InformAction Forums

That thread is missing some of its posts. search.php?keywords=isohunt&sr=posts&ch=0 shows the missing posts, author info is missing and this shows at the top of the page - Looks like OP of that thread wanted to torrent Ubuntu. I'm sure you can find old Ubuntu ISOs somewhere.

soo I just found this post viewtopic.php?t=215&sid=7f378e84f9e47cc ... 517444f906
and I'd like to ask if those torrents/files have been saved or not.

Hi malware fighters,

It is an advanced attack: http://isc.sans.org/diary.html?storyid=7867
Hackers are using it on the popular BitTorrent site IsoHunt.com at the mo , so block these from your OS:
193.104.22.0/24 and 89.149.236.46 this was already blocked 193.104.22.0/24

PDF-files have become the hacker-tool of sorts and this is proven by new advanced attack. The shellcode used in this attack was only 38 bytes large. While the same heap spraying technique has been used inside other exploits, the second part of the shellcode has been added as another object to the PDF document. At first the code seems to be corrupted, but then Adobe Reader will open the whole of the document into memory, as well as the corrupted code. According to Bojan Zdrnja the benefits for the attacker are crystal clear. He easily may change what the exploit is to perform, without the first part of the shellcode needs any change to it.

This will make automatic analysis with a Javascript Interpreting Tool for added malcoded JavaScript impossible. Research has found up two hidden binairies and also that the PDF doc has all aboard to take over a machine completely. No "extra's" are to be downloaded. "Not only is this an example of a malicious PDF-document with an advanced payload, but also to show to what trouble malcreants will go to circumvent detection from av vendors and victims alike", according to the ISC-handler.
Are we NS-users secure against this?

luntrus

P.S. Anyway Adobe is now going for silent uploads a la GoogleChrome, hoping some added obscurity will also add some added security. At the moment I hope they will patch this one real soon. For a while I will use an alternative reader...

Damian

Thank you! The fix works well.

OK, I was right. They check the User-Agent header to prevent leeching from bots and other automated downloaders.
Just enter the following command line in a terminal (logged as the same user as the one you launch Firefox as), it should do the trick once for ever (for cURL): Next FlashGot build will fake the user agent by default both for wget and cURL.

The file doesnt download and theres no output in the terminal. Using wget <url>, the terminal shows this:

anonymous_user wrote:I can test that, just tell me whats parameters to use. The man page is a bit lengthy.

curl <URL>

I can test that, just tell me whats parameters to use. The man page is a bit lengthy.

anonymous_user wrote:I just tried aria2 and it works too (although it also began downloading the torrent).
Maybe its the parameters used for cURL and wget?

Do they work with the same URL from the terminal?
My doubt is that the server blocks cURL's User Agent string...

Well my OS is CrunchBang Linux (based on Ubuntu Intrepid Ibex).

I just tried aria2 and it works too (although it also began downloading the torrent).

Maybe its the parameters used for cURL and wget?

Just tried it, no issue. 29.7 kb and downloaded fine and looks fine.
Could it be something with the way its passing this information on your system? Some configuration data might help.

The torrent files do not save if I use cURL or wget. The builtin downloader saves it fine.

It happens with any torrent, but heres an example:

http://isohunt.com/torrent_details/5251 ... ab=summary