A lot of popular applications use customer downloaders rather than allow the user to download the installation binary directly from Adobe, or whoever the OEM might be. For example, here is the Flash installer doing its work:

enter image description here

The security risk here is obvious: if the download is conducted in plain text it is vulnerable to a man in the middle attack. A hacker who controls any router between me and Adobe, including control of my cable modem, can target and intercept this update and supply their own modified binary.

If I use a web HTTPS download from Adobe then I can still be compromised by a MIM attack, but in this case I can know that there is poison because the false certificate my browser is given by the MIM will not match Adobe's HTTPS certificate.

However, when I use the custom Adobe Flash Player Installer (as above) I have no way to know what certificates are being exchanged. For all I know, the binary is being transferred in plain text, which is highly insecure obviously.

Is this installer to be trusted?


Is this installer to be trusted?

No? As you said, you have no way of trusting what it downloads – even if it did encrypt and cryptographically authenticate the download, you wouldn't know whether what you're downloading is what you want. So this question is the same as "Can I trust any software downloaded from anywhere?", which probably is "no".

Anyway, as you said, there's no way for you to look inside and tell whether it's doing crypto, and if it does, if it's doing it right (i.e. verifying the authenticity of the server according to built-in keys, hoping these are untampered with, since you've downloaded the downloader from somewhere you trust). So even just capturing the traffic (using e.g. wireshark), which is trivial, will only let you confirm the unencryptedness (if that is the case), not the correctness of implementation.

So, short answer: no.

EDIT also: Is that a Windows XP window decoration?!

| improve this answer | |
  • Well, if a download uses HTTPS there is an element of trust because I can verify that the download is encrypted AND I can verify that the certificate is genuine. Since an MITM attack will use an intermediary certificate, I will know if an illegitimate file was substituted. – Tyler Durden Jan 20 '17 at 13:52
  • Yes BTW I do use Windows XP. It is a lot more secure than modern Windows because hackers do not target it anymore. For example, Zeus does not even work on XP anymore, so right off the bat I am immune to the most common toolkits. Also it is a lot more transparent, so that in the unlikely event that I got rooted, it would be a lot easier to tell. I have Windows 10 at work and I can tell you it is WAY WAY more insecure than my home box for various reasons. – Tyler Durden Jan 20 '17 at 13:57
  • 2
    @TylerDurden I hope you know that is crassly mistaken.Windows XP is still a very often-targeted system,even more so that it hasn't seen any security updates in YEARS.And what you say about "rooting" is totally wrong,too,because the idea of a rootkit is that you cannot tell. So you're really really far off and I'd encourage you to not worry the least about security of anything else until you're using an operating system which is still receiving security updates.Everything that you exhibit is dangerous "hearsay pseudo-knowledge",I'm afraid.Please don't take this personally–you're just wrong. – Marcus Müller Jan 20 '17 at 14:32
  • @TylerDurden XP is certainly still actively targeted. What is your source for your claim? Just that new malware won't run on it? – schroeder Jan 20 '17 at 22:54
  • @schroeder If you do a search in the MITRE CVE database you will see that no XP exploits have been logged since 2014. In our malware lab, the droppers we see reflect the same thing, active malware sources target primarily Windows 10, 8 and Vista (to a lesser degree). XP is less than 3% of the installed base so most hackers are ignoring it and focusing on the 97% who use Vista, 8 and 10. Since Vista, the OS memory space structures have been radically changed, so hackers cannot backport rootkits to XP and nobody wants to maintain a rootkit that is only useful on 3% (and dropping) of the base. – Tyler Durden Jan 21 '17 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.