News for hackers. Stuff that matters.

A comment on Basic Electron Framework Exploitation. Parent comment

Re:Basic Electron Framework Exploitation by some_furry on Wednesday August 07, 2019 @02:17PM (#20637338)
> 1) We should absolutely work towards allowing developers to sign their JavaScript.

I've already been working on this for my own projects. It might be something that can be generalized for all Electron projects.

https://github.com/soatok/libvalence

https://github.com/soatok/valence-updateserver

https://github.com/soatok/valence-devtools

This uses Ed25519 signatures and an append-only cryptographic ledger to provide secure code delivery. The only piece it's currently missing is reproducible builds.

For greater context: https://defuse.ca/triangle-of-secure-code-delivery.htm

[ Parent | on HN ]
Re:Basic Electron Framework Exploitation by cjbprime on Wednesday August 07, 2019 @02:24PM (#20637412)
I think you need OS codesigning integration for this threat model. Otherwise whatever special app runtime check code you add just gets removed by the malicious overwrite of your app code.
[ Parent | on HN ]
Re:Basic Electron Framework Exploitation by some_furry on Wednesday August 07, 2019 @02:56PM (#20637722)
I'm just doing this for secure updates, so that malware doesn't get delivered through the update mechanism. For precedent, see https://core.trac.wordpress.org/ticket/39309

It isn't meant to mitigate a compromised endpoint.

[ Parent | on HN ]