Re: Vulnerability in WinRAR - Phishing based

[Andreas Beck <becka-list-bugtraq () bedatec de>]

preben () watchcom no wrote:
> Phishing through WinRAR 3.51
> Due to the build-up of WinRAR, some vital parts of the programs 
> functions and url's are visible through a simple HEX editor.

This is not specific to WinRAR. It is true for almost every usual
binary. Exceptions are only those using a compressor or obfuscation
layer.

> If a user want's to buy the full version of WinRar, the user can use 
> WinRAR's menu to access WinRars homepage.
> Now if the file WinRAR.exe was altered at 0009BCC0, it would be possible 
> to conduct a phishing attack against the user.

If the binary is modified, you are in far worse trouble than a mere
phishing attack.

If you can modify a binary, you can make it do anything. Like installing
a keylogger, intercepting the banking data, even if it is entered into
the original site, or your bank site.


The only point is, that modifying some string is a bit easier than
modifying functionality. However, this isn't of much value for 
programs that aren't run directly, but rather installed first.

You simply wrap another installer around the existing installer 
executable (one that doesn't ask questions), install your keylogger
stuff and then call the original installer. This is a generic process
that only needs to be done once and can be accomplished with fairly
standard tools.

Even for programs that are usually directly executed without
installation (like e.g. putty), a generic .EXE-infector as known 
from viri can be used.


> In a realistic senario, the attacker could spread the modified file(s), 
> through file sharing networks or download sites.

If you run software from untrusted sources, phishing is one of your 
smallest problems.


> Other versions of WinRAR might be vulnerable as well.

About every software that shows builtin external URLs to the user at
some point is "vulnerable" to that.

If we go to the scenario of a user running an untrusted binary, all is
lost anyway.


Kind regards,

Andreas Beck

-- 
Andreas Beck
http://www.bedatec.de/