Gadu-Gadu, a program written by Łukasz Foltyn and distributed by the company sms-express.com, has achieved dizzying success in Poland. It is used by approximately 3 million people monthly and is installed on many, if not most, computers connected to the Internet. Not only home computers, but also those working in corporate networks, through which very sensitive and valuable data sometimes circulate. Using this program is as common as it is tolerated by employers and network administrators. However, it may turn out to be surprisingly dangerous. IT specialists from the Poznań Supercomputing and Networking Center have found as many as seven different types of holes in the program.
– From changes in message handling, which, for example, reaches a stranger instead of the addressee, to vulnerabilities allowing the execution of code (including malicious code!) on the client’s computer – lists Błażej Miga.
– The vulnerabilities also allow for the theft of any files from the client’s computer – adds Jarosław Sajko.
Worse still, the user is not informed in any way about what is happening on their hard drive. Files simply disappear suddenly. An intruder can also do the exact opposite – plant any file on the victim’s computer by saving it to their disk.
You can enter through a small window
This small program can create a huge breach in a well-secured network. An intruder attacks an employee’s computer through a hole in GG, and easily enters the company server, where the data they are interested in is located, by impersonating an authorized user. The server’s security measures then have no grounds to trigger.
Poznań IT specialists have developed tools in laboratory conditions that, by exploiting the holes in GG, allow for the described break-ins. The bad news for users of the instant messenger is that these tools work exactly as their designers intended.
Dangerous metamorphoses
Errors in GG allow for the most brazen attack: impersonating a user. Someone replying to a message from a friend on their contact list was actually opening a gateway to their computer for an intruder.
– To effectively prevent this, we would have to not only ignore messages from strangers but also remove everyone from our contact list – Miga points out. – Because all it takes is clicking on the envelope at the bottom of the screen signaling a new message, and malicious code can already be executed on the computer.
The article comes from the magazine “e-Fakty” 1/2005.