4 ms·
A legitimate downloaded msi file with attached jar payload passes code signature verification. You rename it to .jar and the system executes the payload.
by ComodoHacker 6y ago
A legitimate downloaded msi file with attached jar payload passes code signature verification. You rename it to .jar and the system executes the payload.
- jojobas 6y agoSo it requires an attacker to already have access to rename files, making it somewhat useful against somewhat locked down corporate machines?
- Lammy 6y agoAn attack—even an intentional one like a jailbreak—is usually many individual exploits applied simultaneously that each achieve a different step toward the goal of the attack. This MSI thing means a malicious blob of code can hang out on your machine in a supposedly-safe signed file, then something like a waterhole attack will use a browser exploit to trigger that malicious file. Compare to this real-world iOS attack: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...