360 the upgrade process can be exploited by man-in-the-middle attacks

360 the upgrade process can be exploited by man-in-the-middle attacks, so that the machines that upgrade the virus database are replaced with Trojans.
360 requests will be made during the upgrade process

Http://update.360safe.com/v3/safeup_lib.cab

In this cab package, safeup_lib.ini defines the files for later downloading and upgrading the cab.

For example, url = http://dl.360safe.com/XXXXX.cab

 

If man-in-the-middle attacks hijack the two upgrades, replace the virus database with a Trojan file.

360 the exe file is signed and cannot be directly implanted, but the vbs file is not verified.
Packet Capture

 

Safeup_lib.ini

 

[360 safe] name = 360 security guard module = 360 main, [safe360_setup_1234.vbs] ver = 9.9.9.9999url = login (% version %! = "0.0.0.0000") prompttype = 1 reboot = 0 files = safe360_setup_1234.vbsver = 9.9.9999tip = · New features |

In http://dl.360safe.com/safe360_setup_1234.cab

Which is safe360_setup_1234.vbs.

Let's make full use of the content.

Solution:

The upgrade program determines whether the files in the upgrade package are vbs or other executable files, and disallow the execution or determine the signature.