News for hackers. Stuff that matters.

A comment on WeWork isn’t a tech company; it’s a soap opera. Parent comment

Re:WeWork isn’t a tech company; it’s a soap opera by stefan_ on Thursday August 15, 2019 @02:13PM (#20708005)
A favorite attack vector is various auto-updating software on your computer that downloads updates or update metadata over HTTP. For the longest time Sparkle (an update framework used in Mac apps such as VLC, iTerm, ..) defaulted to HTTP.

Once an attacker is in your network, it's more or less trivial to make that software connect to a malicious update server.

[ Parent | on HN ]
Re:WeWork isn’t a tech company; it’s a soap opera by Kalium on Thursday August 15, 2019 @02:18PM (#20708050)
There's a limited amount of room to exploit this, this so long as signing is handled correctly. The Debian Apt system worked this way for a long time.

Of course, a lot of code signing systems are mismanaged, so...

[ Parent | on HN ]