{"id":663,"date":"2015-03-06T04:14:10","date_gmt":"2015-03-06T09:14:10","guid":{"rendered":"http:\/\/www.brunerd.com\/blog\/?p=663"},"modified":"2015-03-28T18:35:44","modified_gmt":"2015-03-28T23:35:44","slug":"java-8-update-40-installer-app-fun","status":"publish","type":"post","link":"https:\/\/www.brunerd.com\/blog\/2015\/03\/06\/java-8-update-40-installer-app-fun\/","title":{"rendered":"Java 8 Update 40 Installer App Fun!"},"content":{"rendered":"

So perhaps\u00a0you saw my previous post:\u00a0Java 8 without the Adware (aka Java8Unjunker)<\/a>?<\/p>\n

\"Java<\/p>\n

Good stuff eh? There was something\u00a0in there that got me thinking: If they didn’t sign the package<\/em>, is the app doing any<\/em> integrity checks on the package inside either? Hmmm let’s see…<\/p>\n

Voice over: We’ve secretly replaced the JavaAppletPlugin.pkg package with QuickTime 7 let’s see if\u00a0it can tell the difference!
\n\"Not<\/p>\n

Here we go!
\nSure let me authenticate right when you run before any confirmation of action – why not!? (Ugh,\u00a0bad form already.)<\/p>\n

\"Java8<\/p>\n

\"Safe<\/p>\n

Oh OK, “safe and easy”<\/strong> – I love it! But just to clarify…
\nBy “easy” you mean: Checking lots of trust boxes and clicking “Run” buttons a lot to get\u00a0a Java apps working (plus\u00a0crossing your fingers)?
\nBy “safe” you mean: a steady stream of high scored\u00a0CVEs\u00a0with\u00a0low complexity<\/a>?\u00a0Or even running in Unsafe Mode when needed?<\/p>\n

OK what’s next?<\/p>\n

\"Ask\"<\/p>\n

Oh dear God no<\/span>! No Ask.com.\u00a0Uncheck<\/strong>.\u00a0Next<\/strong>.<\/p>\n

Oh, right, away we go, I gave you my password at the door.\u00a0Installing Java are we?
\n\"Java8\"Installed\"<\/p>\n

OK I’ve successfully installed Java then if you say so… I guess I that’s proof alright!
\nIt then takes you to the Verify Java page<\/a>\u00a0\u2014 but who cares about that!<\/p>\n

What does \/var\/log\/install.log<\/strong>\u00a0say about what\u00a0was\u00a0installed?<\/p>\n

\"QT7<\/a><\/p>\n

 <\/p>\n

Yep it installed the QuickTime7<\/strong> package we put in there and Java Updater 40.app was none the wiser.<\/p>\n

So in conclusion… That’s a really nifty “Ask Toolbar installer”\u00a0with arbitrary package installer Oracle. It’s also a great delivery vehicle\u00a0for malware by\u00a0nefarious\u00a0folks. Heck, bundle Java along with your Trojan and the “Verify Java” page would open too!\u00a0Sheesh. Is the Ask\u00a0contract that lucrative?\u00a0Oracle made\u00a0$38 billion<\/a> in revenue last year, IAC the parent of Ask.com pulled in $3 billion<\/a>.\u00a0I guess IAC have\u00a0got money to spend and Oracle will take it (but not invest in more secure installers?)<\/p>\n

Notes: The first\u00a0attempt used a\u00a0QuickTimePlayer7.6.6_SnowLeopard.pkg with an expired certificate, that halted the install. The 2nd attempt I stripped out the expired certificate. It worked. The 3rd time I downloaded a\u00a0newly signed version from Apple, that too worked.<\/p>\n

Parting note for Oracle:
\nSign your critical packages! If you insist on using your glorified “Ask Toolbar installer app” to do this, then require that\u00a0it verify\u00a0the package integrity in some way, Orable! (heh, that was a typo but I like it: Orable<\/strong>, ha!)<\/p>\n

\"Open<\/a>\"Java8<\/a><\/p>\n

 <\/p>\n

Update: Oracle is now signing the package within and the installer can no longer be duped into running an arbitrary package. The\u00a0version when this article was written was\u00a01.8.40.25, it is now\u00a01.8.40.27.<\/p>\n

\"Java<\/a>
It’s signed now!<\/figcaption><\/figure>\n

 <\/p>\n

\"Damaged
Attempted JavaAppletPlugin.pkg Replacement<\/figcaption><\/figure>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

So perhaps\u00a0you saw my previous post:\u00a0Java 8 without the Adware (aka Java8Unjunker)? Good stuff eh? There was something\u00a0in there that got me thinking: If they didn’t sign the package, is the app doing any integrity checks on the package inside either? Hmmm let’s see… Voice over: We’ve secretly replaced the JavaAppletPlugin.pkg package with QuickTime 7 […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,8],"tags":[],"class_list":["post-663","post","type-post","status-publish","format-standard","hentry","category-os-x","category-packages","category-security"],"_links":{"self":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/663","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/comments?post=663"}],"version-history":[{"count":3,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/663\/revisions"}],"predecessor-version":[{"id":681,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/posts\/663\/revisions\/681"}],"wp:attachment":[{"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/media?parent=663"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/categories?post=663"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.brunerd.com\/blog\/wp-json\/wp\/v2\/tags?post=663"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}