KazaaLite/Kazaa Backdoor

[Szafran]

Now ive heard about a backdoor in kazaa lite and/or all other [gloworange]KAZAA[/gloworange] products. What it is suppost to do is allow a user to connect to a [gloworange]Kazaa/Kazzalite[/gloworange] User's [glowpurple]"My Shared Folder"[/glowpurple] simply by using thier IP in and addressbar. Then a belive a backbutton or something is displayed and a user caan click back to move back a folder frm the [glowpurple]MY Shared Folder[/glowpurple] . This backdoor is suppost to allow all user on [gloworange]kazaa[/gloworange] to access the entire C Drive of another User. I would Like To know If This is true and/or if there is a way to protect yourself w/ a firewall. PLEASE HELP

[goozle]

never heard of it.

you used to be able to browse users shared folders by typing they ip addy and port in the address bar,but nothing else,never access they C drive unless they have it shared.lol

[Drunk On Duvel]

Yup, it worked. If I share just a folder, you see the contents of the folder.

If you share "c:\" you get the contents of "c:\" but are unable to browse subdirectories.

Here is a screenie:

[Szafran]

IS the page that is displayed when you put in their IP a page generated by Kazaa?

[Drunk On Duvel]

IS the page that is displayed when you put in their IP a page generated by Kazaa?

Yes, KaZaA is a server and client software, so yes, the page is displayed from the KaZaA server and everything is indexed that you specified to share. Kinda like an index page that is returned to a browser when browsing FTP or a web site directory. If you type

http://123.456.789:kazaaport then you will see the contents of what you shared. I am sure if there is a way to share your files then there can be ways to explore the rest of sombody's computer if smart and crafty enough, but too bad I am not crafty or smart.

As for KaZaA being a "backdoor" I have not seen anything can can be construed as a backdoor, but if somebody were to decompile the software and add extra code to add some kind of extra "functionality" would not be extremely difficult to an experinced programmer or reverse engineer.

[Szafran]

would this be like what music cpmpanys use to messup your songs and/or view your songs?

[Drunk On Duvel]

heh, I din't know. I can think of several ways. Simply download some songs, grab the IP and send the IP to be subpenaed. As for messing songs up, it would be easy to simply create a bogus file and share it. As for messing up "your songs" directly, I do not know if you can remotely alter files.

[Szafran]

i would like to know if the page that is diaplayed when you visit the users IP can be alterend? Like maybe it is located in a DLL or something on my computer.

[Drunk On Duvel]

I do not know. Open a debugger and find out.

[Drunk On Duvel]

goozle, whatever you say.