Download Accelerator Plus can be tricked to download malicious file

[visitbipin@hotmail.com]

Product(ONLY TESTED ON): Download Accelerator Plus 7.4.0.2 (unregistered)
Test Environment: Winxp Pro sp2 (patch level latest)
Risk Type: Rare exception
Threat Level: High
Vendor website:www.speedbit.com

POC screenshots: http://img482.imageshack.us/img482/4205/31uk.jpg
http://img425.imageshack.us/img425/4380/15an.jpg


speedbit.com claims to have 110 million users of DAP world wide and is one of the popular and best download manager for windows. One of its biggest strength to download big files in a faster connection at optimum speed is, it can automatically search for
best mirrors and download different parts of the file form multiple location.

BUT Download Accelerator Plus(DAP) may switch its download to a un trusted or malicious website while searching for fastest mirrors for a particular file under certain conditions. If the ACTUAL, trusted host providing the file is DOWN or due to network co
ngestions the users may get and execute a malicious file instead.

I've included two screenshots which should be self explanatory. Check out the url’s in each screenshot and see from where the file is being received at the end.

In the screenshot I'm trying to download 'Windows 2003 sp1' from download.microsoft.com but DAP automatically chooses to download it only from ftp.planet.nl as my network was having tooooooooo low internet bandwidth at that time.

Further more, on some network/OS there might be rules for MAX CONNECTION PER HOST and (say)if in the network someone is already downloading some file from download.microsoft.com the outcome will surely be a VIRTUAL network congensation for download.micros
oft.com within that DMZ.

For my test I used another client computer behind the gateway to send continuous ping ( 17 different instants) to download.microsoft.com As a result, for my network download.microsoft.com was off the radar. So, in my another computer DAP chooses to downlo
ad Win2003 sp1 from ftp.planet.nl instead. So, even after my network gained its full throttle... no-wounder DAP was still downloading the file from ftp.planet.nl

My test network setup was a 3 computer PC which was left on default configuration with Winxp sp2 (patchlevel: latest)

Changes: This advisory is slightly modified than the one that I emailed to the vendor about a week back and tried contacting it, but with no response till now!

Result: I was receiving the file from an unknown and un-trusted source which could be infected with a malicious program.

BUT fyi: I haven't researched on HOW and WHERE 'DAP' queries to get other possible mirrors for the particular file.

Conclusion: I insist NOT to use download managers that does the same while downloading important files. Or either force your download manager and check whether the file is being downloaded from the original URL or not.

Regards,
-Bipin Gautam

[NaPa]

I didn't see this as a DAP fail, is normal to have out because of =
network
configuration, but, how you can make your own Server to be detected as a
mirror of the file. I mean if you could do this is that a fact nut by =
know
for me is not a flaw.

What do you think?

-----Mensaje original-----
De: visitbipin@hotmail.com [mailto:visitbipin@hotmail.com]=20
Enviado el: mi=E9rcoles, 04 de enero de 2006 11:31
Para: bugtraq@securityfocus.com
Asunto: Download Accelerator Plus can be tricked to download malicious =
file

Product(ONLY TESTED ON): Download Accelerator Plus 7.4.0.2 =
(unregistered)
Test Environment: Winxp Pro sp2 (patch level latest)
Risk Type: Rare exception
Threat Level: High
Vendor website:www.speedbit.com

POC screenshots: http://img482.imageshack.us/img482/4205/31uk.jpg=20
http://img425.imageshack.us/img425/4380/15an.jpg


speedbit.com claims to have 110 million users of DAP world wide and is =
one
of the popular and best download manager for windows. One of its biggest
strength to download big files in a faster connection at optimum speed =
is,
it can automatically search for best mirrors and download different =
parts of
the file form multiple location.

BUT Download Accelerator Plus(DAP) may switch its download to a un =
trusted
or malicious website while searching for fastest mirrors for a =
particular
file under certain conditions. If the ACTUAL, trusted host providing the
file is DOWN or due to network congestions the users may get and execute =
a
malicious file instead.

I've included two screenshots which should be self explanatory. Check =
out
the url=92s in each screenshot and see from where the file is being =
received
at the end.

In the screenshot I'm trying to download 'Windows 2003 sp1' from
download.microsoft.com but DAP automatically chooses to download it only
from ftp.planet.nl as my network was having tooooooooo low internet
bandwidth at that time.=20

Further more, on some network/OS there might be rules for MAX CONNECTION =
PER
HOST and (say)if in the network someone is already downloading some file
from download.microsoft.com the outcome will surely be a VIRTUAL network
congensation for download.microsoft.com within that DMZ.

For my test I used another client computer behind the gateway to send
continuous ping ( 17 different instants) to download.microsoft.com As a
result, for my network download.microsoft.com was off the radar. So, in =
my
another computer DAP chooses to download Win2003 sp1 from ftp.planet.nl
instead. So, even after my network gained its full throttle... =
no-wounder
DAP was still downloading the file from ftp.planet.nl=20

My test network setup was a 3 computer PC which was left on default
configuration with Winxp sp2 (patchlevel: latest)

Changes: This advisory is slightly modified than the one that I emailed =
to
the vendor about a week back and tried contacting it, but with no =
response
till now!

Result: I was receiving the file from an unknown and un-trusted source =
which
could be infected with a malicious program.

BUT fyi: I haven't researched on HOW and WHERE 'DAP' queries to get =
other
possible mirrors for the particular file.

Conclusion: I insist NOT to use download managers that does the same =
while
downloading important files. Or either force your download manager and =
check
whether the file is being downloaded from the original URL or not.

Regards,
-Bipin Gautam

[Dave Korn]

visitbipin@hotmail.com wrote in
news:20060105180806.22333.qmail@securityfocus.com
> Just n' update:
> DAP searches for all its mirrors from mirrorsearch.speedbit.com
>
> I have no knowledge about HOW the mirrors are gathered.

Then your report should have been titled "Maybe DAP can be tricked to
download malicious file, maybe not, I haven't got any idea because I haven't
bothered to find out".

Or even better, you shouldn't have bothered posting it because it has zero
content. "There might or might not be a vulnerability in application X" is
NOT information. Uninformed speculation is NOT information.

What you actually observed was DAP not being tricked and not downloading a
malicious file. What you wrote was the exact opposite. Your report is
fraudulent and utterly dishonest.

cheers,
DaveK
--
Can't think of a witty .sigline today....