Classic Shell hacked with compromised update that erases your partition table • Hacker News Board

Re: Classic Shell hacked with compromised update that erases your partition table

#31

Post by AdmiralAsshat » Wed, Aug 03, 2016, 1:39 PM UTC

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer.

Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user.

How difficult would it be for the installer to compute its own hash and present it to the end-user when the installer starts, so that they can verify it against the hash posted on the front of the software's webpage?

EDIT: Although I suppose if the binary itself is compromised, the hackers could always modify the hash function so that it shows the same hash as an existing "good" version even with the malicious code added. Hmm.

Re: Classic Shell hacked with compromised update that erases your partition table

#32

Post by ultramancool » Wed, Aug 03, 2016, 1:42 PM UTC

nailer wrote: post #6

Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.

Yeah, but many apps for Windows still aren't signed so many users are trained to just click through.

Re: Classic Shell hacked with compromised update that erases your partition table

#33

Post by drzaiusapelord » Wed, Aug 03, 2016, 1:47 PM UTC

nailer wrote: post #6

Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.

MS just made all drivers required to be signed and I suspect the next step is to disallow downloads of executables that aren't signed. No, I don't mean smartscreen warnings, I mean a refusal to download entirely with exceptions being put in manually via a control panel item Grandma will be hesitant to mess with and via GPO for enterprise.

Then build out a reputation system for signers. I was recently given a link via steam to watch a video. It had an embedded fake Flash updater. The installer was very clever as it was signed by something like "Browser Company" and looked like the official Flash installer. My local AV and virustotal.com didn't detect it at the time either.

I think the age of it being convenient to run arbitrary executables in Windows is ending. There's just too much liability now, especially in the age of ransomware and kiddie hackers doing it for the lulz.

Re: Classic Shell hacked with compromised update that erases your partition table

#34

Post by warbiscuit » Wed, Aug 03, 2016, 1:48 PM UTC

This comment (http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=...) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums).

   ClassicShellSetup_4_3_0_clean.exe
   MD5: e10881b65c27c6e09e5a33cd8bcd99c6
   SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364
   File size: 7220496 bytes

   ClassicShellSetup_4_3_0_infected.exe
   MD5: c67dff7c65792e6ea24aa748f34b9232
   SHA1: 438b6fa7d5a2c7ca49837f403bcbb73c14d46a3e
   File size: 7148732 bytes

Re: Classic Shell hacked with compromised update that erases your partition table

#35

Post by beefhash » Wed, Aug 03, 2016, 1:52 PM UTC

warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic.

[1] https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities

[2] https://sites.google.com/site/itstheshappening/

Re: Classic Shell hacked with compromised update that erases your partition table

#36

Post by ayuvar » Wed, Aug 03, 2016, 1:56 PM UTC

AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

Signing the installer would help detect tampering, except it seems like in this case the compromised installer was not signed and the usual one is.

Nothing really stops you from unpacking all of the contents of the first installer, and repacking it with your payload into an unsigned installer which is likely what happened here.

Re: Classic Shell hacked with compromised update that erases your partition table

#37

Post by eli » Wed, Aug 03, 2016, 1:58 PM UTC

teh_klev wrote: post #24

pluma wrote: post #10

Earlier quoted context omitted.

I'm not sure it's appropriate to give that kind of people unwarranted publicity.

Links on HN are rel="nofollow" so they're not going to get any google juice.

I don't think SEO is what pluma is concerned about

Re: Classic Shell hacked with compromised update that erases your partition table

#38

Post by [deleted] » Wed, Aug 03, 2016, 2:00 PM UTC

AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

[deleted]

Re: Classic Shell hacked with compromised update that erases your partition table

#39

Post by DougN7 » Wed, Aug 03, 2016, 2:02 PM UTC

AdmiralAsshat wrote: post #31

So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer. Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user. How difficult would it be for the installer to compute its own hash and pre…

Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).

Re: Classic Shell hacked with compromised update that erases your partition table

#40

Post by eeeeeeeeeeeee » Wed, Aug 03, 2016, 2:07 PM UTC

TazeTSchnitzel wrote: post #25

This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights. OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.

I agree, in a way, but what is the point of root access on an OS X workstation? The "good stuff" -- bank accounts, personal data, etc. -- is inside that user account, even if it's not an admin user. And you can backdoor the user account to a point that the average user will never find it, making getting root less of a useful achievement.