[idkyall]

I'm really curious where the 0-day is in the code of the project honestly

[dantillberg]

This "UpdateCheckThread" code looks pretty funky, [0]. It downloads some stuff from a URL, writes a file to disk, and creates a process to run it.

0: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

[bdowling]

If the code is wrapped in

   if (updateDlg.DoModal() == IDOK) { … }

then doesn’t that mean it only runs that code if the user clicks “OK” on the update dialog?

(Edit: I think I understand now. It’s not the code, it’s the update URL that’s the problem, because it’s controlled by NK. So if you run this and blindly click “OK”, then it will download an executable that will infect your PC.)

(Edit 2: Or the issue is not in the source at all, but is in the prebuilt binary.)

[rightbyte]

It could be that the code is fine but the URL is compromised?

[saagarjha]

The 0-day is in a popular software package. The GitHub repo apparently contains a backdoor ability to execute code from the attacker. If I had to guess, this would be the software update functionality here: https://github.com/dbgsymbol/getsymbol/blob/cb4bdedc1a85c308...

[r1ch]

That's just malware. There's no 0-day here.

[saagarjha]

That’s what Google is calling it, so I’m inclined to believe them.

[g___]

"In addition to targeting researchers with 0-day exploits, the threat actors also developed a standalone Windows tool that has the stated goal of 'download debugging symbols from Microsoft, Google, Mozilla and Citrix symbol servers for reverse engineers.'

The attackers used a 0-day but getsymbol is not one.

[saagarjha]

Yep, that’s what I said.

[edgyquant]

No it isn’t what you said at all. You said Google was calling malware a zero day and you believe them, but they aren’t doing this.

[rightbyte]

Seems to be some dll:s included. Maybe there?

"But the tool also has the ability to download and execute arbitrary code from an attacker-controlled domain."

Sounds like most software nowadays to be honest. The blog author does not really point out why this code would be more malicious than "normal" or how the code author is known to be Korean.