4 ms·
What exactly is the attack vector? Are the users supposed to receive an unexpected jar file and run it? Or can it pretend it's an MSI the user legitimately wan
by jojobas 6y ago
What exactly is the attack vector?
Are the users supposed to receive an unexpected jar file and run it? Or can it pretend it's an MSI the user legitimately wanted, yet execute malicious code?
- eknkc 6y agoI guess it would not work as an MSI but would be fine as a JAR. As far as I can remember, jar is zip and zip has headers at the end of files. Making it possible to append a jar to something and disregard the first part. In this case a signed MSI. And so you have a code signed JAR from Microsoft. Then what? I don’t know.
- ComodoHacker 6y agoIt would work as an MSI, as MSI files are read from the start.
- Xylakant 6y agoHowever, from the description, it would not execute the payload as an msi either - the appended garbage would just be ignored from the installers perspective.
- ComodoHacker 6y agoJRE would execute the payload.
- jojobas 6y agoIt wouldn't, unless there's already a different exploit to do so.
- deleted 6y ago[deleted]
- llarsson 6y agoThe latter. You download an MSI from some file hosting mirror, who cares, because you then diligently look and see that it has been signed correctly by the company that made the software. But the vulnerability makes it rather trivial to have appended arbitrary content, even executable code, to it, without impacting the supposed validity of the signature. This is really bad.
- raxxorrax 6y agoI think signing software is futile anyway since it now behaves like malware that exfiltrates user data anyway. An installer that verifies its file hash has the same level of protection. Software development licences are a huge scam doing more for DRM than for actually real security.
- Xylakant 6y agoNo, the former. The file is renamed it .jar by the attacker and executed by the java runtime. The msi part is ignored - it only serves to cloak the jar from the scanner - it recognizes the file as msi and ignores signed msi files.
- ComodoHacker 6y agoA legitimate downloaded msi file with attached jar payload passes code signature verification. You rename it to .jar and the system executes the payload.
- jojobas 6y agoSo it requires an attacker to already have access to rename files, making it somewhat useful against somewhat locked down corporate machines?
- Lammy 6y agoAn attack—even an intentional one like a jailbreak—is usually many individual exploits applied simultaneously that each achieve a different step toward the goal of the attack. This MSI thing means a malicious blob of code can hang out on your machine in a supposedly-safe signed file, then something like a waterhole attack will use a browser exploit to trigger that malicious file. Compare to this real-world iOS attack: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...