Pizza Slow, httpshaming: Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong? It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run. There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely. Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates. This looks easy enough to fix. (Submitted by Phillip Knoll)

Figure 1. mirrored image from https://66.media.tumblr.com/a4e22db75a76bbe0f15452caf6152de9/tumblr_naj03mEeUL1tjflgfo1_1280.png without alt text, sorry.

Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong?

It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run.

There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely.

Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates.

This looks easy enough to fix.

(Submitted by Phillip Knoll)

August 19th, 2014 8:38am

Posted on Tumblr over 12 years agoon August 19, 2014 - 3:38 PM and archived here at /tumblr/2014/08/19/httpshaming-evernote-checks-for-update-over/at https://pizza.slow.high.quality.gravely.pizza/tumblr/2014/08/19/httpshaming-evernote-checks-for-update-over/ in the Tumblr collection in both HTML and markdown.

Proximate posts in the Tumblr collection
Newer	nevver: Modern toss	22 August 2014
Newer	These bottles of ginger ale were the exact same size when fermentation started Sunday. on Flickr.	22 August 2014
This post	httpshaming: Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong? It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run. There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely. Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates. This looks easy enough to fix. (Submitted by Phillip Knoll)	19 August 2014
Older	View my 2 latest photos on Flickr: https://flic.kr/u/2mJ1Jd/aHsk1m48N3	17 August 2014
Older	~ brew install smoked porter on Flickr.	17 August 2014

Proximate posts in the General collection
Newer	For the wall?	21 August 2014
Newer	Twitter post from August 20, 2014, 501920654803755009	20 August 2014
This post	httpshaming: Evernote checks for update over unencrypted HTTP, and the update packages are also downloaded over HTTP. But it’s signed code, right? What could go wrong? It’s trivially easy to perform a man-in-the-middle attack to prevent future updates from ever being received, or to redirect the user to unsigned or malicious code, that may or may not run. There is a DSA signature on the file at the update URL, and there’s signatures on the files and a certificate OU deep within the app contents… but that all assumes the user can get to the update, and download it securely. Good news for persistent threats, bad news for the millions of Evernote users who want to get critical security updates. This looks easy enough to fix. (Submitted by Phillip Knoll)	19 August 2014
Older	Twitter post from August 18, 2014, 501506567653441538	18 August 2014
Older	Twitter post from August 18, 2014, 501457061360574464	18 August 2014

h

previous link

j

next post

k

previous post

l

next link

gg

first

G

last

0

top of page

$

bottom of page

Enter

open

u

undo the title's shadow

ZZ

quit, turning these off

Esc

re-enter normal mode, enables shortcuts

⌘K

search

Posts by platform by year, 1999–2026
	Blog	Facebook	Twitter	Tumblr	Instagram	Path	Vimeo	Strava	Mastodon	Bookwyrm	total

total	519	2286	3892	2387	132	16	38	572	2264	75	12181
1999	7	–	–	–	–	–	–	–	–	–	7
2000	10	–	–	–	–	–	–	–	–	–	10
2001	–	–	–	–	–	–	–	–	–	–	0
2002	23	–	–	–	–	–	–	–	–	–	23
2003	35	–	–	–	–	–	–	–	–	–	35
2004	85	–	–	–	–	–	–	–	–	–	85
2005	150	–	–	–	–	–	–	–	–	–	150
2006	83	–	–	–	–	–	–	–	–	–	83
2007	72	16	–	–	–	–	–	–	–	–	88
2008	33	546	169	–	–	–	–	–	–	–	748
2009	10	407	744	–	–	–	–	–	–	–	1161
2010	6	195	352	3	–	–	–	–	–	–	556
2011	4	383	290	8	20	–	–	–	–	–	705
2012	–	372	254	124	19	16	1	–	–	–	786
2013	–	165	512	196	–	–	3	–	–	–	876
2014	–	73	670	270	–	–	–	6	–	–	1019
2015	–	74	889	554	–	–	11	2	–	–	1530
2016	–	55	12	389	1	–	3	–	–	–	460
2017	–	–	–	429	47	–	5	7	–	–	488
2018	–	–	–	414	45	–	–	7	123	–	589
2019	–	–	–	–	–	–	1	–	210	–	211
2020	–	–	–	–	–	–	3	2	452	–	457
2021	–	–	–	–	–	–	7	8	404	–	419
2022	–	–	–	–	–	–	1	4	422	–	427
2023	–	–	–	–	–	–	1	48	214	13	276
2024	–	–	–	–	–	–	–	167	205	33	405
2025	–	–	–	–	–	–	2	222	154	22	400
2026	1	–	–	–	–	–	–	99	80	7	187
total	519	2286	3892	2387	132	16	38	572	2264	75	12181