I’m just going to remove the tweets about the unique Chrome downloads this is obviously a dead-end.
Prikaži ovu nit
For transparency, this is my original tweet where I discovered that ChromeSetup.exe downloads are each unique. It could definitely be abused in this way, but Google’s privacy policy says they don’t and the Omaha system code that does this is open source.pic.twitter.com/Wryikklemw
-
-
This post discusses how the files are all signed at the same time with the same Authenticode digest, but the file hash is each different. My evil-corp postulate for why this was happening was wrong. https://twitter.com/vcsjones/status/1213283838065041408?s=21 …https://twitter.com/vcsjones/status/1213283838065041408 …
Prikaži ovu nit -
Here’s where Google discloses they use unique downloads to track install success and conversion, but not to link identities. I think I believe them. https://twitter.com/jpevarnek/status/1213283217043673088?s=21 …https://twitter.com/jpevarnek/status/1213283217043673088 …
Prikaži ovu nit -
My job is to poke and look for unusual things on the network, and noticing every ChromeSetup.exe was a unique hash set off alarm bells about polymorphic viruses that use unique executables to evade certain virus signature approaches.
Prikaži ovu nit -
There are APT threats that replace the GoogleUpdate.exe service for persistence and executable goodlist bypass, so it’s always good to be suspicious of stuff that looks too official to be malware...
Prikaži ovu nit
Kraj razgovora
Novi razgovor -
-
-
The only real crime here is that you use light mode.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Why, were Google shills upset at you for reporting this? Uhg.
-
This is awful even if they're not actively doing any tracking since (1) it enables other parties to do so in sone ways they shouldn't be able to, and (2) (more important) it undermines ability to identify and verify the downloaded file by hash.
Kraj razgovora
Novi razgovor -
-
-
Reading up on this Omaha thinghttps://chuck-nbc.fandom.com/wiki/Omaha_project …
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
They don't *right now*. It's just waiting for someone to flick a switch.
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.