EarthStation 5 P2P application contains malicious code

**random nut** · 10-02-2003 07:16 PM

EarthStation 5 P2P application contains malicious code

ES5 info
EarthStation 5 (aka ES5, aka ESV) (http://www.earthstation5.com and http://forums2.es5.com/) is a P2P application first released about 6-12 months ago. The people behind ES5 claim that ES5 is the most secure P2P software in the world. They also claim that they are security experts, and that they have more than 15 million simultaneous users on-line 24/7. In comparison Kazaa, the most popular P2P application, only has about 4 million simultaneous users on-line at any given time of day.

Malicious code
There exists malicious code in ES5.exe's "Search Service" packet handler. By sending packet 0Ch, sub-function 07h to the "Search Service"'s IP

ort, a remote attacker could delete any file the user is sharing. If the remote attacker uses "filenames" with a relative path in them (eg. "..\..\..\WINDOWS\NOTEPAD.EXE"), the remote attacker could also delete files in eg. the windows and windows\system32 folders, or any other folder on the same partition as any of the shared folders. Since most users using Windows are in the Administrators group, a remote attacker could also delete the C:\BOOT.INI file which is a required boot file used by ntldr.

IMPORTANT: This is not a bug! They intentionally added this code to ES5.

Vulnerabilities
There also exists a lot of other vulnerabilities in ES5 (eg. DoS attacks, buffer overflow bugs, and so on), but these all seem to be unintentional. Another advisory may have more info on these vulnerabilities, but I'm not their beta tester so don't hold your breath.

Conclusion
The people behind ES5 have intentionally added malicious code to ES5. If you have followed the ES5 discussions on message boards and read what the ES5 people have said and done (eg. DoS attacking BitTorrent sites), this comes as no surprise. The question then is "why did they do it?" I'm sure they won't tell us, but here's a theory: They could be working for the RIAA, MPAA, or a similar organization. Once they have enough users on their ES5 network, they would start deleting all copyrighted files they own which their users are sharing. The users wouldn't know what hit them.

Tested ES5 builds
ES5 build 1266
ES5 build 2180 (latest version)

MD5 sums of files
MD5 sum (using RFC 1321 source code) of tested files (just in case the ES5 people will remove the malicious code w/o changing the build number)

e35838ef6668abe883344e3a7e734794 *es5beta1266.exe
ce44a1f0542b9132f2debd9866febc65 *es5beta2180.exe
373c30ba0e8b1dce05dcab2acce94a77 *es5_build1266.exe
915de0f8e72be40bf071a86bc9dc2626 *es5_build2180.exe

2,244,663 es5_build1266.exe (ES5.exe - build 1266)
2,347,063 es5_build2180.exe (ES5.exe - build 2180 - latest version)
4,436,309 es5beta1266.exe (ES5 installer - build 1266)
4,553,325 es5beta2180.exe (ES5 installer - build 2180 - latest version)

The official ES5 installer download URL is http://download.es5.com/es5beta.exe , but check its MD5 sum before installing it in case they changed it.

Credits
me

for discovering it (mailto:randnut@yahoo.com)

Exploit code
Go to http://www.geocities.com/esvuln to download the exploit binary if you don't want to compile it yourself.

Source code to esv ("ExpoitStation 5" or "EarthStation Vulnerabilities", you decide) but first a little FAQ...

The rest can be found here http://lists.netsys.com/pipermail/fu...er/011339.html[/b]

**Welsh** · 10-02-2003 08:19 PM

Oh please.
This is a personal thing between Random Nut and ES5, he has been attacking them for a while now.
I think this should be removed until somebody independant has at least checked it out.
I can see at least 10 outright lies in that post.

**darktiger_64** · 10-02-2003 08:22 PM

Could you please identify the 10 lies, and tell us the truth.

**random nut** · 10-02-2003 08:25 PM

Welsh, before calling me a liar, test the code. It's there. That'll prove I'm right.

And for the people who don't know who Welsh is, he's an ES5 fanboy who spammed the K-Lite board today and yesterday. He nearly got banned.

**JiMiThInG** · 10-02-2003 08:30 PM

Well Random Nut has done nothing but earn my total respect with all his "online" actions. However I have since day one said something just doesn't "smell right" about ES5. And I'm far from the only one who ES5 has set of the B.S. alarm for.

**skapunk52** · 10-02-2003 08:33 PM

Well since ES5 is so malicious couldnt you show this to someone like symantec so they can add it as a trojan or something?

**random nut** · 10-02-2003 08:40 PM

I'm sure they read Full Disclosure and BugTraq.

ES5 has code which allows a remote user to delete a user's shared files. That's the "only" malicious code I found, but I can't rule out that there's more.

**Welsh** · 10-02-2003 08:43 PM

Originally Posted by darktiger_64

Could you please identify the 10 lies, and tell us the truth.

Okay, so I'll do my best.
With my own opinions.

1.They intentionally added this code to ES5.
Not unless it's a bug they didn't.

2.and that they have more than 15 million simultaneous users on-line 24/7
It's an old claim, no longer being claimed.

3.This is not a bug!
I believe if anything, it is a bug.

4.The people behind ES5 have intentionally added malicious code to ES5
No they haven't.

5.(eg. DoS attacking BitTorrent sites)
Pure speculation based on a conversational screenshot from ES5 Radio Chat, denied, never proven, never admitted, and explained.

6.They could be working for the RIAA, MPAA, or a similar organization.
I know it's a speculation, but it's rubbish.

7.Once they have enough users on their ES5 network, they would start deleting all copyrighted files they own which their users are sharing.
Another speculation, but still a load of rubbish.

8.The users wouldn't know what hit them.
Well if this rubbish was true, then there wouldn't be any users and so nobody would be "hit".

9.Credits
me for discovering it
You deserve no credits if you are lying.

10.Tested ES5 builds
ES5 build 1266
ES5 build 2180 (latest version)
I doubt that "Tested" is the correct word.

Okay, maybe lies was the wrong word, but rubbish, speculations, and scaremongering is what this post is all about.

@Random Nut, I have already told you that I respected your work and opinions, but after the fiasco on the K-Lite board recently I find it hard to believe anything posted by anybody from those discussions.
I know nothing about code etc, but this postt is full of the kind of rubbish that people complained about when ES5 was over-hyped.
I'm happy to admit being wrong and taken as a fool if this does turn out to be malicious.
I have absolutely no axe to grind with you, but I hope for the sake of your credibility that you haven't gone a step too far with this.

**drwtwn312** · 10-02-2003 08:48 PM

just because it is speculation doesn't me it's a lie so i don't think you even have 10 there bud

**JiMiThInG** · 10-02-2003 08:48 PM

Well ES5 has done NOTHING to earn the trust of the p2p community. However Random_Nut has. He provides some facts where you voice your oppion. You don't seem like a bad dude...but all you ES5 fanboys have a very similar sound. I half suspect or at least wouldn't be suprised if ES5 had like 1 or 2 guys out there spamming up p2p community boards with pro-ES5 rubbish. Random Nut on the other hand has nothing to gain...

**Welsh** · 10-02-2003 08:49 PM

Originally Posted by random_nut

Welsh, before calling me a liar, test the code. It's there. That'll prove I'm right.

And for the people who don't know who Welsh is, he's an ES5 fanboy who spammed the K-Lite board today and yesterday. He nearly got banned.

No spam there, just corrections being made to nasty comments and speculation.
K-Lite board folk have conveniently deleted all of the topics and posts, and nearly banned me even though it was their people, (balamm?) who were in the wrong.
Lock them and then delete them, then claim I was spamming?
Nice.

**random nut** · 10-02-2003 08:52 PM

Welsh, what the fuck (sorry) is your problem? I have provided the exploit code, you have ES5 installed, so what are you waiting for ES5 fanboy? Too afraid of the truth? Too afraid that I'm right? Just test it and stop calling me a liar when I have already presented source code and binary for anyone to download and test.

At first I thought you were a nice guy. But that changed when you showed your real self by spamming the K-Lite board today and yesterday, and now calling me a liar without even having tested the code.

**JiMiThInG** · 10-02-2003 08:58 PM

I mean posting the code is a about the only "facts" I have seen in this matter. If you have any real facts Welsh, I'm open to giving them a good look..but right now its your oppions..vs. his facts.

**random nut** · 10-02-2003 09:02 PM

JiMiThInG: I just PM'd you...

**Welsh** · 10-02-2003 09:02 PM

@Random Nut:
I am a nice guy!
I did nothing wrong on the K-Lite board and you know it.
I am honest and pride myself upon that.
I have absolutely no idea what to do with that code, but I still can't believe it is malicious rather than a bug.
That is the point.
If I am wrong in trusting ES5 then shite, you got me, I should have listened to you all along and for that I will be sorry.
But what if I'm right, and it is merely a bug and proven to be so?

Originally Posted by drwtwn312

just because it is speculation doesn't me it's a lie so i don't think you even have 10 there bud

Okay, maybe not 10 outright lies, but you can surely see the justification for me posting.
I am angry that people continue to crucify ES5 without justification, based on posts exactly along these lines.
ES5 and the RIAA?
Come on.
Random Nut is on a mission because a while back he went to the ES5 boards claiming some vulnerability and was proved wrong, publically.
So he has certainly something to gain, and I believe he is using his good, respected name to gain revenge.
ES5 is not evil, bad or malicious.
It is improving all of the time and does not deserve this crap being plastered all over it.

I half suspect or at least wouldn't be suprised if ES5 had like 1 or 2 guys out there spamming up p2p community boards with pro-ES5 rubbish

Wrong. ES5 has many many people out there telling the truth as they see it instead of bashing a program they are afraid to use because of posts like Random Nut's.
Fanboy?
No. Just a user, like I use k-Lite and Shareaza.
But you cannot only go by one opinion.
Use your own thoughts!

EarthStation 5 P2P application contains malicious code

LinkBack

Thread Tools

Display

EarthStation 5 P2P application contains malicious code

Similar Threads

Who have P2P application design and code

Malicious program?

Websense Mines for Malicious Code with Google

Tags for this Thread

Bookmarks

Bookmarks

Posting Permissions