Skip to content

Wechat may be agent spy #1758

@cross-hello

Description

@cross-hello

Environment

Phenomenon

After setting, explorer will connect 50051, 50052, 50053 port iteratively per three seconds.
image

thought

Af first, think it as the problem of Windows.
Then search get https://answers.microsoft.com/zh-hans/windows/forum/all/explorer%E4%B8%80%E7%9B%B4%E5%9C%A8%E8%AE%BF/7395ec69-6357-45e6-b794-72cad3b71de6

Then find it is wechat driver cause explorer to establish connection.
https://developers.weixin.qq.com/community/enterprisewechat/doc/000cacfa3a4c0086845af0caf56c01

After remove the wechat driver and restart explorer. The above ports explorer stop visit.

Here are the packages of removed wechat driver.
WXDrive.zip

How to replicate

  1. set global system variable : http_proxy=http://a.b.c.d:10811
  2. extract package to C:\Program Files (x86)\WXDrive
  3. restart windows explorer
  4. Visit connectting log on a.b.c.d server.( Please block .localhost. before: "regexp:.*localhost.*")

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions