Re:Zoom has a signed binary that runs any unsigned script
by UncleMeat on Wednesday April 01, 2020 @01:12PM
(#22751044)
And somehow break the binary's signature?
But the truth is you don't really need to do that. If people are coming to your own domain you can ship them whatever you want. I'd wager that well below 1/1,000,000 users actually verify signatures on binaries. For the huge majority of users, there is little you can do to prevent this.
Re:Zoom has a signed binary that runs any unsigned script
by virgilp on Wednesday April 01, 2020 @12:37PM
(#22750613)
But if you modify it, it's no longer signed?
Re:Zoom has a signed binary that runs any unsigned script
by seb314 on Wednesday April 01, 2020 @12:58PM
(#22750872)
apparently the issue is that you could modify the script, keeping the script-launching binary unchanged and signed?
did not try/verify though
Re:Zoom has a signed binary that runs any unsigned script
by UncleMeat on Wednesday April 01, 2020 @01:19PM
(#22751151)
How are you planning on modifying the script?
The network can't do it if it is downloaded over TLS. A malicious host can already ship evil scripts. Malware on the local machine can already do worse that edit a script.
Re:Zoom has a signed binary that runs any unsigned script
by lordlimecat on Wednesday April 01, 2020 @02:06PM
(#22751727)
The installer is code-signed, and requests root privileges, right?
>Malware on the local machine can already do worse that edit a script.
Malware on the local machine may not have root rights. You're basically arguing that privilege escalation isnt a real threat.
You get the zoom signed package installing your unsigned code.