Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If you don't want to read all of the details, skip to the bottom; I'll make a summary.

I created a computer program as a proof of concept (I threw it together in 12 hours, so I wrote it in Visual Basic to get it done quickly). Normally I'd be using Linux but my client wanted a Windows version, so I resorted to VB.

Anyway, the program was designed for a computer rental company; if a computer is rented to a customer is lost, stolen or the customer stops paying, the computer can be remotely locked and tracked. I got the proof of concept working and installed it onto 4 computers running Windows XP. I showed those 4 computers to my client and demonstrated the software to them.

Once I'd finished the demonstration, I returned the computers back to my office and they've been turned off ever since. However, today (2 days after the demonstration) I noticed a computer check into my online service (e.g. my program was installed onto another computer). The model of the computer was completely different to the computers I was using and the serial number was reported as 'None'.

Also, I noticed the same computer check in 4 times within the space of 2 minutes from different locations in the world (according to IP address lookup). It's possible that it was 4 identical computers in different locations running the software at almost exactly the same time (The serial number was 'None' so I couldn't tell if they really were different computers or not).

I don't understand how this happened because I created the software on a Virtual Machine running a clean install of Windows XP with antivirus (the host machine was running Linux). The 4 demonstration machines were also clean installs with antivirus and they were fully updated. This means that during the 15 minutes those computers were connected to my clients' network, the program somehow got leaked. The computers never left my sight, nobody other than myself have ever accessed them.

How is that even possible and why would malware target a .exe file?

Summary

  • Created software on a clean install of Windows XP in a virtual machine (host was running linux)
  • Installed the software onto 4 computers and connected them to an unknown network for no more than 15 minutes
  • Nobody touched the computers besides myself
  • The software was then run from 4 different internet connections on what seems like the same computer two days after I unplugged the computers from the unknown network (the computers were never turned on again after being connected to that network).

Software is closed-source and was never given to anyone.

If it was malware, why did it steal an .exe?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

The most important part of this post is "with antivirus".

Do you have automatic submissions turned on? If so, those computers might have sent in an 'automatic submission' to the AV mothership at some point. It might have been flagged for evaluation, and possibly run in a controlled environment to see what behavior it would exhibit. These environments are often global, as sometimes malicious software does different things if run from a different subnet/country.

The other possibility (discussed by others) could be that it's random port scan or POST engine looking for vulnerabilities on the particular port you are using. You should enter the IP addresses that are contacting you into an abuse list, and see if they are known scanners.

Mike

share|improve this answer

sounds like your software should have some sort of authentication with your 'online service'

If your online service gets pinged, would it report that as a connected user? It is possible its just a robot hitting your online service?

share|improve this answer
    
As this is just a proof of concept I hadn't added any 'proper' security. It was certainly something running the software as all requests are POST requests containing information about the computer running it. In this case I saw the specification of the computer but the serial number was missing –  user2370602 Feb 5 at 22:50

To be honest, this sounds to me like someone or some other program made an error and contacted your server instead of the one they had to contact. But if you really want to test, just track their computer. That will work if they're running your software and throw up an error if they aren't. To be honest, I really doubt that someone with the skills required to access your filesystem in 15 minutes would be so careless as to leave traces that they stole your program.

share|improve this answer
    
Although it could be some other software accidentally contacting my servers, it seems unlikely that it would have POST data which is formatted in exactly the same way as my software would format it (sure, it's possible, but highly unlikely). As it was just a proof of concept, the only way of tracking computers in this version is based on their IP location. It seems that if someone really did run it manually, they were prepared; The serial number of their computer had been replaced with 'None' somehow, like they were expecting their serial number to be probed, they also randomised their IP –  user2370602 Feb 5 at 23:39
    
@user2370602 That is strange, but keep in mind that it would have been much easier to sniff your POST packets than to copy your files. –  KnightOfNi Feb 6 at 1:41
    
That's true. If someone did sniff the packets then make their own request, they replaced the data containing the computers' CPU info with completely different CPU info.. If they were messing around with the packets I'd expect them to use the same data or add spam to it –  user2370602 Feb 6 at 6:50
    
@user2370602 Well, they could have been trying to duplicate your program, even if they didn't know what it was. They could have been testing what they had done so far to ensure the packets were formatted correctly. Of course, speculation doesn't really help at the end of the day, but the only answer to your question with the data we have is already in the question: "Seems Unlikely." –  KnightOfNi Feb 6 at 22:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.