I recently read that most software available on the Web isn't sent over HTTPS (even if the link is on an HTTPS page). This means that the binaries downloaded were never authenticated and could in theory be altered in transit.

Is it far-fetched to imagine someone on the network inserting malware into the programs one downloads ?

I imagine that it would be far easier for someone on a public WiFi ; let's assume the files are downloaded over a personal connection at a well-known ISP.

  • 1
    Any server on the path way to the user could tamper with it. Why take the risk? – Alexander O'Mara Jul 25 '16 at 0:51
  • 1
    It's not terribly common, but it has been done before, so it is definitely possible. – user253751 Jul 25 '16 at 1:10
  • @AlexanderO'Mara I knew it's totally possible, so I take precautions. Just wanted to know if it has really been observed, and how common this kind of attack really is. – Hey Jul 25 '16 at 2:10
  • @immibis do you have any example ? You can write an answer ! – Hey Jul 25 '16 at 2:11
  • What precautions do you take? I'm genuinely curious, because HTTPS is considered the de facto standard. – h4ckNinja Jul 25 '16 at 6:08

For a man in the middle it is easy to tamper with a download. There are even metasploit modules which make it really easy to infect a downloaded executable on the fly.

And man in the middle can be easily achieved too, for example by redirecting traffic inside a local network with ARP or DHCP spoofing, by controlling your own local network by creating an innocent sounding hotspot or by creating your own malicious Tor exit node. And in some parts of the world also government agencies are able to hijack critical parts of the network.

It is impossible to say what your chance is of being infected this way because it highly depends how easy it is for an attacker to hijack exactly your network connection and how much of a target you are. And even if tampering with the download itself was successful it might not result in an infection of your system. For example tampering with the download of a signed update will probably only result in a failed update if the signature is verified by your local system. And apart from tampering with the data during the download are much more ways to deliver such malware, like hacking the system serving the files and modifying the offered files.

| improve this answer | |

This type of attacks is a legit threat. It can be easily implemented by tools like EvilGrade ( evil upgrade). Many softwares still perform update via HTTP.

Example Scenario: Lets say a user has notepad++ installed on his PC.An attacker who has access to internal DNS can perform DNS cache poisoning and use a tool like Evil Grade. To put in simple words, it prompts a fake upgrade for notepad++,when the user clicks on update the tool delivers a pre-made binary (infected agents). The tool comes with its own webserver and DNSserver modules.

The attacker can also be in the internal network performing ARP spoofing,or fake a wifi access point.

Of course this makes use of poor implementation of software updates. A signed updated over TLS can protect against this type of attacks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.