Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Evilgrade 2.0 - the update explotation framework is back
From: Dan Kaminsky <dan () doxpara com>
Date: Sat, 30 Oct 2010 14:23:31 -0700

On Sat, Oct 30, 2010 at 8:02 AM, <Valdis.Kletnieks () vt edu> wrote:

On Sat, 30 Oct 2010 04:43:14 +0800, Jacky Jack said:
It's now a time for vendors to re-consider their updating scheme.

And do what differently, exactly?

We really need autoupdate baked into the platform.

A) Laying in wait for some random to think "Wow, I should update iTunes" and
hijack the process.

B) Send out a few hundred thousand spam with a '
From:update () apple-itunes-support com<From%3Aupdate () apple-itunes-support com>
with a link to a site you control and feed the the sheep some malware.

Yeah, and C) I can take a rubber hose and choke you with it until you give
me the admin password.  That C works does not obviate A or B.

There are...side effects to C.

What you're not understanding is that many autoupdaters operate with zero
user interaction.  There is something to be said about silent ownage, simply
because you connected to a network.

Also, note that Evilgrade has been out for several years, and there are
still (many) vulnerable endpoints. This is the reality of design bugs --
they can survive the light of day, because they're such a miserable pain to
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]