Security Issues in MetaTrader 4
  #1 (permalink)  
Old 01-27-2005, 11:04 AM
scorpion's Avatar
Administrator
 
Join Date: Aug 2004
Posts: 1,923
Thanks: 97
Thanked 361 Times in 147 Posts
scorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to behold
Send a message via MSN to scorpion Send a message via Yahoo to scorpion
Default Security Issues in MetaTrader 4

The security hole in MetaTrader 4 is nothing but its new MQ4 Expert Language. The new language allows external API calls to any MQ4 and DLL files, which introduce many posibilties on expert developments: close-source expert, for example, since some developers don't want to expose their creations to the public.

While giving such benefit, it also gives off a security issue to users. It is extremely dangerous to allow such calls. If you're unlucky, you will run malicious expert without realising what would happen. Believe it or not, API calls can infect your pc with viruses, spy on your keyboard activities, delete your files, and even format your harddisk.

I've attached an expert that makes two api calls: first it open thebugs.ws website, and second it attempts to send a blank email to me. This expert is safe and worth to demostrate.

Note: Luckily, the "Allow DLL imports" checkbox must be checked for any expert to call external api.
Attached Images
File Type: png API_import_mt4.png (5.5 KB, 107 views)
Attached Files
File Type: txt APITest.mq4.txt (1.7 KB, 85 views)
Sponsored Links Profitable Forex Systems
Automatically trade proven forex trading systems.
Real trading records available!
__________________
Make easy pips with the Advanced Economic Calendar for Forex Trading.
Reply With Quote
  #2 (permalink)  
Old 01-27-2005, 02:26 PM
gazuz's Avatar
Senior Trader and Moderat
 
Join Date: Aug 2004
Posts: 768
Thanks: 1
Thanked 8 Times in 5 Posts
gazuz is a name known to allgazuz is a name known to allgazuz is a name known to allgazuz is a name known to allgazuz is a name known to allgazuz is a name known to all
Default

Scorpion,

Indeed this is a bit threatening, I did have to check the box in order for something to happen. BUT it prompted me before asking if I would allow this with a Yes No or Cancel situtation. I think that if any files were to be deleted or a disk formatted there would still be a prompt. Other than that viruses are going to be tricky to avoid. Now what exactly does this checking the box suppose to do?
__________________
____________________________\¦/
___________________________(ò ó)
______________________o0o___(_)___o0o__
___¦_____¦_____¦_____¦_____¦_____¦_____¦
¦_____¦_____¦_____¦_____¦_____¦_____¦__
___¦_____¦_____¦_____¦_____¦_____¦_____¦
¦_____¦_____¦_____¦_____¦_____¦_____¦__
Reply With Quote
  #3 (permalink)  
Old 01-27-2005, 02:47 PM
scorpion's Avatar
Administrator
 
Join Date: Aug 2004
Posts: 1,923
Thanks: 97
Thanked 361 Times in 147 Posts
scorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to behold
Send a message via MSN to scorpion Send a message via Yahoo to scorpion
Default

If you check "Allow DLL imports" box then Experts are allowed to call dangerous external APIs, and if you check "Confirms DLL functions call" then you will be asked (YES or NO) to grant or deny the dangerous calls; it's up to you.

Well, I classify this functionality of MT4 as an serious security issue, because most users don't know what these checkboxs are, so they are at risk of being cheated to allow the dangerous calls. Confirmation of such dangerous call is no use for novice users.
__________________
Make easy pips with the Advanced Economic Calendar for Forex Trading.
Reply With Quote
  #4 (permalink)  
Old 01-27-2005, 02:51 PM
scorpion's Avatar
Administrator
 
Join Date: Aug 2004
Posts: 1,923
Thanks: 97
Thanked 361 Times in 147 Posts
scorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to beholdscorpion is a splendid one to behold
Send a message via MSN to scorpion Send a message via Yahoo to scorpion
Default

Anyway, just wanna warn you guys of this security issue, so be aware is better. Don't check the boxs if you are not supposed to check 'em.
__________________
Make easy pips with the Advanced Economic Calendar for Forex Trading.
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


Similar Threads
Thread Thread Starter Forum Replies Last Post
Getting spread in MetaTrader 4 karan MetaTrader and ZeroCode 3 05-23-2006 04:31 AM
Metatrader 4 released Rastarr MetaTrader and ZeroCode 17 07-08-2005 03:38 PM
Neurex goes to metatrader 4 !!! Belzebut MetaTrader and ZeroCode 1 07-07-2005 10:14 AM
Upcoming MetaTrader Version 4 scorpion MetaTrader and ZeroCode 12 11-26-2004 12:30 AM


All times are GMT. The time now is 11:46 AM.
Powered by vBulletin Version 3.6.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.1.0

Registered members have access to special online forex currency trading tools, software, mt4 expert advisors and indicators. Register now