Whatsapp, Slack, Skype and apps based on popular Electron framework vulnerable to backdoor attacks
This week at B-Sides LV, security researcher Pavel Tsakalidis presented his work on security defects in the Electron framework, a cross-platform development framework that combines Javascript with Node.js: apps built with Electron include Skype, Slack, Whatsapp, Visual Studio Code and others.
Tsakalidis showed how the lack of basic encryption for Electron code leaves users vulnerable to hackers who inject back-door code into their sessions, which exposes their communications, filesystem, and cameras and mics to third parties.
These changes are harder to make in Macos or GNU/Linux systems (where admin access is required), but Windows systems are wide open.
To make things worse, Electron's team had previously rejected a user request for encryption to protect its files, and when Tsakalidis presented his work to them, they ignored him.
Tsakalidis has released a proof-of-concept tool called BEEMKA, a small Python program that can open Electron ASAR archive files and insert exploit code into them, exploiting apps and Chrome plugins built in the framework.
Read the restCode inserted into the ASAR can run either within the application's context or within the context of the Electron framework itself. Application code is "plain old JavaScript," Tsakalidis explained, capable of calling Electron's operating-specific modulesincluding microphone and camera controls, as well as operating system interfaces. Code injected into Electron's internal Chrome extensions can allow attackers to bypass certificate checks, so that, while code may still force communications over HTTPS, an attacker can use a self-signed certificate on a remote system for exfiltration. And Web communications can be altered or completely blockedincluding applications' updating features, which would prevent new versions from being automatically installed, displacing the backdoored application.
Original Link: http://feeds.boingboing.net/~r/boingboing/iBag/~3/6e6nt-WCL1Q/pavel-tsakalidis.html