_______________________________________________________________________

        Zango Adware -  Insecure Auto-Update and File execution
_______________________________________________________________________


Reference : TZO-042006-Zango
Author    : Thierry Zoller
Advisory  : http://secdev.zoller.lu/research/zango.htm

Shameless Plug :
I would also like to take the opportunity to invite you to the
Security Conference known as "Hack.lu 2006" in the Grand-Duchy
of Luxembourg. More information at http://www.hack.lu
** See you there!


I. Background
~~~~~~~~~~~~~

http://www.zangocash.com

"ZangoCash (formerly LOUDcash) is recognized around the world as one of
the best pay-per-install affiliate programs on the Internet. ZangoCash
is a subsidiary of 180solutions which also includes Zango and 
MetricsDirect . Every day, 7,500-10,000 ZangoCash affiliates distribute
our software to users who are then connected with more than 6,000 
MetricsDirect advertisers."



II. Description
~~~~~~~~~~~~~~~

After the acknowledgement of an License Agreement, during Startup, the 
bundled EXE contacts several servers and downloads the required Adware
components. The downloaded components are not checked for integrity 
or authenticity and are executed as soon as they are downloaded.

The Following procedures are exploitable :

   1. Initial Install
   2. Auto-Update function

The condition is exploitable in the following scenarios :

   1. You have legitimate control over the DNS server
   2. You have compromised a DNS server
   3. You forge a cache poisoning attack against a vulnerable DNS server
   4. You have access to the machine and change the HOST file

Redirecting static.zangocash.com to an IP address under your Control and
creating the respective V-host allows you to deploy any type of executable
on the machine where zango is being installed or currently is installed.

Why is this an Issue ?
Especially the auto update function is a problem, imagine a DNS server 
not a split setup) is compromised or cache-poisened, every workstation 
with zango installed inside the company can be immediately compromised
as the Workstation tries to automaticaly download an update of Zango 
and fails to realise that instead of Zango it downloads and executes 
a Rootkit/Backdoor/"put anything here". 


III. Summary
~~~~~~~~~~~~~~~
Vendor contact : 01/02/2006
Vendor Response : 05/02/2006

Vendor Response :
No official statement, first I was asked to remove the webpage,
then I was allowed to keep it online, I was not given permission
to disclose the conversations that took place. I will respect
the rights of 0180 Solutions. 


Reference : TZO-042006-Zango
Author    : Thierry Zoller 
WWW       : http://secdev.zoller.lu