OK
[4] Shell Process #EXAM_OBJEC 4030B6F, 412B0F8 RAM OK
[4] Shell Process #PARENT 4030B6F RAM Fehl
[4] Shell Process #FREE_LOCK 4030B6F RAM OK
[4] Shell Process Lock RAM:sfssalv Read Fehl
[4] Shell Process *Lock HD0:C/sfssalv Read Fehl
[4] Shell Process #LOC_OBJECT 412AD52, 412B17B, FFFFFFFE HD0 Fehl
[4] Shell Process #EXAM_OBJEC 4156B16, 412B250 HD0 OK
[4] Shell Process #FREE_LOCK 4156B16 HD0 OK
[4] Shell Process *Open HD0:C/sfssalv Read OK
[4] Shell Process #FINDINPUT 4156B17, 412AD52, 4129D55 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 1059CEC4, 5978 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 105A2B7C, 2C0 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #END 1055B028 HD0 OK
[4] Shell Process *Lock HD0:C/sfssalv Read OK
[4] Shell Process #LOC_OBJECT 412AD52, 412B184, FFFFFFFE HD0 OK
[4] Shell Process #PARENT 4156B16 HD0 OK
[4] Shell Process #FREE_LOCK 4156B16 HD0 OK
[4] sfssalv *Lock PROGDIR: Read OK
[4] sfssalv #LOC_OBJECT 4156C0A, 416CF67, FFFFFFFE HD0 OK
[4] sfssalv *Open HD0:C/sfssalv Read OK
[4] sfssalv #FINDINPUT 4156C3D, 4156B16, 4129D55 HD0 OK
[4] sfssalv #FREE_LOCK 4156B16 HD0 OK
[4] sfssalv #READ 10599AA0, 105B3F78, 8000 HD0 OK
[4] sfssalv #READ 10599AA0, 105B3F78, 8000 HD0 OK
[4] sfssalv #END 10599AA0 HD0 OK
[4] sfssalv RunCommand 8192 Fehl
[4] sfssalv #FREE_LOCK 4156C0A HD0 Fehl
[4] Shell Process GetVar echo Local Fehl
[4] Shell Process GetVar oldredirect Local Fehl
[4] Shell Process GetVar keepdoublequotes Local Fehl
SnoopDos eingefroren um 17:59:13
Schliesse SnoopDos-Log um 17:59:28
Any ideas?
I've also noticed that I can run processes in the background
in UNIX/Linux style, i.e. using & instead of RUN . My original OS3.1 does not mention that. Hm.
Best regards,
Scholle
-
I've also noticed that I can run processes in the background in UNIX/Linux style, i.e. using & instead of RUN . My original OS3.1 does not mention that.
That's probably because your OS 3.1 manual doesn't cover AmigaOS 3.9 shell features.
Anyway, looking at that snoopdos log. Where is dos/LoadSeg debug?
It does read the file in LoadSeg it seems
4] Shell Process #FINDINPUT 4156B17, 412AD52, 4129D55 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 1059CEC4, 5978 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 105A2B7C, 2C0 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #READ 1055B028, 1059C240, 400 HD0 OK
[4] Shell Process #END 1055B028 HD0 OK
That's LoadSeg reading the executable. But... does it return proper seglist? For that we need dos/LoadSeg enabled in snoopdos.
It could be the executable is corrupt and thus LoadSeg fails to load it.
[EDIT] actually... It does load it ok.
[4] sfssalv *Lock PROGDIR: Read OK
[4] sfssalv #LOC_OBJECT 4156C0A, 416CF67, FFFFFFFE HD0 OK
[4] sfssalv *Open HD0:C/sfssalv Read OK
[4] sfssalv #FINDINPUT 4156C3D, 4156B16, 4129D55 HD0 OK
[4] sfssalv #FREE_LOCK 4156B16 HD0 OK
[4] sfssalv #READ 10599AA0, 105B3F78, 8000 HD0 OK
[4] sfssalv #READ 10599AA0, 105B3F78, 8000 HD0 OK
[4] sfssalv #END 10599AA0 HD0 OK
[4] sfssalv RunCommand 8192 Fehl
[4] sfssalv #FREE_LOCK 4156C0A HD0 Fehl
However, it fails miserably when executing...
-
>But I tried PROTECT C:SFSSalv -e,
He said PROTECT C:SFSSalv +e
+e not -e