The target is presented with a dialogue to upgrade their
flash installation [via ISP-based MITM - DenisM].
If this upgrade is accepted the malicious SWF enables the
installation of a ‘scout agent’ which provides target
validation.
Adopting HTTPS is very important for the Web, but the lack of HTTPS in this case is just a red herring. The real problem is that it's way too easy to exploit systems through the web browser. If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites. Working on solving this problem is just as essential as transitioning to HTTPS.
If the entire Web switched to HTTPS, government attackers would just find another way to deliver their exploits besides injection into plain text websites.
Exactly. HTTPS relies on a centralised CA infrastructure, which is probably (indirectly) under the control of government anyway, so I don't see how taking away the ability to MITM plain text connections will help; and governments would prefer that their exploits be done over HTTPS since a properly-forged certificate will look "secure", and that makes the end-users more likely to blindly trust the authenticity of the content they download... it also means that firewalls and other systems designed to detect suspicious content in traffic (as much as they're derided for being used for censorship-related purposes, ones under the control of the user can be beneficial) won't catch the exploit either. I think that would be even worse.
HTTP causes some suspecion of the content, but HTTPS gives the impression of being secure, decreasing the level of suspicion while implicitly forcing the user to trust the CAs.
HTTPS with self-signed certificates that are exchanged in-person would probably provide the most secure authentication, but that doesn't really scale.
I'm assuming, as there is a live PE executable modification payload listed, and Windows is supposed to throw warnings for unverified / unsigned updates and installers, that the CA infrastructure is already compromised.
Either that or most Windows users still just habitually click through security warnings, which I sincerely hope is no longer the case.
With tools like these out there, what can we do to protect ourselves? Besides not downloading binaries over HTTP (which still wouldn't protect you if a CA has been compromised) what other steps can someone take? I hate how vulnerable and yet utterly essential our browsers have become.
