Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Permanent fix for #797 #798

Closed
Kreyren opened this issue Jan 10, 2019 · 13 comments
Closed

Permanent fix for #797 #798

Kreyren opened this issue Jan 10, 2019 · 13 comments

Comments

@Kreyren
Copy link
Contributor

Kreyren commented Jan 10, 2019

League Of Legends installers seems to be frequently updated -> causes checksum mismatch.

Reference: #797 (comment)

Suggestions? Can we in theory make something that would update the checksum automatically?

@plata
Copy link
Collaborator

plata commented Jan 10, 2019

If the checksum changes a lot, you can just leave it away.

@qparis
Copy link
Member

qparis commented Jan 10, 2019

Or, we use a browser step to manage the download of the client

@Kreyren
Copy link
Contributor Author

Kreyren commented Jan 10, 2019

@plata @qparis Both seems unsane, recommends making a bot that updates the checksum since this is a problem on most wineapps.

Ignoring checksum nor using browser to download the wineapp opens a security hole to system assuming changed hosts file.

@plata
Copy link
Collaborator

plata commented Jan 10, 2019

How is the checksum related to your /etc/hosts?

@qparis
Copy link
Member

qparis commented Jan 10, 2019

Checksum does not secure http transaction is not a digital signature mechanism, especially when it is automatically updated.....

HTTPS has been created to solve this problem

@Kreyren
Copy link
Contributor Author

Kreyren commented Jan 10, 2019

@qparis HTTPS can be abused since any page can use secure certificate..

Alike:
image

Note the invalid URL -> Phishing website designed to steal M$ accounts


@plata If hosts file is changed for the Installer's website the phoenicis can invoke a malware on wine, note that WannaCry runs on platinum in WINE and that many systems are still vulnerable to spectre, meltdown, etc..

@qparis
Copy link
Member

qparis commented Jan 10, 2019

If you have access on the machine and you can install a certificate, of course, anything can be abused... Please read about checksum, digital signature and cryptography. Saying that we should create a bot that automatically changes the checksum on the script for security reason is just crazy

@Kreyren
Copy link
Contributor Author

Kreyren commented Jan 11, 2019

@qparis Note that mensioned site above comes with valid certificate nothing was changed from my side. I'm suggesting to make a bot that is going to update the checksum in case the installer is updated.

Why is it insane?

@qparis
Copy link
Member

qparis commented Jan 11, 2019

@Kreyren You are suggesting to "secure" a HTTPS connexion with a checksum, that is crazy for many reasons:

  • The scripts is downloaded through HTTPS, so if I follow your reasoning, nothing guarantee me that it has not been altered aither
  • Authorities won't deliver certificate to anybody, you need to prove that you own the domain

Can we now focus on the real problem of this ticket or do we continue to reinvent https?

@Kreyren
Copy link
Contributor Author

Kreyren commented Jan 11, 2019

@qparis

The scripts is downloaded through HTTPS, so if I follow your reasoning, nothing guarantee me that it has not been altered aither
Authorities won't deliver certificate to anybody, you need to prove that you own the domain

https://thehackernews.com/2017/04/unicode-Punycode-phishing-attack.html, Note that the site in an example has secure certificate.. Sites alike are also common and hosts manipulation can be done on most noob distros or macOS remotely..

MACOSX : https://www.exploit-db.com/exploits/44307
Linux : https://www.exploit-db.com/?platform=linux


Can we now focus on the real problem of this ticket or do we continue to reinvent https?

Made a hotfix to disable checksum. Dunno how else it could be solved excluding automatic checksum

@qparis
Copy link
Member

qparis commented Jan 11, 2019

Have you read the article and do you understand how it works? If so, you would have noticed that this is out of our context.

So as I said before, we have two solutions:

  • Simply disable checksums
  • Add a browser step to download the client

@madoar @plata any opinion?

@plata
Copy link
Collaborator

plata commented Jan 11, 2019

Just disable the checksum like all other scripts where the downloaded file changes frequently.

@Kreyren
Copy link
Contributor Author

Kreyren commented Jan 11, 2019

Disagree, but i respect the decision.

Recommends closing.

@plata plata closed this as completed Jan 12, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants