4 ms·
The latter. You download an MSI from some file hosting mirror, who cares, because you then diligently look and see that it has been signed correctly by the comp
by llarsson 6y ago
The latter. You download an MSI from some file hosting mirror, who cares, because you then diligently look and see that it has been signed correctly by the company that made the software.
But the vulnerability makes it rather trivial to have appended arbitrary content, even executable code, to it, without impacting the supposed validity of the signature.
This is really bad.
- raxxorrax 6y agoI think signing software is futile anyway since it now behaves like malware that exfiltrates user data anyway. An installer that verifies its file hash has the same level of protection. Software development licences are a huge scam doing more for DRM than for actually real security.
- Xylakant 6y agoNo, the former. The file is renamed it .jar by the attacker and executed by the java runtime. The msi part is ignored - it only serves to cloak the jar from the scanner - it recognizes the file as msi and ignores signed msi files.