<<< Date Index >>>     <<< Thread Index >>>

Backdoor in RelevantKnowledge adware (What are we fighting for?)




Authors:         YAG KOHHA (skyhole@xxxxxxxxx), Lame
Title:           Backdoor in RelevantKnowledge adware (What are we fighting 
for?)
Vendor:          TMRG, Inc.

Description:

RelevantKnowledge  is  an  adware  distributed  with different shareware
projects, e.g. Artisian Burner.

RelevantKnowledge   was   found  to  contain  backdoor  proxy  component
rlvknlg.exe   (Marketscore  OSSProxy),  which  is  configured  to  allow
incoming  network  connections  on TCP/8254, probably acts as open proxy
and  also performs keylogging and monitoring for active windows content.
Component can not be disabled by user.

Details (by YAG KOHHA, Lame):

Recently I download freeware CD burner software to create some absolutely legal 
copies
from ISO image. Of cause where is adware in installer which promise to "boost 
your
internet Connection" and "free coupons". 
After I finished my works I uninstall burner and adware via add/remove programs 
and reboot
the computer. After reboot I check Windows Firewall rules. In exception tab I 
found
RelevantKnowledge application. I map'ed my host and found strange HTTP server 
on port 8254
which answers as OSSProxy. I check netstat and found that this port used by
%windir%\system32\rlvknlg.exe process which also referred in
Software\Mircosoft\Windows\CurrentVersion\Run\ key. I check this file and found 
that this
programs hooks keyboard, mouse, current window and post info to the
http://www.relevantknowledge.com/upgraderesult.aspx site via locally installed 
proxy. I
check this site and found that "privacy procedures are regularly audited and 
certified by
the nationally-recognized firm, Ernst & Young, who assure that we conform with 
the
international trust services and privacy principles developed and managed by 
the American
Institute of Certified Public Accountants"
(http://www.relevantknowledge.com/RKPrivacy.aspx).
So guys, may be I miss something. If I see software which doesn't get removed 
via Add/Remove
Programs,  breaks  my firewall settings, hook my keyboard and mouse, and has 
remote
management capabilities, I call it Remote Access Trojan. What should I do to be 
"conform
with the international trust Services" and Ernst & Young say: "This is good 
code, Joe,
well done!" when I write new all-in-one client for my botnet? Or this is part 
of anti
piracy program? And MPAA want to know which films I burn on DVD? Or this is 
Uncle Sam's
hand? I don't understand. 

YAG KOHHA, Lame

File with binary and disassembly can be found here:
http://www.secyrity.nnov.ru/files/ossproxybd.zip
Archive password is "backdoor".

-- 
/3APA3A
http://www.security.nnov.ru/