Doesn't it mean that ADMF of FinFly somehow interferes with browser auto-update in order to upload its trojan to the target computer? I know browser update file must be somehow cryptographically signed, but NSA may have access to private RSA key used for browser updates, which allows such types of attacks. Isn't it?
Re:Spy Files 3
by toyg on Sunday September 22, 2013 @08:28AM
(#6426536)
I haven't read the docs, but from the wikileaks page describing it, I assume the malware "wraps" any exe. If it then manages to "unwrap" (on save?) and disappear before crypto checks happen, then they don't need actual need to attack the crypto.
Doesn't it mean that ADMF of FinFly somehow interferes with browser auto-update in order to upload its trojan to the target computer? I know browser update file must be somehow cryptographically signed, but NSA may have access to private RSA key used for browser updates, which allows such types of attacks. Isn't it?