Whatsapp, Slack, Skype and apps based on popular Electron framework vulnerable to backdoor attacks

Cory Doctorow 12:56 pm Thu Aug 8, 2019

This week at B-Sides LV, security researcher Pavel Tsakalidis presented his work on security defects in the Electron framework, a cross-platform development framework that combines Javascript with Node.js: apps built with Electron include Skype, Slack, Whatsapp, Visual Studio Code and others.

Tsakalidis showed how the lack of basic encryption for Electron code leaves users vulnerable to hackers who inject back-door code into their sessions, which exposes their communications, filesystem, and cameras and mics to third parties.

These changes are harder to make in Macos or GNU/Linux systems (where admin access is required), but Windows systems are wide open.

To make things worse, Electron's team had previously rejected a user request for encryption to protect its files, and when Tsakalidis presented his work to them, they ignored him.

Tsakalidis has released a proof-of-concept tool called BEEMKA, a small Python program that can open Electron ASAR archive files and insert exploit code into them, exploiting apps and Chrome plugins built in the framework.

Code inserted into the ASAR can run either within the application's context or within the context of the Electron framework itself. Application code is "plain old JavaScript," Tsakalidis explained, capable of calling Electron's operating-specific modules—including microphone and camera controls, as well as operating system interfaces. Code injected into Electron's internal Chrome extensions can allow attackers to bypass certificate checks, so that, while code may still force communications over HTTPS, an attacker can use a self-signed certificate on a remote system for exfiltration. And Web communications can be altered or completely blocked—including applications' updating features, which would prevent new versions from being automatically installed, displacing the backdoored application.

Tsakalidis said that in order to make modifications to Electron apps, local access is needed, so remote attacks to modify Electron apps aren't (currently) a threat. But attackers could backdoor applications and then redistribute them, and the modified applications would be unlikely to trigger warnings—since their digital signature is not modified.

Skype, Slack, other Electron-based apps can be easily backdoored [Sean Gallagher/Ars Technica]

Basic Electron Framework Exploitation [Pavel Tsakalidis/Context]

Finally revealed: identity of hacker blamed for stealing from 300+ companies and governments, in 44 countries

Unsealed court documents reveal the identity of Fxmsp, a hacker from Kazakhstan who is blamed for information theft from more than 300 companies and governments, in 44 different countries around… READ THE REST
IRS says it bought in to location database for millions of US cellphones to track tax crime suspects

The United States Internal Revenue Service says it purchased access to a marketing database that offers location data for millions of US cellphones, so the IRS can identify and track… READ THE REST
Google removes 106 malicious Chrome extensions with 32M downloads that collect browsing history and sensitive credentials

Following the discovery and prompting of a security researcher at Awake Security, Google says it has removed 106 malicious Chrome extensions that had 32 million downloads, and which were gathering… READ THE REST
Short Post, just one paragraph

Dessert cheesecake wafer bear claw fruitcake. Fruitcake chupa chups donut candy canes marzipan. Apple pie sweet roll tart chocolate cake macaroon marshmallow carrot cake gummi bears sweet. Pastry sugar plum… READ THE REST
Save 50% on a 1-year subscription to Dashlane's premium password manager

We all know vital information about ourselves and our private digital accounts can be compromised by cybercriminals. However, many would be frightened to know just how compromised they and their… READ THE REST
The Bite Helper removes the itch of a mosquito bite in seconds

While mosquitoes have certainly earned their title as the deadliest animal on earth, their impact on most of our lives is usually a lot less consequential. But even though they… READ THE REST