WorldFlash - Spyware and BO

[mac.ac () t-online de (Dr. Markus a Campo)]

I use the demo-version of the WorldFlash News-Ticker Gold M5.30i
(http://www.worldflash.com/). While investigating some unexpected crashs
of the programm with a sniffer, I noticed that some privat informations
are sent back to WorldFlash, i.e. my real IP behind the firewall, the
mailserver I use, and other stuff (see attachment).

When I contacted the vendor I was told to uninstall the program - YES
SIR, I WILL DO SO

The crash seems to be a buffer overrun while getting news. Some sites
send back a whole bunch of useless HTML-crap back to the ticker.

Best regards

Markus a Campo


POST /cgi-bin/admin5.exe HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 221
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; WFG)
Host: www.scroller.com
Connection: Keep-Alive
Cache-Control: no-cache

192.168.69.35&mac.ac/mailto.btx.dtag.de@127.0.0.1&1399765272&1061960668&a06bdb1&jupiter&00000000000000000040802000800000&4294963696&24c0a81a&00000000000000000000401000000000&6f10000&1300051



‡%2-!.9f„…f(5'/€4m/.,).%n$%
HTTP/1.1 200 OK
Date: Wed, 27 Aug 2003 04:38:25 GMT
Server: Apache/1.3.26 (Unix) PHP/4.1.2
Keep-Alive: timeout=3, max=5
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

31 
This is text sent back to the WorldFlash client


0

HEAD /Service1.dll HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; WFG)
Host: www.scroller.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Wed, 27 Aug 2003 04:38:25 GMT
Server: Apache/1.3.26 (Unix) PHP/4.1.2
Last-Modified: Sun, 24 Aug 2003 02:48:18 GMT
ETag: "2733b1-24600-3f482772"
Accept-Ranges: bytes
Content-Length: 148992
Keep-Alive: timeout=3, max=4
Connection: Keep-Alive
Content-Type: text/plain