Security Flaw Impacts Electron-Based Apps Such as Skype, Signal, Discord, Others

Minimalist · May 13, 2018

Security researchers have found a security flaw in Electron, a software framework that has been used in the past half-decade for building a wealth of popular desktop applications.

Apps built on top of Electron and potentially affected by this recently found bug include Microsoft's Skype and Visual Studio Code, GitHub's Atom code editor, the Brave browser, along with official desktop apps for services like Signal, Twitch, Discord, Basecamp, Slack, Ghost, WordPress.com, and many more.

The framework has become very popular among today's software development community because it allows developers to easily port web-based apps coded in HTML, JS, and CSS to run on the desktop. The software framework is a custom API wrapped around the Node.js server-side JavaScript server.
Click to expand...

https://www.bleepingcomputer.com/ne...sed-apps-such-as-skype-signal-discord-others/

Minimalist · May 25, 2018

Electron patches patch after security researcher bypassed said patch

In an update last week, the developers of Electron – the toolkit used to craft widely used apps from Skype and Slack to Atom – shipped a patch to their January patch, and now, an infosec researcher has explained why.
Click to expand...

https://www.theregister.co.uk/2018/05/25/electron_patches_blacklist_error/

guest · Aug 7, 2019

Skype, Slack, other Electron-based apps can be easily backdoored
Changes to configuration files don't change signature, can add malicious features
August 7, 2019
https://arstechnica.com/information...electron-based-apps-can-be-easily-backdoored/

At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA, a Python-based tool that allows someone to unpack Electron ASAR archive files and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions.
The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign.
It’s not a bug, it’s a feature
The problem lies in the fact that Electron ASAR files themselves are not encrypted or signed, allowing them to be modified without changing the signature of the affected applications. A request from developers to be able to encrypt ASAR files was closed by the Electron team without action.

Tsakalidis said that in order to make modifications to Electron apps, local access is needed, so remote attacks to modify Electron apps aren't (currently) a threat.
But attackers could backdoor applications and then redistribute them, and the modified applications would be unlikely to trigger warnings—since their digital signature is not modified.
Click to expand...

Log in or Sign up

Security Flaw Impacts Electron-Based Apps Such as Skype, Signal, Discord, Others

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Log in or Sign up

Security Flaw Impacts Electron-Based Apps Such as Skype, Signal, Discord, Others

Minimalist Registered Member

Minimalist Registered Member

guest Guest

Useful Searches