At 11:19 AM 10/15/2004, Martin Hepworth wrote:
hmm great, perl malware :-)

More seriously, anyone checked the code for nasties...

Disclaimer: I'm no perl expert, so treat my analysis that of someone with limited experience.


I inspected the code and saw nothing terribly suspicious in my limited understanding of perl.

The only thing that's a bit troubling is it seems to parse the entire AWL database into a giant memory array named resulthash, and this could exhaust memory if your AWL DB is large. I'm not 100% sure that's what happens, but it seems it does it that way.

For paranoia, copy your AWL DB to an unprived account and be sure to execute it as that non-root user in a shell that has reasonable rlimit's set.

The code itself seems quite simple and straightforward.

It first tries to open the database using one of several DB formats.

It then parses the database into a memory array, resulthash.

After that it dumps it out into two files.
One plaintext where the email address is in plain text format, followed by the count and score:
[EMAIL PROTECTED] 5 15.0
The other is a hex-print of the md5 hash of the address, followed by count and score:
6371166aee1e6da503f6c1e623447952 5 15.0


For privacy, make sure you don't mix the two files up.





Reply via email to