0

I am a programmer. I recently developed an automation tool that periodically downloads couple of files over a non-secured (http) url.

Two files are:

  1. A text file that is very tiny (under 10KB) which has details about the version, checksum of the main file, the relative path from where to download, size of the file etc.
  2. A compressed (zip) file that contains a bunch of dat files which are actual files of interest.

Now the infosec team is raising questions on downloading the content from a HTTP site instead of HTTPS. The host doesn't support https for whatever reasons. My question is how risky is the content to download from the site considering the following things.

  1. Host is a popular anti-virus product (McAfee: download.nai.com).

  2. It's a direct download without any authentication/authorization.

  3. The files are binary *.dat files which are actually virus definitions of McAfee's command-line tool. These dat files are used internally by this tool.

I am guessing the reason McAfee has put them for public access is to offload overhead caused by using https. My gut feeling is there is no risk because if there was any McAfee would have provided a secured portal to its customers.

2
  • 1
    I'm sure the files are of a proprietary format and are validated by the software before being loaded. I imagine they are in some way signed and would be rejected by McAfee if tampered with in transit prior to loading. You could test this by modifying a dat file and see if you get an error about loading the definition file. How would you know if this was happening? The fact they are available to everyone publically means authentication doesn't really matter to you. The most one might be able to do from a remote position (MITM) is perform some sort of DOS attack by feeding it "odd" dat files. Mar 19 '20 at 21:03
  • I was thinking exactly same thing
    – Insecured
    Mar 20 '20 at 6:52
2

The download over HTTP is not a problem by its own but it depends on what you do with the file after the download is relevant:

  • If you just delete the file: no problem.
  • If you download an executable from a seemingly trusted site and run it: bad idea since it might have been manipulated during the transit or the attacker made you access a different server than intended.
  • If you know from a secure source that the file has a specific hash or signature and verify it successfully after download: the problem of manipulation in transit or wrong server is gone.

In your specific case the files might have some signature which is checked by the program they are intended for. If you do something else with these files and don't check the signature you don't get the related benefits but have to deal with the problem that the download might have been manipulated.

Apart from that: just because something is downloaded over HTTPS it is not automatically safe either. Only the problem that the download might have been manipulated in transit or that you've accessed the attackers server instead is gone. It is still possible that the file was already bad on the trusted server because the server was hacked or that you've blindly connected to some arbitrary server to download some files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.