Re:Evilgrade is like Firesheep for Software Updates
by gojomo on Thursday November 04, 2010 @03:06PM
(#1870308)
Are the latest versions of Skype, VMWare, and others listed there at risk of software-update hijacking, with no cryptographic verification of update payloads?
[ Parent
| on HN ]
Re:Evilgrade is like Firesheep for Software Updates
by dinedal on Thursday November 04, 2010 @03:23PM
(#1870381)
VMWare is in the compatibility list, so that's a yes there.
Re:Evilgrade is like Firesheep for Software Updates
by gojomo on Thursday November 04, 2010 @03:55PM
(#1870510)
I see it on the EvilGrade page; I'm asking here for independent confirmation.
Re:Evilgrade is like Firesheep for Software Updates
by dguido on Thursday November 04, 2010 @05:12PM
(#1870802)
Yeah, Virtual Infrastructure and VSphere clients download updates over HTTP from a URL that looks like: http://www.vmware.com/vmware<%RND1%>.exe