7 ms·

I'm really curious where the 0-day is in the code of the project honestly

deleted 3y ago
[deleted]
saagarjha 3y ago
The 0-day is in a popular software package. The GitHub repo apparently contains a backdoor ability to execute code from the attacker. If I had to guess, this would be the software update functionality here: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
- r1ch 3y ago
  That's just malware. There's no 0-day here.
  - saagarjha 3y ago
    That’s what Google is calling it, so I’m inclined to believe them.
    - g___ 3y ago
      "In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.' The attackers used a 0-day but getsymbol is not one.
      - saagarjha 3y ago
        Yep, that’s what I said.
        deleted 3y ago
        [deleted]
        edgyquant 3y ago
        No it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.
        saagarjha 3y ago
        This is what I said: > The 0-day is in a popular software package. (I have no idea what this is.) > The GitHub repo apparently contains a backdoor ability to execute code from the attacker. (This is what Google says and I think it’s the autoupdater.) Is this different than what you feel?
rightbyte 3y ago
Seems to be some dll:s included. Maybe there? "But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain." Sounds like most software nowadays to be honest. The blog author does not really point out why this code would be more malicious than "normal" or how the code author is known to be Korean.
deleted 3y ago
[deleted]
dantillberg 3y ago
This "UpdateCheckThread" code looks pretty funky, [0]. It downloads some stuff from a URL, writes a file to disk, and creates a process to run it. 0: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...
- bdowling 3y ago
  If the code is wrapped in if (updateDlg.DoModal() == IDOK) { … } then doesn’t that mean it only runs that code if the user clicks “OK” on the update dialog? (Edit: I think I understand now. It’s not the code, it’s the update URL that’s the problem, because it’s controlled by NK. So if you run this and blindly click “OK”, then it will download an executable that will infect your PC.) (Edit 2: Or the issue is not in the source at all, but is in the prebuilt binary.)
  - rightbyte 3y ago
    It could be that the code is fine but the URL is compromised?

deleted 3y ago

[deleted]

The 0-day is in a popular software package. The GitHub repo apparently contains a backdoor ability to execute code from the attacker. If I had to guess, this would be the software update functionality here: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

r1ch 3y ago
That's just malware. There's no 0-day here.
- saagarjha 3y ago
  That’s what Google is calling it, so I’m inclined to believe them.
  - g___ 3y ago
    "In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.' The attackers used a 0-day but getsymbol is not one.
    - saagarjha 3y ago
      Yep, that’s what I said.
      - deleted 3y ago
        [deleted]
      - edgyquant 3y ago
        No it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.
        saagarjha 3y ago
        This is what I said: > The 0-day is in a popular software package. (I have no idea what this is.) > The GitHub repo apparently contains a backdoor ability to execute code from the attacker. (This is what Google says and I think it’s the autoupdater.) Is this different than what you feel?

rightbyte 3y ago

Seems to be some dll:s included. Maybe there? "But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain." Sounds like most software nowadays to be honest. The blog author does not really point out why this code would be more malicious than "normal" or how the code author is known to be Korean.

deleted 3y ago

[deleted]

dantillberg 3y ago

This "UpdateCheckThread" code looks pretty funky, [0]. It downloads some stuff from a URL, writes a file to disk, and creates a process to run it. 0: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308b58e1ea34e5d63afecca4316/GetSymbol/CMainDlg.cpp#L39 https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

bdowling 3y ago
If the code is wrapped in if (updateDlg.DoModal() == IDOK) { … } then doesn’t that mean it only runs that code if the user clicks “OK” on the update dialog? (Edit: I think I understand now. It’s not the code, it’s the update URL that’s the problem, because it’s controlled by NK. So if you run this and blindly click “OK”, then it will download an executable that will infect your PC.) (Edit 2: Or the issue is not in the source at all, but is in the prebuilt binary.)
- rightbyte 3y ago
  It could be that the code is fine but the URL is compromised?