How Secure Is Emule? - Official eMule-Board (2024)

If someone is running eMule, how nuch more vulnerable do they become to hackers, viruses, spyware, etc.?

I've been running the program a few months now with no incidents. I recommended it to a friend of mine and he declined, saying he's been told by IT friends it's very risky.

I've searched the net a bit trying to get some info on this but haven't come up with anything yet.

thanks

eMule itself is safe.

It's no more dangerous than having an Internet connection without eMule. If you set rightly your router, firewall, antivirus, etcetera, eMule is not a hole in your system.

The things you download may be infected with malware as anything you can download in any network (be it P2P or not). In fact I have found more malware in http and Bittorrent than with ed2k or Kad (eMule). If go downloading every piece of crap offered in any network you bet you'll get malware.

DO UT DES

Quote

That kind of misinformation infuriates me! So often 'IT experts' haven't the faintest idea about computers. You can tell that from me

You get viruses easily enough if you aren't careful. Common sense applies. Using P2P does not increase this risk.

If you rely solely on a router as a firewall & manually forward ports AND do not have Emule running then there is an extremely mild risk of someone hacking your computer through those two ports. Chances of this occuring are so incredibly small it's not worth worrying about. Firewalls and their importance in home computing are overrated.

Well if you'd consider me an "IT expert" then I'd probably tell someone that is totally clueless that it's risky too. It surely isn't for me but someone that has no clue about computers is at constant risk by his mere presence on the net.

This post has been edited by Andu: 18 August 2007 - 05:52 PM

Three Rings for the Elven-kings under the sky,
Seven for the Dwarf-lords in their halls of stone,
Nine for Mortal Men doomed to die,
One for the Dark Lord on his dark throne
In the Land of Mordor where the Shadows lie.
One Ring to rule them all, One Ring to find them,
One Ring to bring them all and in the darkness bind them
In the Land of Mordor where the Shadows lie.

Dark Lord of the Forum

Morph your Mule

Need a little help with your MorphXT? Click here

I neither use personal firewalls (MS or 3rd party) or background antivirus applications for several years while directly connected to the internet with my XP machine.

Emule and other p2p apps are constantly running and guess what,
zero infections.
Nothing.
Nada.

I'm not recommending this for anyone with 2 left hands, zero computer knowledge and a windows OS "out of the box",
it is just to let you know, those "security" apps aren't really necessary.

Those 'IT experts' should know that.

How to setup Emule. A small checklist | Schmu's MuleDoc

P2P is not piracy, it's marketing.
In fact, if your music or movie is NOT being downloaded, you should be WORRIED !
If you can't even give it away for free, how do you expect to sell it, stupid ?

I'm a bloodsucking fiend. Look at my outfit !

I use a PF for a little bit of control over the applications that I have on my system. And an antivirus because I sometimes download dodgy stuff. But I think I could pretty much live without either.

Three Rings for the Elven-kings under the sky,
Seven for the Dwarf-lords in their halls of stone,
Nine for Mortal Men doomed to die,
One for the Dark Lord on his dark throne
In the Land of Mordor where the Shadows lie.
One Ring to rule them all, One Ring to find them,
One Ring to bring them all and in the darkness bind them
In the Land of Mordor where the Shadows lie.

Dark Lord of the Forum

Morph your Mule

Need a little help with your MorphXT? Click here

no firewall and av either. faq, invited you are ;o)

Hi everyone
Be carefully with the stuff you download, that is the key.
bye

Make your own ipfilter file, and manage fake files. Take in count, You are the best filter for emule.

What I meant by "How secure is it?" is "When using EMule, how much does the risk of either being hacked or infected with malware/viruses/spyware/etc. increase?"

The last post is interesting, but one problem is that I am not as experienced as you are and so am not following a lot of what you say in that key last paragraph.
I lost you after the first sentence. What's "secure indent"? "Fixed port"? "Fixed application"? "the hacker can overwrite the existing client"? and especially: "rewriting unreged pointers in memory and assigning it a task smiler to static shellcode exploits overwriting ebp."?

What I'm after here is some kind of info I might be able pass on to my friend that might convince him that his other IT friends are exaggerating the risks.

If there was someone who could explain what the realistic risks are using EMule in a way that my non-techie friend might be able to grasp (or ME even!), that's the kind of info that would help here. He's a smart guy, a teacher, but not the most computer savvy person I know.

So again, in that same last post, if I was following correctly, it seems that there is at least some risk of being hacked. Is that risk increased by having EMule installed and connected? Or is it not affected by EMule being installed and running?

Niclights, you mentioned that if EMule is not running then there's some risk of the ports it uses being used by a hacker to enter... am I understanding that correctly? If I am, does it also mean that Emule needs to be occupying those ports while running or else they are just left open for someone else to possibly enter through? Is that correct? But Emule running and using the ports would prevent that? If so, it's a risk I was not aware of.

For one, even if the risk of being hacked was the same as if EMule was not installed, having the program installed means you are probably connected online for a much greater amount of time, and so it effectively increases your vulnerabilty just by increasing your online time vulnerability.

If it helps, my friend does have a complete package of Anti-Virus, Anti-Spyware (a number of them, with one protecting in real time) and also a Firewall.

Here is one more question: is EMule safer to use than Torrent? If so, why?

So far, it seems as if the risks break down to 2 categories:

1. downloading a file and accidentally opening malware/etc. that is attached to it
2. being hacked

#2 is the one I think I need to understand much better.

Are there any other risks other than these 2?

billermo, on Aug 21 2007, 01:44 PM, said:

Translated: it is possible, but is very very improbable.

billermo, on Aug 21 2007, 01:44 PM, said:

That's all your friend needs.

billermo, on Aug 21 2007, 01:44 PM, said:

#1 is the 99.99% of the risk. So if you or your friend take care, the risk is insignificant.

DO UT DES

You (your PC) are much more likely to get infected via other applications (Browser, Email, Messenger, ...) that connect to the internet.

Once you are infected via such an avenue, there are many viruses that explicitly use p2p applications (ed2k, gnutella, ...) to spread themselves further or do whatever they want to do.

Your main concern should be to close this way of infection first !

Either by using always-up-to-date malware protection(s) and/or by properly configuring AND using those applications (sadly requires more than just basic knowledge).

Then the risk of "being hacked" can be reduced to almost Zero, by allowing INCOMING network traffic only to well tested applications (like emule) you REALLY need for your daily work.

You can do that either by using a good router and/or a personal firewall ("easier" way, lots of side effects) or by spending some quality time with your PC configuring it in a more secure way.

But even that is no 100% guarantee forever (yes, i do make backups).
There just isn't a "magic bullet", no matter what the marketing says.

What do you mean by "EMule safer to use than Torrent" ?

The clients?

There hasn't been a known exploitable vulnerability in Emule for some time, but that doesn't mean Emule is 100% bug free.
Whereas Azureus and utorrent both had severe bugs just lately.
And with all the other closed source clients you will probably never know for sure.

The content?

There are just as many infested files on the ed2k network as on any public torrent tracker.
Scan finished files with at least 2 different malware scanners to have some assurance.
Or stick to ed2k release forums/sites and private trackers to reduce the risk even before you start downloading.

This post has been edited by qm2003: 21 August 2007 - 06:57 PM

How to setup Emule. A small checklist | Schmu's MuleDoc

P2P is not piracy, it's marketing.
In fact, if your music or movie is NOT being downloaded, you should be WORRIED !
If you can't even give it away for free, how do you expect to sell it, stupid ?

I'm a bloodsucking fiend. Look at my outfit !

Hi, I'm a novice here. I have a security question :
Let's suppose that I'm connected to a server, which is hopefully safe. I do a search with the 'server' (not 'global') method and I begin downloading a file.
Then the server and the other peers who are sharing that file can know my IP and the file I'm downloading.
And if I'm not mistaken, although my search only turns up peers who are connected to the supposedly safe server, If those other peers are using the 'global search' option and they are connected to peers from other servers, then consequently I may get connected to peers from other servers, is this correct?
Then what can those other servers know about me, theoretically? Do they know my IP or what file i'm downloading / uploading?
And what about Kademilla? is Kad strictly P2P? Is my information sent only to the peers who are sharing files with me?

Edited:
Sorry, I re-read the network guide here :
http://www.emule-pro...p;rm=show_topic

It seems that I was wrong with my guess. It says:
'Finding sources for files
Downloads can be added by eMule’s search function or a special eD2k link format offered on many websites.
Once they are in the Download list, eMule first queries the local (connected) server then all other servers in the network for sources to that particular download. The server looks up the file’s hash value in its database and returns the clients it knows for having it.'

So, 'all other servers in the network' - What does it mean? Coud it be the servers listed in my own 'server.met' file?

Then, if my 'server.met' is safe, and if one of my peers has a 'server.met' which contains a malicious server( which is not listed in my 'server.met'), is it possibile that my information(my IP, my shared files, what file I'm downloading or uploading) is sent to that server?

This post has been edited by Snowb34: 27 December 2007 - 09:34 AM

Your question is answered in other topic you opened.

Stoepsel, on Dec 27 2007, 12:56 PM, said:

Your

Anyway you have some mistakes about how eMule and eD2K work. Your ip and the files you share are send and stored just in the server you are connected to. You can find sources from all the servers you have in your list and via source interchange or passive from other users, and BTW from Kad.

Cheers

As I understand it (and I'm sure someone will correct me if I'm wrong), it works like this;

If you have a computer with no firewall, either in software or in a router, then all the ports are open. Anyone who gets your IP address (most of the time, they're not looking for you just any IP address with open ports), they can attempt to make a connection to your system and try to hack it. They find open ports by running a port scanner that sends requests to the different ports, looking for a response.

When you run a software firewall, it closes all the ports and (hopefully) doesn't respond at all to port scanning. Some programs such as eMule or the various BitTorrent clients (as well as some other programs) need to open ports to function. They have to be able to listen for and accept incoming connections. Software firewalls can be set to open these ports when they detect a particular program running, and close them when the program closes.

Router firewalls typically can't tell when a particular program is running, because the router is a separate box. All it knows about are the connections going through it. By default it blocks incoming connections, to protect you from hackers. Of course some programs need to have it pass through the connections to function. To do this, you forward the ports. Meaning any time the router receives an incoming connection reuest on port xxxx, it forwards it to the computer rather than blocking it. As was mentioned above, if you only have a router and no software firewall, then any ports you forward are effectively open all the time.

When you have a program like eMule running, it watches those ports and only accepts incoming connections from other clients using the same network. Think of a port as being like a telephone. Having the port open is like putting the phone out on the street and leaving it unguarded. When it rings, anyone might pick it up. With a firewall, it's like unplugging the phone; nobody can use it because it's not connected. With a program running that specifically uses that port, it's like having a secretary to answer the phone who makes sure that nobody else picks it up.

So in summary, incoming connections first have to get past your router (if you have one), your software firewall (which you should have) and even then, they'll only be able to connect to the ports that eMule is using and eMule will reject any connection that doesn't come from another eDonkey or KAD client program.

As for other security risks...

As has already been said, if you download and run an infected file, viruses and malware can get onto your system that way. However, the risk on P2P networks is no greater than downloading from any other source on the net. Audio, video, pictures and text are all generally safe to download. WMV/ASF video files can contain browser triggers that when played in Windows Media Player, can send your browser to a site where it might be infected with malware. The solution is to avoid these types of files unless you're sure of the source, or to view them in a player that won't act on the triggers, like Media Player Classic or VLC.

Additionally, you should be sure that whatever P2P client you install (eMule, BitTorrent, whatever) is a trustworthy program. Malware authors have been known to put out their own modified P2P programs which look like the real thing, but which install malware. eMule and uTorrent are both considered safe.

Finally, you should be aware that Microsoft, in its infinity stupidity, made the default in Windows to NOT show file extensions for known file types. This makes it possible for malware authors to create filenames like "BritneySpears.jpg.exe" Windows removes the true extension ".EXE" making it look like a jpeg file. Users double-click to view the file and the program runs and infects their system. This should be turned off in the Folder Options.

What others know about you...

When you run eMule, it sends your list of shared files to the server to be indexed, so that other users who may be searching for those files will be able to find them. Anyone who wants one of those files will be given your IP address so that they can connect directly to you and request the file. As other people search for those files, your IP address will get passed around through various methods like source exchange (asking other clients if they know anyone else who has the file). If you're worried about hackers getting your IP address, don't be. Hackers don't use the P2P networks for getting IP addresses to hack. If you're worried about your IP address because you're downloading copyrighted content, then shame on you! I've got bad news for you; There's no guaranteed way to prevent the wrong people from seeing your IP address or knowing that you're sharing a copy of Vampire Cheerleaders from Venus. On the bright side, if something is old/obscure, the chances are less likely that anyone would be looking and if it's something really popular, you're just one of many.

I would say that the only sure way to stay out of trouble is to never download anything that might be copyrighted, but RIAA has been known to sue dead people and people who don't even own computers.

Just to quickly expand on the vulnerabilities of routers and port-forwarding, an advantage of using UPnP (assuming it works!) is that it can forward the ports on application start and close on application end.