full-disclosure - Re: Evilgrade 2.0 - the update explotation framework is back

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTinqd-Fo4BgrZeG3H+37boLssGP16UdzcUCHu_LJ@mail.gmail.com>
Date: Sat, 30 Oct 2010 14:23:31 -0700
From: Dan Kaminsky <dan@...para.com>
To: Valdis.Kletnieks@...edu
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Evilgrade 2.0 - the update explotation
 framework is back

On Sat, Oct 30, 2010 at 8:02 AM, <Valdis.Kletnieks@...edu> wrote:

> On Sat, 30 Oct 2010 04:43:14 +0800, Jacky Jack said:
> > It's now a time for vendors to re-consider their updating scheme.
>
> And do what differently, exactly?
>

We really need autoupdate baked into the platform.

A) Laying in wait for some random to think "Wow, I should update iTunes" and
> hijack the process.
>
> B) Send out a few hundred thousand spam with a '
> From:update@...le-itunes-support.com<From%3Aupdate@...le-itunes-support.com>
> '
> with a link to a site you control and feed the the sheep some malware.
>

Yeah, and C) I can take a rubber hose and choke you with it until you give
me the admin password.  That C works does not obviate A or B.

There are...side effects to C.

What you're not understanding is that many autoupdaters operate with zero
user interaction.  There is something to be said about silent ownage, simply
because you connected to a network.

Also, note that Evilgrade has been out for several years, and there are
still (many) vulnerable endpoints. This is the reality of design bugs --
they can survive the light of day, because they're such a miserable pain to
fix.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/