0

a friend of mine wanted to install MongoDB Community when he encountered a problem. The .msi file downloaded from https://www.mongodb.com/try/download/community was rejected by Windows when he tried to install it enter image description here

The file that he downloaded is not signed, although it should. We checked the hashes, and the hash computed for his local file is different from the official hash posted on MongoDB's website. His SSL certificate for MongoDB's website is also different. For me it's issued by Amazon, but his is issued by "Sample CA 2"

enter image description here

Also, I was able to download that .msi file and install it without any problems. The file has a digital certificate and both hashes match for me.

The questions are: Can this be a MITM attack? Is there some "man in the middle" corrupting executables?

Additional data:

  • it's a personal computer, not connected to any proxy or corporate network
  • it seems that all websites he visits have SSL certificate issued by the same "Sample CA 2"
  • that "Sample CA 2" certificate is under the "Trusted Root Certification Authorities"
  • he can't remove or disable that certificate for good. Whenever he restarts the system, it comes back
  • when he sets the certificate to Disable All Purposes, he can then not view any websites, as they are all shown as Unsafe
  • a full scan is going on currently using "System Mechanic Ultimate Defense" software, nothing found for now
Improve this question
6
  • Based on the certificate issuer this is definitely some MITM. If this is an actual attack or of there is some corporate proxy or local firewall or similar involved is unknown though. Same: if the file is not the expected one something was changed. If this was just corrupted or deliberately modified for a malicious purpose is unknown though just based on the provided information.
    – Steffen Ullrich
    Jul 29 '21 at 19:11
  • Or, the file on the server from which this was downloaded could have been replaced by a malicious one, by a rogue system admin, or an attacker that was able to breach the server - as was the case in 2013 when the credentials of a recently laid-off engineer were used to replace a bootstrap file on a CDN, with one that contained an exploit (see opsec.readthedocs.io/en/latest/incidences/maxcdn.html).
    – mti2935
    Jul 29 '21 at 21:22
  • @mti2935 I think it's not the case here. I was able to download that .msi file and install it on windows without any problems. The hashes match and it has a digital signature. I even uploaded the same file to g drive and asked him to download it from there. It was corrupt as well.
    – Aleksander Kozłowski
    Jul 30 '21 at 4:57
  • You're saying you uploaded the file to Google drive, then your friend downloaded the file from Google drive, and the hash of the file that you uploaded is different than the hash of the file that your friend downloaded? If that's the case, then I think you should figure out where this attack is taking place. When your friend points his browser to the download URL at google.com, does his browser show the true and correct certificate for google.com?
    – mti2935
    Jul 30 '21 at 20:59
  • @mti2935 Yes, exactly. It seems that it doesn't matter if he downloads it from the official MongoDB website or from my Google Drive, it's always corrupt. Also, his SSL certificate for Google Drive is issued by "Sample CA 2". I'll edit my post with additional data that he gave me
    – Aleksander Kozłowski
    Jul 31 '21 at 7:41
3

A search for "sample ca 2" shows that it is an indication of a type of malware. This cert needs to be removed from the system an off-line scan of the device should be performed.

Improve this answer
3
  • I wonder why malware would use a name like "Sample CA 2" in the certificate? Would Windows refuse to install the certificate if it had the name of an actual authority? Imitating a certificate from a firewall or corporate proxy might also be clever. Using "Sample CA 2" makes it easy to detect a problem.
    – Fire Quacker
    Jul 29 '21 at 20:27
  • Thanks for the reply @schroeder. He tried to remove it, but it always comes back after a restart. Can this be malware that adds this certificate every time, or is it rather due to some windows policies?
    – Aleksander Kozłowski
    Jul 31 '21 at 7:55
  • You can check the policies. But it looks like you have malware. You can read the Fortinet links that explain all the technical details.
    – schroeder ♦
    Jul 31 '21 at 8:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.