4 ms·
Just to elaborate since there is some confusion about when the name would occur. 1) Take MicrosoftSigned.Msi 2) Append Malway.jar to it 3) Take file and rena
by JamesBarney 6y ago
Just to elaborate since there is some confusion about when the name would occur.
1) Take MicrosoftSigned.Msi
2) Append Malway.jar to it
3) Take file and rename it as RunMe.Jar
# Now you have a jar file that appears to be signed by Microsoft but contains malways.
4. Give target RunMe.jar and ask then to dbl-click it.
# Usually this file would prompt the user with a "You shouldn't trust this arbitrary file from the internet" prompt, but it doesn't because Windows thinks this file is correctly signed
5. Target is now infected
- rootsudo 6y agoThat's interesting, so you literally have to add the jar file to the EOF for the MSI? I know this can be done w/ Cat. --Wow, so JAR files are read from bottom top so it literally masquerades. That's interesting.
- chupasaurus 6y agoThere's an old similar technic - concatenate JPEG with RAR, JPEG header only describes image part, for archive files they're opened from their correspondent header.
- barrkel 6y agoZip files have the index at the end of the file so that new files can be added to the archive without rewriting the whole thing. Zips can also be read from front to back, reading the header of each entry and skipping the compressed data to the next header, which is most of what zip repair utilities do (or did, not sure anyone repairs zips any more). But it's faster to read the index. And to be clear, jars are zip files.
- anonymfus 6y agoNot every zip-based format behaves like this, Microsoft's zip based container formats tend to require a proper beginning too. For example if you add docx (which is a zip file) to the end of something else and open it in Microsoft Word, it will complain that the file is corrupted, and will suggest to repair it.
- Lammy 6y ago> 4. Give target RunMe.jar and ask then to dbl-click it. Or, even better, simultaneously put a silent drive-by browser zero-day in a website they visit regularly, like https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
- staticassertion 6y agoIf you can execute code on the host I don't think this attack is necessary, unless maybe you disable execution entirely for unsigned programs. The attacker can drop/ exec files as they please, regardless of whether they're signed. Anyone can feel free to correct me.
- sukilot 6y agoDoes Windows claim to verify signatures JRE data files, or only native executables?
- mqus 6y agoWell if they don't claim it, then they shouldn't try to verify and let it mark as "verified" anyways. If they do claim it then they should properly verify signatures Either way is wrong.
- hoistbypetard 6y agoWindows marks the JAR file as verified in the properties just because there's a verified msi structure at the front of it. I count that as a claim to have verified the file. Because that's what windows displayed.
- donmcronald 6y agoSo does the .msi contain a file length that gets blindly trusted? Or maybe that's part of the signature itself? That's crazy the signature check wouldn't verify the file length.