4 ms·
There's a screenshot at the page 49 of https://wikileaks.org/spyfiles/docs/GAMMA_2010_FinfFINFISP_en.html https://wikileaks.org/spyfiles/docs/GAMMA_2010_FinfFIN
by mkup 13y ago
There's a screenshot at the page 49 of https://wikileaks.org/spyfiles/docs/GAMMA_2010_FinfFINFISP_en.html https://wikileaks.org/spyfiles/docs/GAMMA_2010_FinfFINFISP_e... (logs of ADMF trojan upload service) which mentions resource "chrome_installer(3)_129271991323222656.exe" was processed.
Doesn't it mean that ADMF of FinFly somehow interferes with browser auto-update in order to upload its trojan to the target computer? I know browser update file must be somehow cryptographically signed, but NSA may have access to private RSA key used for browser updates, which allows such types of attacks. Isn't it?
- toyg 13y agoI haven't read the docs, but from the wikileaks page describing it, I assume the malware "wraps" any exe. If it then manages to "unwrap" (on save?) and disappear before crypto checks happen, then they don't need actual need to attack the crypto.