[19468] in bugtraq
trojaned Reality Fusion app
daemon@ATHENA.MIT.EDU (J Edgar Hoover)
Sun Mar 4 17:17:27 2001
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-ID: <Pine.BSF.4.30.0103021924420.3850-100000@totally.righteous.net>
Date: Fri, 2 Mar 2001 20:02:41 -0800
Reply-To: J Edgar Hoover <zorch@TOTALLY.RIGHTEOUS.NET>
From: J Edgar Hoover <zorch@TOTALLY.RIGHTEOUS.NET>
To: BUGTRAQ@SECURITYFOCUS.COM
The executable rfupd.exe included in the Reality Fusion products bundled
with many popular cameras sends the following data to 204.176.10.168 port
80 every time you use the app, reboot your computer or change
configuration.
-----
GET /GCSE/Messages/todolist04.tag HTTP/1.1
If-Modified-Since: Sat, 03 Mar 2001 00:43:39 GMT
If-None-Match: "e9ffe1fc7aa3c01:87a"
User-Agent: RFUPD
Host: www.RealityFusion.com
Connection: Keep-Alive
-----
This is particularly disturbing since the application by its nature
enables video/audio surveillance of the user.
I'm real curious what kind of information is obfuscated in the string
If-None-Match: "e9ffe1fc7aa3c01:87a" too.
Anyone interested in dissecting the (windows) application can find it at
http://totally.righteous.net/rfupd.exe
Cheers,
zorch
