A Pidgin instant messaging client developer, which supports networks like Jabber/XMPP, Bonjour, Gadu-Gadu, IRC, Novell GroupWise, Lotus Sametime, and Zephyr, announced the detection of malicious code in the ss-otr (ScreenShareOTR) plugin found in the community-developed plugins directory. The plugin was added to the directory on July 6, distributed only in binary form, and added screen sharing capabilities to Pidgin using the OTR (Off-the-Record) protocol. On August 16, security researchers identified malicious activity in ss-otr, which manifested as a keylogger launching and sending screenshots to external servers.
An analysis of the malicious changes conducted by ESET revealed the presence of code in the pidgin-screenshare and libotr libraries that could load and execute scripts and executable files from a szerver attackers (jabberplugins.net). For Windows users, typical malware DarkGate, which supports modules for a wide range of malicious activities including mining, keystroke logging, establishing remote access, and stealing personal data, keys, and passwords from popular applications, was downloaded and installed from the server. Linux builds also had functionality for loading and executing third-party code (what exactly was loaded on Linux systems is still unclear).
To reduce the risk of similar incidents in the future, Pidgin developers plan to include only plugins whose code is available under open licenses approved by the OSI. It is also planned to reference only third-party plugins that have undergone a security audit.
Forrás: opennet.ru
