3

I realize the answers will be language specific, but I am curious what terms you would look for when checking something out on Github? I was looking for a remote administration tool that I could use with clients, and found some awesome ones, that happen to be "viruses"

Take https://github.com/rsmudge/vncdll (associated with metasploit), or the QuasarRAT project for example: https://github.com/quasar/QuasarRAT

Now I have seen enterprise high priced tools like SolarWinds MSP Connect, Dameware, and so on that do most of those same things, but QuasarRAT is listed as a virus when I try compiling it.

I was playing with the idea of taking the QuasarRAT program apart, segmenting each feature into plugins, remove any that may be malicious only, but then I am not sure it still wouldn't be listed as a virus.

In PHP I would look for obfuscated code that was using base64_decode(), exec() and so on, but I am curious what terms I should be on the lookout for with C#, C++ C, Bash - specifically those that may involve keylogging, transmitting data to a remote host, or downloading additional things to the computer?

Things I can think of are TcpListener, AcceptTcpClient, stream, bind, sockets, http, wget, curl, ftp, ssh, rsync. Since I am not fluent in C++, C, and I know I have more to learn in Bash and C#, I would love suggestions for those fun Easter eggs that people have hidden that you have found.

While I realize that just because these terms are used, it doesn't mean it IS malicious, but at least I can focus some time on that function and decide what it is doing, what else is calling it, and if it is approved.

IF we can get a good list together, I will try to come up with a script that will automatically search and bring back the matches for review.

  • If you're doing this as a fun learning exercise, then carry on! But if you're planning on using the results for something serious, then know that you're fighting a serious uphill battle; especially in C, for any search list you come up with, I can write a malicious program that it doesn't catch. If you're willing to put in that much effort, why not pay for a tool that comes with some reputation? – Mike Ounsworth Aug 29 '18 at 4:18
  • Thanks Mike, I haven't found a tool yet that I can integrate with my own application. I have found tools that let me rebrand their application like RemoteUtilities.com, but I can't integrate that within my application like I wanted. Many of my customers already have a remote desktop tool, but it is managed by a 3rd party IT company that is generally reluctant to share login credentials. I plan on having an option during install to enable remote support and having it all be part of the main app. – Alan Aug 29 '18 at 4:35
5

If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle.

If someone's really truly trying to hide malicious code in plain sight, then you probably won't notice it. Take for example, the infamous 2003 nearly-a-backdoor in the Linux kernel where this harmless code:

if ((options == (__WCLONE|__WALL)) && (current->uid == 0))
    retval = -EINVAL;

was turned into a backdoor like so:

if ((options == (__WCLONE|__WALL)) && (current->uid = 0))
    retval = -EINVAL;

(hint: instead of checking if you're root uid == 0, it turns you into root uid = 0. So pass in the flags _WCLONE|_WALL to whatever system call this is and BAM! you're now root.)

This example isn't directly relevant, but shows that malicious code in C/C++ can be really subtle. So if you think there's a chance that someone is playing hide-and-seek games in the code, move on and find a different project.


I often deal with a softer version of your question, "Is this open source library / tool ok to use?". My approach is to see if it has a good reputation; is it actively maintained? Do their github tickets give the impression that they follow a proper dev process? Do they publish regular changelogs, including security fixes? Does it have unresolved CVEs against it? If there are binaries, are they properly code-signed?

It's not foolproof, but it weeds out seedier projects. (if anyone has a better way of vetting open source projects, I'd love suggestions!)

  • Wow Mike, that is super sneaky, I guess uid should be on the list for sure. I had to read that a couple times to find what was different. – Alan Aug 29 '18 at 4:40
  • That example is from code running inside the linux kernel itself, so setting uid = 0 in an application won't do anything. Just an example to show that people can be more clever than what you can detect with ctrl+f pattern matching. – Mike Ounsworth Aug 29 '18 at 4:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.