Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Classic Shell hacked with compromised update that erases your partition table

classicshell.net

Post reply on HN
Print view View original

71–80 of 110 posts

Re: Classic Shell hacked with compromised update that erases your partition table

#71

Post by flurpitude »

mtgx wrote: post #54
corobo wrote: post #4

It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.

I also hate that Fosshub doesn't even use HTTPS, even though they could get a Let's Encrypt certificate for free. They only offer file signatures, but even those are MD5 and SHA1, and both types should've been deprecated a while ago.

I don't see much value in published file hashes when they're hosted on the same site that hosts the files. If someone compromises the download link they're probably in a good position to update the hashes too.

Re: Classic Shell hacked with compromised update that erases your partition table

#73

Post by rvern »

Zardoz84 wrote: post #63
drewg123 wrote: post #26

Earlier quoted context omitted.

There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about. Obligatory xkcd: https://xkcd.com/1200/

And because that, I never allow to my web browser to remember my passwords.

The application can still get them, it doesn't matter whether they're in a file on your hard drive or typed manually.

Re: Classic Shell hacked with compromised update that erases your partition table

#74

Post by marcosdumay »

beefhash wrote: post #35
warbiscuit wrote: post #34

This comment ( http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=... ) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums). ClassicShellSetup_4_3_0_clean.exe MD5: e10881b65c27c6e09e5a33cd8bcd99c6 SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364 File size: 7220496 bytes ClassicShellSetup_4_3_0_infected.exe MD5: c67dff7c…

Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic. [1] https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities [2] https://sites.google.com/site/itstheshappening/

From this use case, where one person makes a file, and then an attacker forges another one with the same hash, MD5 was just recently broken and SHA-1 is far from it. Also, it's not immediately clear if a pair of broken hashes is also broken or not (depends on many things, and I probably don't even know half of them).

So, I'd say this is safe, for now. Yet, I also get bad feelings when somebody either comes with an MD5 hash or uses a SHA-1 as the most secure option.

Re: Classic Shell hacked with compromised update that erases your partition table

#75

Post by semi-extrinsic »

Sir_Cmpwn wrote: post #67
Zardoz84 wrote: post #61

Earlier quoted context omitted.

I'm begin to think that EFI is a very wrong turn way on modern computers.

You're a bit behind the curve on this. EFI has been criticized for being horrendously complicated and gross since its inception.

Obligatory Matthew Garrett quote from a Linux kernel EFI patch in 2011:

UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" is an ancient African word meaning "Why do something right when you can do it so wrong that children will weep and brave adults will cower before you", and "UEI" is Celtic for "We missed DOS so we burned it into your ROMs".

https://lkml.org/lkml/2011/5/25/228

Re: Classic Shell hacked with compromised update that erases your partition table

#76

Post by pritambaral »

TazeTSchnitzel wrote: post #65
e40 wrote: post #62

Earlier quoted context omitted.

OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications /Applications requires administrative rights to update. I never use an admin account for every day activity, so I need to type in a password to update /Applications.

Yes, dragging the application there requires admin rights, but it doesn't grant those to the app itself.

What if the app had an suid binary?

Disclosure: I'm not a mac user, and never have been one long enough to mess around with /Applications.

Re: Classic Shell hacked with compromised update that erases your partition table

#77

Post by warbiscuit »

kalleboo wrote: post #51
beefhash wrote: post #35

Earlier quoted context omitted.

Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic. [1] https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities [2] https://sites.google.com/site/itstheshappening/

It seems more reliable to check the developer signature in Properties on the EXE - the correct developer is "Ivaylo Beltchev". The infected download is unsigned and requires you to click through a warning.

Though annoyingly it's signed using sha1, not sha256.

So if they were gonna put effort into making an sha1 collision, they'd probably target the signed payload, not the overall exe.

Though it doesn't look like sha1 is that broken yet, for the budget of this grade of attacker.

Re: Classic Shell hacked with compromised update that erases your partition table

#78

Post by 0x0539 »

flurpitude wrote: post #71
mtgx wrote: post #54

Earlier quoted context omitted.

I also hate that Fosshub doesn't even use HTTPS, even though they could get a Let's Encrypt certificate for free. They only offer file signatures, but even those are MD5 and SHA1, and both types should've been deprecated a while ago.

I don't see much value in published file hashes when they're hosted on the same site that hosts the files. If someone compromises the download link they're probably in a good position to update the hashes too.

The purpose of the hashes isn't to prove the file hasn't been tampered with, its confirm that the file wasn't corrupted during download.

Re: Classic Shell hacked with compromised update that erases your partition table

#79

Post by digi_owl »

Zardoz84 wrote: post #61
voltagex_ wrote: post #16

Earlier quoted context omitted.

Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.

I'm begin to think that EFI is a very wrong turn way on modern computers.

The PC platform as a whole is going through a severe case of "second system effect".

Re: Classic Shell hacked with compromised update that erases your partition table

#80

Post by ultramancool »

fencepost wrote: post #47
Forge36 wrote: post #15

I hope the auto update wasn't affected. I just did this at work, no big warning screen. Now I'm paranoid to reboot.. Update: Looks like I wasn't affected. There was an official update (4.3.0) which was released on the 30th leading to unfortunate timing.

The thread on Classic Shell specifically notes that the auto update pulls from a different source that was not affected.

It also verifies signatures before it will execute the update, so even if that source were hacked it wouldn't have been affected.
Post reply on HN