How can you find out if a program has a "backdoor".

**StuartD** · 01-17-2005, 08:37 AM

Depending on the program you're trying to run, but yeah... if you have something that doesn't need the inernet, and you run it and it tries to establish a connection to something.... chances are it's a backdoor into your system

**AgentCash** · 01-17-2005, 08:37 AM

Depends on what the program is... zonealarm will alert you when any program tries to connect, so even if it's just connecting to check for updates or any number of other things, it will alert you the first time.

**xlogger** · 01-17-2005, 08:44 AM

Ok i open up this program and its traying to connect to this proxy (or ip) 24.92.32.22

And zonelabs firewall tells me its taying to connect.

**SmokeyTheBear** · 01-17-2005, 09:08 AM

many times a program will just talk to the internet to find software updates , nothing wrong with that.. But to be sure , i would get a packet sniffer and sniff the packets being sent when you run the program..

**xlogger** · 01-17-2005, 09:10 AM

No this is a "special" program (and its cracked) i got that some people use. And it has been said it some version have backdoors.

**SmokeyTheBear** · 01-17-2005, 09:11 AM

Is that paltalk your using ??

**xlogger** · 01-17-2005, 09:12 AM

Originally posted by SmokeyTheBear

Is that paltalk your using ??

nah its not.

**jukeboxfrank** · 01-17-2005, 09:14 AM

You may not be able to understand the data packet from the sniffer but you can check out the IP addresses the program is connecting to. Most backdoors will connect to an IRC channel.

**SmokeyTheBear** · 01-17-2005, 09:17 AM

That ip looks like a personal ip from raodrunner time warner cable .. looks fishy to me.. I did a google on it and it has been used by personal ip's from an isp mainly.. I doubt it is anything legit.

**SmokeyTheBear** · 01-17-2005, 09:19 AM

Try this tool out http://www.ethereal.com/distribution/win32/

**xlogger** · 01-17-2005, 09:20 AM

Originally posted by jukeboxfrank

You may not be able to understand the data packet from the sniffer but you can check out the IP addresses the program is connecting to. Most backdoors will connect to an IRC channel.

It seems to connect to one proxy. Which is:

24.92.32.22
http://whois.sc/24.92.32.22
http://www.google.com/search?q=%2224...en-US:official

Edit: i think its a proxy..its in here (search for that ip) http://proxy2004.iespana.es/proxy200...SPLIT(164).TXT

**xlogger** · 01-17-2005, 09:25 AM

o well fuck it, i will nuke that ip and not use the program.

**SmokeyTheBear** · 01-17-2005, 09:28 AM

If you read the packet it will tel you what is being sent to that ip.. If it is a proxy , they are just forwarding the packet through the proxy , using the sniffer you can find the intended destination

How can you find out if a program has a "backdoor".

How can you find out if a program has a "backdoor".

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment