Re: Evilgrade 2.0 - the update explotation framework is back

[Dan Kaminsky <dan () doxpara com>]

On Sat, Oct 30, 2010 at 8:02 AM, <Valdis.Kletnieks () vt edu> wrote:

> On Sat, 30 Oct 2010 04:43:14 +0800, Jacky Jack said:
> > It's now a time for vendors to re-consider their updating scheme.
>
> And do what differently, exactly?

We really need autoupdate baked into the platform.

A) Laying in wait for some random to think "Wow, I should update iTunes" and
> hijack the process.
>
> B) Send out a few hundred thousand spam with a '
> From:update () apple-itunes-support com<From%3Aupdate () apple-itunes-support com>
> '
> with a link to a site you control and feed the the sheep some malware.

Yeah, and C) I can take a rubber hose and choke you with it until you give
me the admin password.  That C works does not obviate A or B.

There are...side effects to C.

What you're not understanding is that many autoupdaters operate with zero
user interaction.  There is something to be said about silent ownage, simply
because you connected to a network.

Also, note that Evilgrade has been out for several years, and there are
still (many) vulnerable endpoints. This is the reality of design bugs --
they can survive the light of day, because they're such a miserable pain to
fix.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/