a friend of mine wanted to install MongoDB Community when he encountered a problem. The .msi file downloaded from https://www.mongodb.com/try/download/community was rejected by Windows when he tried to install it
The file that he downloaded is not signed, although it should. We checked the hashes, and the hash computed for his local file is different from the official hash posted on MongoDB's website. His SSL certificate for MongoDB's website is also different. For me it's issued by Amazon, but his is issued by "Sample CA 2"
Also, I was able to download that .msi file and install it without any problems. The file has a digital certificate and both hashes match for me.
The questions are: Can this be a MITM attack? Is there some "man in the middle" corrupting executables?
- it's a personal computer, not connected to any proxy or corporate network
- it seems that all websites he visits have SSL certificate issued by the same "Sample CA 2"
- that "Sample CA 2" certificate is under the "Trusted Root Certification Authorities"
- he can't remove or disable that certificate for good. Whenever he restarts the system, it comes back
- when he sets the certificate to Disable All Purposes, he can then not view any websites, as they are all shown as Unsafe
- a full scan is going on currently using "System Mechanic Ultimate Defense" software, nothing found for now