4 ms·

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer.

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and present it to the end-user when the installer starts, so that they can verify it against the hash posted on the front of the software's webpage? EDIT: Although I suppose if the binary itself is compromised, the hackers could always modify the hash function so that it shows the same hash as an existing "good" version even with the malicious code added. Hmm.

ayuvar 10y ago
Signing the installer would help detect tampering, except it seems like in this case the compromised installer was not signed and the usual one is. Nothing really stops you from unpacking all of the contents of the first installer, and repacking it with your payload into an unsigned installer which is likely what happened here.
- ianlevesque 10y ago
  In theory that's what Windows SmartScreen is there to prevent.
  - Someone1234 10y ago
    Unfortunately every single one of those terrible "stop Windows 10 spying on you!!!" guides tells people to turn off SmartScreen along with UAC/Windows Firewall/Windows Defender. Or worse tells them to download an unknown program which turns off a bunch of security features at a single click without an explanation of the cost. But at least the user feels less spied upon or something...
    - Karunamon 10y ago
      SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons. Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s https://youtu.be/DD9CvHVU7B4?t=1m43s
      - Someone1234 10y ago
        What you see in that video isn't SmartScreen, SmartScreen is disabled in that video. Here is what SmartScreen actually looks like and actually does[0] on Windows 10 when attempting to download an unsigned installer. If Microsoft is aware that the file you're attempting to download is malware, they will block the download entirely (in IE/Edge). [0] http://imgur.com/a/l5JzM http://imgur.com/a/l5JzM
        Karunamon 10y ago
        Ah, yup. Good catch!
        kuschku 10y ago
        The issue is that due to the high costs of getting a certificate, a lot of legitimate software for Windows is still unsigned. I know several large FLOSS projects, with hundredthousands and millions of users, that ship only unsigned binaries, telling their users to turn off SmartScreen. If Microsoft would have used a GPG-like mechanism, or provided certs for free, it would look very different.
deleted 10y ago
[deleted]
DougN7 10y ago
Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).
- nexxer 10y ago
  Per the developer at that forum thread: "To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature." And per another user (silmar), my sentiments: "The problem with signed installers is: many software developers don't sign, so you install even if Windows warns you. Even if someone signs and then stops signing, it may be that he forgot about it. But you want to install NOW, so you skip the warning." Admittedly the download page doesn't mention signing or how to look for that, though, per the comment I referenced above, I doubt it would make much difference to the vast majority of users.
  - Zancarius 10y ago
    I doubt it as well, and I completely agree with what you and others have said. While I rarely use Windows, it's unsurprising to see software from smaller development shops release software with no signature (or at least historically it's been unsurprising). So, this complacency sort of breeds the habit of simply clicking through and installing anyway. Heck, I even remember when installing certain drivers often required clicking through similar warnings since they occasionally weren't signed. While I'd like to think things are generally better now, I think the historical inertia of Windows' ecosystem and how conditioned users have become to ignoring such warnings is at least partially (mostly?) at fault. There's no easy way to correct people's behavior, and enforcing certain settings (e.g. only installing signed software) would mean either 1) upsetting power users or 2) users still finding a way to disable such checks.
  - DougN7 10y ago
    I was just suggesting it would be easier to have people check for the displayed signature than get them to hash their download and compare it to something on the website.
tetha 10y ago
End-User-Effort just doesn't work, sadly. I'm currently rather thinking about some cross-referencing service. A developer would go ahead and register multiple download locations for their product. The system would go ahead and download the file from the various locations, compute checksums and alert if the checksums of different download locations differ. If this service exists, you'd have to compromise this service and a download location in order to exchange a file unnoticed for more than 2*the check interval. The major issues I see: - Updates are a big issue, because updates are a planned exchange of the binary to download. So I guess there'd need to be a set of valid checksums, which weakens the guarantees of the system, but not too much. - Resources are an issue, especially bandwidth and traffic. Imagine getting all debian isos from all mirrors to verify their checksums. But either way, such a service could be a good way to detect irregular file changes and notify the security community, devs, site admins and so on.

ayuvar 10y ago

Signing the installer would help detect tampering, except it seems like in this case the compromised installer was not signed and the usual one is. Nothing really stops you from unpacking all of the contents of the first installer, and repacking it with your payload into an unsigned installer which is likely what happened here.

ianlevesque 10y ago
In theory that's what Windows SmartScreen is there to prevent.
- Someone1234 10y ago
  Unfortunately every single one of those terrible "stop Windows 10 spying on you!!!" guides tells people to turn off SmartScreen along with UAC/Windows Firewall/Windows Defender. Or worse tells them to download an unknown program which turns off a bunch of security features at a single click without an explanation of the cost. But at least the user feels less spied upon or something...
  - Karunamon 10y ago
    SmartScreen is functionally useless, though. All it provides is a UAC warning for unsigned code, the likes of which through a legitimate user has clicked an untold number of times for perfectly legitimate reasons. Here's a video where the malicious file is executed. Nothing immediately seems amiss: https://youtu.be/DD9CvHVU7B4?t=1m43s https://youtu.be/DD9CvHVU7B4?t=1m43s
    - Someone1234 10y ago
      What you see in that video isn't SmartScreen, SmartScreen is disabled in that video. Here is what SmartScreen actually looks like and actually does[0] on Windows 10 when attempting to download an unsigned installer. If Microsoft is aware that the file you're attempting to download is malware, they will block the download entirely (in IE/Edge). [0] http://imgur.com/a/l5JzM http://imgur.com/a/l5JzM
      - Karunamon 10y ago
        Ah, yup. Good catch!
      - kuschku 10y ago
        The issue is that due to the high costs of getting a certificate, a lot of legitimate software for Windows is still unsigned. I know several large FLOSS projects, with hundredthousands and millions of users, that ship only unsigned binaries, telling their users to turn off SmartScreen. If Microsoft would have used a GPG-like mechanism, or provided certs for free, it would look very different.

deleted 10y ago

[deleted]

DougN7 10y ago

Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).

nexxer 10y ago
Per the developer at that forum thread: "To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature." And per another user (silmar), my sentiments: "The problem with signed installers is: many software developers don't sign, so you install even if Windows warns you. Even if someone signs and then stops signing, it may be that he forgot about it. But you want to install NOW, so you skip the warning." Admittedly the download page doesn't mention signing or how to look for that, though, per the comment I referenced above, I doubt it would make much difference to the vast majority of users.
- Zancarius 10y ago
  I doubt it as well, and I completely agree with what you and others have said. While I rarely use Windows, it's unsurprising to see software from smaller development shops release software with no signature (or at least historically it's been unsurprising). So, this complacency sort of breeds the habit of simply clicking through and installing anyway. Heck, I even remember when installing certain drivers often required clicking through similar warnings since they occasionally weren't signed. While I'd like to think things are generally better now, I think the historical inertia of Windows' ecosystem and how conditioned users have become to ignoring such warnings is at least partially (mostly?) at fault. There's no easy way to correct people's behavior, and enforcing certain settings (e.g. only installing signed software) would mean either 1) upsetting power users or 2) users still finding a way to disable such checks.
- DougN7 10y ago
  I was just suggesting it would be easier to have people check for the displayed signature than get them to hash their download and compare it to something on the website.

tetha 10y ago

End-User-Effort just doesn't work, sadly. I'm currently rather thinking about some cross-referencing service. A developer would go ahead and register multiple download locations for their product. The system would go ahead and download the file from the various locations, compute checksums and alert if the checksums of different download locations differ. If this service exists, you'd have to compromise this service and a download location in order to exchange a file unnoticed for more than 2*the check interval. The major issues I see: - Updates are a big issue, because updates are a planned exchange of the binary to download. So I guess there'd need to be a set of valid checksums, which weakens the guarantees of the system, but not too much. - Resources are an issue, especially bandwidth and traffic. Imagine getting all debian isos from all mirrors to verify their checksums. But either way, such a service could be a good way to detect irregular file changes and notify the security community, devs, site admins and so on.