Comments on Metasploit: Evilgrade Will Destroy Us All

I think Dan Kaminsky has a good set of guidelines:...

2009-02-21T16:38:00.000-08:00

I think Dan Kaminsky has a good set of guidelines:

* To succeed, your update package must be:
o Signed.
o Signed by you.
o Signed by you, using the right EKU (Extended Key Usage)
o Signed from an unrevoked signature
o Be the same product
o Be a new version

Source: www.doxpara.com/DMK_BO2K8.ppt

i think we should define a new standard for update...

2008-07-31T00:44:00.001-07:00

i think we should define a new standard for update services based on more reliable cryptographic methods. using a distibuted PKI including all Software vendors is not enough but a little step in the right direction.
kroakadil

Just using HTTPS/SSL isn't enough--there needs to ...

2008-07-30T18:28:00.000-07:00

Just using HTTPS/SSL isn't enough--there needs to be proper certificate verification. SECOBJADV-001 is an example of a vulnerability in an updater that uses HTTPS. In this case, it was Lenovo's SystemUpdate which comes installed by default on their laptops.

nate: embedding the public key in a signed executa...

2008-07-29T22:58:00.000-07:00

nate: embedding the public key in a signed executable only prevents the executable from being modified. An attacker could simply supply a different executable with his own key embedded in it.

Colin:These papers do a pretty good job of outlin...

2008-07-29T19:14:00.000-07:00

Colin:
These papers do a pretty good job of outlining the risks and proper protections.
Note that it's a much harder problem then you might think..

Very nice, as always the update procedure should u...

2008-07-29T14:32:00.000-07:00

Very nice, as always the update procedure should use https.

This is a great tool for security demonstration.

Digitally signing updates should solve most of iss...

2008-07-28T23:07:00.000-07:00

Digitally signing updates should solve most of issues imho.

We're all doomed! This is neat stuff that everyon...

2008-07-28T21:52:00.000-07:00

We're all doomed! This is neat stuff that everyone knew was coming but hoped would wait just a little while longer to appear.

Re: approach to secure updates. Sign them and embed the public key in your executable. Just beware crypto flaws like not checking RSA padding -- get your design reviewed!

Has anyone published a set of guidelines for writi...

2008-07-28T10:41:00.000-07:00

Has anyone published a set of guidelines for writing a secure updater?