Reply to thread

Message

<blockquote data-quote="struppigel" data-source="post: 1052819" data-attributes="member: 86910">This is exactly the same issue as with the <a href="https://malwaretips.com/threads/glasswires-sha-256-hash-doesnt-match-the-one-listed-on-their-website.122381/" target="_blank">Glasswire download</a> we also analysed. Dropbox is also one of those vendors who save data in the certificate, so that the certificate is not broken.It is not VirusTotal that is weird but Microsoft Windows being weird in allowing manipulated certificates as valid unless you opt-out.And the reason for allowing it is, well, companies like Dropbox abusing this vulnerability in legit installers. Why? Imagine you download something from a dropbox link but have no dropbox installed. How will it know what you wanted to download without putting this information into the installer somehow? That is why. They cannot sign the installer for each and every download and they do not want to use non-signed ones. So they inject the data into the certificate instead.[USER=38832]@upnorth[/USER] was completely correct here in his assessment and despite the manipulation the file is clean. VT is also correct.</blockquote>

[QUOTE="struppigel, post: 1052819, member: 86910"] This is exactly the same issue as with the [URL='https://malwaretips.com/threads/glasswires-sha-256-hash-doesnt-match-the-one-listed-on-their-website.122381/']Glasswire download[/URL] we also analysed. Dropbox is also one of those vendors who save data in the certificate, so that the certificate is not broken. It is not VirusTotal that is weird but Microsoft Windows being weird in allowing manipulated certificates as valid unless you opt-out. And the reason for allowing it is, well, companies like Dropbox abusing this vulnerability in legit installers. Why? Imagine you download something from a dropbox link but have no dropbox installed. How will it know what you wanted to download without putting this information into the installer somehow? That is why. They cannot sign the installer for each and every download and they do not want to use non-signed ones. So they inject the data into the certificate instead. [USER=38832]@upnorth[/USER] was completely correct here in his assessment and despite the manipulation the file is clean. VT is also correct. [/QUOTE]

Verification