Arduino Create Agent – Windows installer tampering while preserving Authenticode signature

guest · Aug 13, 2019

Arduino Create Agent – Windows installer tampering while preserving Authenticode signature
August 13, 2019
https://blog.arduino.cc/2019/08/13/...ring-while-preserving-authenticode-signature/

Arduino Create Agent is a plug-in that was designed to help Arduino users connect their devices to the Arduino Create platform. The plug-in lets your browser communicate with your device’s serial port from a web application.
We chose Bitrock’s InstallBuilder, a powerful and easy to use cross-platform installer creation tool, for generating the Arduino Create Agent installers (Windows, macOS, Linux). Those binaries are then served through our global CDN.

Yesterday, Bitrock has published an important security advisory in which they stated that Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature. A specially crafted payload can be appended to an existing installer and trick the installer initialization code to execute code included in it, while the existing signature remains valid.

Once we’ve been notified, and given the potential impact of this security issue, we worked around the clock to re-build and re-release our Agent’s Windows installer. Version 1.1.89 has now been released through our official channels.
Click to expand...

Log in or Sign up

Arduino Create Agent – Windows installer tampering while preserving Authenticode signature

guest Guest

Log in or Sign up

Arduino Create Agent – Windows installer tampering while preserving Authenticode signature

guest Guest

Useful Searches