Skype, Slack, other Electron-based apps can be easily backdoored

'The Electron development platform is a key part of many applications,
thanks to its cross-platform capabilities. Based on JavaScript and
Node.js, Electron has been used to create client applications for
Internet communications tools (including Skype, WhatsApp, and Slack)
and even Microsoft's Visual Studio Code development tool. But Electron
can also pose a significant security risk because of how easily
Electron-based applications can be modified without triggering
warnings.

At the BSides LV security conference on Tuesday, Pavel Tsakalidis
demonstrated a tool he created called BEEMKA, a Python-based tool that
allows someone to unpack Electron ASAR archive files and inject new
code into Electron's JavaScript libraries and built-in Chrome browser
extensions. The vulnerability is not part of the applications
themselves but of the underlying Electron framework—and that
vulnerability allows malicious activities to be hidden within
processes that appear to be benign. Tsakalidis said that he had
contacted Electron about the vulnerability but that he had gotten no
response—and the vulnerability remains.

While making these changes required administrator access on Linux and
MacOS, it only requires local access on Windows. Those modifications
can create new event-based "features" that can access the file system,
activate a Web cam, and exfiltrate information from systems using the
functionality of trusted applications—including user credentials and
sensitive data. In his demonstration, Tsakalidis showed a backdoored
version of Microsoft Visual Studio Code that sent the contents of
every code tab opened to a remote website.'

-- source: https://arstechnica.com/information-technology/2019/08/skype-slack-other-electron-based-apps-can-be-easily-backdoored/

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list | [email protected]
Unsubscribe: https://list.waikato.ac.nz/mailman/listinfo/wlug