Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Custom Trojan Creation Tool Sold Online

Posted by Zonk on Fri Jul 20, 2007 04:10 PM
from the haxx0ring-made-e-z dept.
Security The Internet Programming IT Technology
Finch writes "Net Security.org is reporting on the surprisingly sophisticated 'virus in a can' software called Pinch. Pinch is a tool sold on several online forums and designed to create Trojans. It allows attackers to specify the data that Trojans steal. One of the interface tabs, PWD, allows malicious users to select the type of password to be stolen by the Trojan: from email passwords to passwords kept by the system tools. It is possible to order the Trojan to encrypt this data when sending it, so that nobody else can read it. 'Pinch also lets users carry out other actions: turn infected computers into zombie computers, pack Trojans to make detection more difficult, and kill certain system processes, particularly those of security solutions.'"
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Custom Trojan Creation Tool Sold Online 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • obligatory (Score:2, Funny)

    by Anonymous Coward
    Yes, but does it run on Linux?

  • That sounds like fun (Score:5, Funny)

    by Anonymous Crowhead (577505) on Friday July 20 2007, @04:13PM (#19932801)
    How much is it and where can I buy it? For, uh, research purposes.

  • nothing special (Score:3, Informative)

    by sub7 (187049) on Friday July 20 2007, @04:14PM (#19932807)
    they were distributing trojans like this in the 1990s... sub7 anyone? ;)

    • Re:nothing special (Score:5, Informative)

      by KillerCow (213458) on Friday July 20 2007, @04:31PM (#19933023)
      Or the venerable Virus Creation Laboratory [netlux.org], ala '92.
      • You beat me to it. VCL was a great starting point for learning how to write virii. It was the first thing that I thought of when I read saw the article. [nostalgia]Sometimes I miss the days of Digital Decay and the NuKE vs YAM flame wars.[/nostalgia]
      • VCL... Didn't "Nowhereman" set that up?

    • Re: (Score:3, Informative)

      by Afecks (899057)
      I'm a trojan author so I'm getting a kick out of these replies...

      No seriously, this is not a new idea. There was Senna Spy Trojan Generator [megasecurity.org] many years ago. However, unless the generator actually generates the source code so you can compile it, I would call it a highly customizable backdoor, nothing more.

      • I'm a trojan author...

        Pardon my asking, but isn't admitting to that rather like stuffing bloody meat down your shorts and swimming with sharks?

  • Nothing New (Score:5, Informative)

    by KermodeBear (738243) on Friday July 20 2007, @04:14PM (#19932819) Homepage
    There is nothing new here.

    I remember back in my script kiddie days I was able to download programs that would put together a trojan or virus together from the various options the user selected. Press a button and viola! It generated an executable. This was ten years ago.

    What's so new here? That fact that someone is commercializing it?

    Well, good. If you have to shell out cash at least it will keep my 16 year old self from downloading it and causing annoyances.
    • Because no one would ever, never, ever put a free copy online somewhere?

    • Only 10 years? How about 1992? (Score:4, Interesting)

      by khasim (1285) <brandioch.conner@gmail.com> on Friday July 20 2007, @04:20PM (#19932895)
      http://vx.netlux.org/vx.php?id=tv03 [netlux.org]
      I still remember the password was chiba city.
      • Oh the days :)

        "Mum, look I created my first virus"

        They bearly worked and I understood nothing about the internals, but VCL is definately a prime example that this has been done many times before and is nothing new.
    • Ahh, Virus Creation Lab. What memories. Brings me back to the days when viruses were pleasure, not business.

    • Yes, the fact its now a "business" is what is ( sort of ) new here.

      It also makes it all that more irritating and pathetic.
    • I had to modify the following post to take any direct references as I have no way of knowing if you, personally, actually made use of your exploits outside of your own private testing environment...

      I guess that's the difference between real tao programmers and script kiddies.

      I _could_ have engaged in the same things that script kiddies did, exploiting other people for personal amusement and/or gain, but made a conscious decision not to. I saw the links, I looked at the downloads, the ftp sites, and the web
        • You haven't even asked for my resume, nor have you asked about my skills and experience, nor have you asked what I'm qualified to do, nor have you offered me a list of your available openings. All you want to do is rant. Tech companies can spend nearly a hundred thousand dollars bringing an H1-B applicant online but they can't give me a little boost out of this situation? Sounds like a fishbowl.

          You qualify for the standard response...

          Thank you for visiting Slashdot, yet again, to post a followup to my wr

      • Re:Nothing New (Score:4, Funny)

        by Anonymous Coward on Friday July 20 2007, @04:35PM (#19933061)
        Yeah, Sub7 was great. I thought the most entertaining feature was being able to quickly and easily set the user's desktop wallpaper image. It didn't take long to sniff just enough of the Sub7 protocol to be able to develop a tool that would a) scan huge swath of netspace for Sub7 b) login c) download a .jpg d) set wallpaper. A lot of people back in the late 90s woke up to find that overnight, their wallpaper had changed to a photo involving a cucumber and a very hairy receptacle.

        Being able to pop custom modals was pretty fun, too. "ERROR: Insert penis into CD-ROM drive to continue operation! [OK]," followed by the CD tray immediately ejecting itself, probably freaked a few people out.

        Oh, to be young again, those were the days...!

  • I'm not scared... (Score:3, Funny)

    by rob1980 (941751) on Friday July 20 2007, @04:14PM (#19932825)
    If anybody tries to install a trojan on my computer, I'll hit them back.

    With Winnuke95.

  • After all those (Score:5, Funny)

    by rrohbeck (944847) on Friday July 20 2007, @04:19PM (#19932885)
    "1NCRE@SE Y0UR PEN1S S1ZE 25% 1N 2 WEEKS!" programs I definitely need custom Trojans.

    • 1NCRE@SE Y0UR PEN1S S1ZE 25% 1N 2 WEEKS!" programs I definitely need custom Trojans.

      Ah, that is unless you've followed the instructions from this oldie but goodie:

      --

      Follow these instructions EXACTLY, and in 3 to 6 weeks you will have received well over 50,000 inches of penis, all yours. This program has remained successful because of the inadequacy and vanity of the participants. Please continue its success by carefully adhering to the instructions.

      Welcome to the world of Mail Order Penis Enlargement! This little business is a little different than most cosmetic surgery. Your product is n

  • A great slogan for this program, but I bet our latex buddies have an entirely different interpretation of that...
  • I wonder who actually pays for these tools? Seems like such a tool would be freely downloadable after teh first purchase. I mean, it isn't like the author is going to try to sue you or anything (though maybe he'll DDoS your download site). It would be like a drug dealer calling the cops because someone stole his supply.

    -matthew
  • Does anyone have a copy of the EULA for that software?
    • EULA

      By agreeing to the purchase and install of Trojan-o-Matic, hereby called the 'Software', you agree to host 'x' amount of porn or phishing sites. The amount is determined by the Software according to its use and the creator of the software. At any time, you submit your computer to be a host server for the Software Creator's Nigerian email server. That is all.... oh, and your bank account is empty.
    • EULA, Pinch, 2.60
      I reserve the right to go ballistic on your ass if you rip me off. (But feel free to redistribute if you include your custom trojan in the file.)

      EULA - most other software
      [four to six pages of nonsense much of it in all caps, mainly stating the exact same as above with the exclusion of the parenthesis but adding a page or two basically saying "I can also castrate you with a dull wooden spoon if you do something I would rather you pay me extra to get done."]

  • kill certain system processes, particularly those of security solutions.
    If you run trojans, can it really be said you have a security solution to be killed?

  • slashvertisment? (Score:3, Funny)

    by muszek (882567) on Friday July 20 2007, @06:23PM (#19934089) Homepage
    it's the first slashvertisment that makes you search for the shop yourself...
  • Either the black-hats or the condom company, but someone has to change the name of their product.

    These subject lines are killing me.

  • Mod me flamebait, but (Score:3, Insightful)

    by postbigbang (761081) on Friday July 20 2007, @06:41PM (#19934247)
    Since I have to take care of a lot of machines of people that get these things, my otherwise non-violent nature would like to find the authors, well, in a Turkish prison. Yes these things have been sold on the net for a long damn time, but I've also had to scrape, reformat, debug, and otherwise keep hapless unwitting people from the damage these things do. They're often chained to using Windows whether they want to or not.

    I've seen them spend hundreds of dollars on both prevention and cure, only to get owned again. This isn't about Microsoft, this is about guys that are the seeming equivalent to those that might cut brake lines in a car. The outcome isn't injurious physically, just emotionally/mentally and financially.

    My hacker instinct says always continue to hack and explore and try and break things, but selling trojans seems way over the top. No fucking 'let them download Ubuntu or get a second mortgage for a Mac' shit. This is real, this is vulgur, and this is a business plan for bright guys gone bad.... and I don't get paid for scraping this crap.
  • needs to have his liver removed with hot pincers.

  • The Future of Anti-Virus (Score:3, Interesting)

    by Nom du Keyboard (633989) on Friday July 20 2007, @09:53PM (#19935253)
    I'm believing that the future of anti-virus/rootkit solutions has to be a live CD that runs fully independently of the host system and software being scanned.

    • Re:Scary stuff to be sure (Score:5, Insightful)

      by realmolo (574068) on Friday July 20 2007, @05:18PM (#19933501)
      Eh. Trojans/rootkits/viruses built form these "kits" tend to all be very similar. Essentially, if you defend against one, you're defended against all the others.

      Never mind the fact that it's a fucking KIT. If YOU can download it, so can the anti-virus people in order to figure out how to detect viruses made with it.

      The interesting thing about modern viruses/trojans/whatever is that very few of them are really *viruses* anymore. They rely almost completely on simply getting a user to manually run (or at least give permission to the system to run) an obfuscated executable. It's sad that the technique is so successful.

    • Re:Torrent? (Score:5, Interesting)

      by Havenwar (867124) on Friday July 20 2007, @05:59PM (#19933893)
      Oh, actually a search for "pinch" on emule turns up quite a plethora of results... although once you've sorted out the porn and downloaded a few exe files (yes I know, for most geeks this is the exact reverse of the normal process), for some odd reason antivirus warnings start to pop up... apparently two out of three pinch downloads was infected with "Win32/PSW.LdPinch.P4 trojan" and the third with some other crap that I forgot to write down.

      You can almost see the scriptkiddies sitting there with their brand new trojan going... "hmm, now if only I had some program to trick people into downloading... something I could merge my trojan with to start off my botfarm. Something I could put on fasttrack, and maybe emule... something idiots would download and run even if their antivirus goes off. Hey wait a minute, I'm an idiot and I just ran pinch even though 'norton' told me it was bad for me!"

      • Re:Torrent? (Score:5, Insightful)

        by PCM2 (4486) on Friday July 20 2007, @06:24PM (#19934097) Homepage

        apparently two out of three pinch downloads was infected with "Win32/PSW.LdPinch.P4 trojan"

        Did you stop to think that maybe the construction set was identified as a Trojan because it ... you know ... contained the code for a Trojan? As in ... if it tripped your antivirus then you probably had the right one.

        • He did consider that. His point was that precisely because of what you're saying, people will run a file that's supposed to be Pinch, even if they see a virus warning. Therefore, it would make sense for people who want to create a botfarm to make a virus with Pinch, and then throw it up as a torrent and say it IS pinch. Get it?
        • Well, yes. Hence why I found it amusing that only two out of three downloads (of exactly the same files according to filename and versions and all... except filesize) warned about that particular trojan, which could logically be an indication of it containing the code it will later use. The third occasion warned for another trojan, which means that either that was the correct one, or it was infected with another trojan. Of course they were all infected, as was blatantly obvious hours later when I sandboxed

      • Re: (Score:3, Informative)

        by rantingkitten (938138)
        Considering that "virii" is a made-up, non-English word, then yes, I can believe Bush using it and being mocked in the media the next day for another brilliant Bushism. The proper plural is "viruses".

        Hate to be the one who bears bad news. And by the way, "boxen" is not a real word either.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.