Are portable apps vulnerable to binary planting?

Question

Several Windows apps come in both "installer" and "portable" forms, with the latter having the advantage that you can just download and run it from anywhere in the system.

Doesn't being able to run them from anywhere in the system mean that such apps are inherently vulnerable to binary planting since an attacker with access to your system could at some point swap the downloaded app with a malicious executable? Isn't running code from anywhere but C:\Program Files, etc inherently dangerous? If it is, why don't we see this kind of attack all the time?

Answer 1

The logic behind the question is confusing, which is why I think you are having trouble getting answers or getting people to understand you.

Portable apps would be inherently subject to (I would not use the term "vulnerable to") being swapped out for malicious versions without any elevation of privileges or installation. Because that's how they are supposed to work. So, that's a given, and we can assume that this is a factor.

Isn't running code from anywhere but C:\Program Files, etc inherently dangerous?

"inherently dangerous"? Of course not. And this is where the logic starts to go astray. Having an approved directory structure where binaries should be executed is a handy, easy, simple, and predictable way to enforce binary execution policies. Some hardened systems do only allow binaries to be executed from a protected directory structure. But the ease of adding controls in one case does not mean that the other case is "inherently dangerous".

Does being able to execute binaries from any arbitrary place in the system introduce weaknesses? Sure. It's more difficult to control what apps are approved. But not impossible.

why don't we see this kind of attack all the time?

Because it would have to be not a niche case to be relevant "all the time".

The point of the attack would be to place the app in such a way that the user of the system would choose to run it as a normal part of the user's operating of the system. Because if the attacker could replace the app and execute it themselves, then why replace an existing app at all?

For this attack to make sense, an attacker would have to:

• have access to the system to be able to delete/replace the app, and if they could do that, there are far worse things they could do
• know that the app would be executed by the user and not just "hanging around" for convenience, which brings an element of uncertainty and unpredictability for the attacker
• create the malicious app in a way that would avoid anti-virus protections

All of these factors are in the way of this being an issue "all the time". Possible? Of course. But not a major or universal threat.

Answer 2

If an attacker has permissions to overwrite files within your homefolder, you've already lost.

Answer 3

If your goal is to avoid executing potentially hostile code, you're better served with code signing that some poor man version of Trusted Path Execution. But in any case both are defeated by the presence of an executable interpreter (on purpose or not), which is the case on most systems not hardened to the point of unusability.

Answer 4

1. Installing means not unpacking. It can be much more complex, e.g. registration of components in the registry. You cannot reach that by just unpacking. That's why it is incorrect to say that "pretty much every Windows app" has a portable version.

2. "C:\Program Files" has no any special meaning from the security point of view. Launching executables from this directory is not safer than launching from any other directory. Besides, many installers allow to specifiy the destination directory, and you can install to any directory you want.

3. If the attacker can modify the downloaded portable app, then this attacker can modify the downloaded installer as well. Launching an infected installer has the same risk as launching a portable app.

4. If you carefully launch portable apps, this can be even more safe compared to installer. Installers require usually admin permissions to be able to write to the system directories like C:\Windows\System32 and to write to the registry. That's why users normally give such permissions. If you are logged in as a normal user, not an admin, and launch a portable app, you can better control the application. For instance, if you launch a simple text editor and it requires more permissions, e.g. to modify some system file, you can reject the request.

Answer 5

Even attackers observe the gain/cost ratio.

Not every user uses portable apps. IMHO, the fact is the casual user ignores them. That means that you would invest in an attack having few possible targets. It terribly lowers the expected gain because it is the product of the number of possible target by the attack efficiency.

Portable apps can reside anywhere in the system including on removable media. It adds a complexity level, because you have to search for something without knowing where it is nor even if it is currently present. Furthermore, it could have been renamed at installation time, which adds a risk of not finding it even if it is present...

In the end, it is generally thought more efficient to propose copies of innocent apps, either portable or installable ones, but that have been specially crafted to contain malware code. It is easier than first gaining access to a system without even knowing whether the attack vector will be there.

Of course, if the considered threat is your little brother/sister attacking your system, they already have physical access to your system, and can know what tools you use. In that threat model, portable apps are a very easy attack vector, and if you use them you should protect them.