New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Switch to NSIS 3.03 to avoid DLL hijacking #13643

Closed
wants to merge 2 commits into
base: master
from

Conversation

Projects
None yet
8 participants
@h4x3rotab

h4x3rotab commented Jul 12, 2018

Early version of NSIS searches its DLL from the same directory of the executable. If a hacker can place some DLL files in the same directory of the bitcoin installer, the installer will load and run it with admin permission.

Gitian is still in trusty. It shipped with NSIS 2.46, which is vulnerable to this issue. So in this fix, we instead build the latest NSIS by Gitian.

Thanks to @wilsonmeier from Bitcoin Gold team for the fix. Borrowed some code from TOR project.

Details: https://trac.torproject.org/projects/tor/ticket/17895

@fanquake fanquake requested a review from theuni Jul 12, 2018

@laanwj

This comment has been minimized.

Member

laanwj commented Jul 12, 2018

Thanks,
The idea was to switch to Ubuntu 18.04 for building to avoid having to do this, as that ships with a newer NSIS package, but if that turns out not to be feasible before the next release this will be helpful!

Switch to NSIS 3.03 to avoid DLL hijacking
Early version of NSIS searches its DLL from the same directory of
the executable. If a hacker can place some DLL files in the same
directory of the bitcoin installer, the installer will load and
run it with admin permission.

Gitian is still in trusty. It shipped with NSIS 2.46, which is
vulnerable to this issue. So in this fix, we instead build the
latest NSIS by Gitian.

Thanks to @wilson from Bitcoin Gold team for the fix. Borrowed some
code from TOR project.

Details: https://trac.torproject.org/projects/tor/ticket/17895

@h4x3rotab h4x3rotab force-pushed the h4x3rotab:nsis-fix branch from 628aa01 to 921c372 Jul 12, 2018

@MarcoFalke

This comment has been minimized.

Member

MarcoFalke commented Jul 12, 2018

if that turns out not to be feasible before the next release this will be helpful!

Currently our Windows gitian cross builds are broken, so we'd have to switch to bionic. (Or revert the qt depends bump)

@DrahtBot

This comment has been minimized.

Contributor

DrahtBot commented Jul 12, 2018

Note to reviewers: This pull request conflicts with the following ones:
  • #13623 (Migrate gitian-build.sh to python by ken2812221)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

@h4x3rotab h4x3rotab force-pushed the h4x3rotab:nsis-fix branch from 8fcc0a5 to 59c243f Jul 12, 2018

@ken2812221

This comment has been minimized.

Member

ken2812221 commented Jul 12, 2018

This has been fixed in nsis 2.50, and nsis in ubuntu bionic is version 2.51.

@h4x3rotab

This comment has been minimized.

h4x3rotab commented Jul 12, 2018

This has been fixed in nsis 2.50, and nsis in ubuntu bionic is version 2.51.

Yeah, bionic could be even better.

@theuni

This comment has been minimized.

Member

theuni commented Jul 12, 2018

Holding out on reviewing this until after #13171 is merged or closed.

@ghost

This comment has been minimized.

ghost commented Jul 14, 2018

Bitcoin Gold developer contributing for Bitcoin Core, nice 👍

@MarcoFalke

This comment has been minimized.

Member

MarcoFalke commented Jul 16, 2018

Closing per #13643 (comment)

@MarcoFalke MarcoFalke closed this Jul 16, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment