{"action":"created","issue":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/2615","repository_url":"https://api.github.com/repos/ShareX/ShareX","labels_url":"https://api.github.com/repos/ShareX/ShareX/issues/2615/labels{/name}","comments_url":"https://api.github.com/repos/ShareX/ShareX/issues/2615/comments","events_url":"https://api.github.com/repos/ShareX/ShareX/issues/2615/events","html_url":"https://github.com/ShareX/ShareX/issues/2615","id":241290626,"number":2615,"title":"Verify signatures of DLLs before loading them.","user":{"login":"sirocyl","id":944067,"avatar_url":"https://avatars1.githubusercontent.com/u/944067?v=3","gravatar_id":"","url":"https://api.github.com/users/sirocyl","html_url":"https://github.com/sirocyl","followers_url":"https://api.github.com/users/sirocyl/followers","following_url":"https://api.github.com/users/sirocyl/following{/other_user}","gists_url":"https://api.github.com/users/sirocyl/gists{/gist_id}","starred_url":"https://api.github.com/users/sirocyl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sirocyl/subscriptions","organizations_url":"https://api.github.com/users/sirocyl/orgs","repos_url":"https://api.github.com/users/sirocyl/repos","events_url":"https://api.github.com/users/sirocyl/events{/privacy}","received_events_url":"https://api.github.com/users/sirocyl/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-07-07T14:59:34Z","updated_at":"2017-07-07T15:01:10Z","closed_at":null,"body":"Signing the actual program, including DLLs and the ffmpeg download, ensures a path of trust rooted in your own hands.\r\nVerifying these signatures on DLLs, before loading them, prevents from simple DLL hijacking and bait-and-switch attacks, where a valid .exe is running malicious code.\r\n\r\nNotepad++ was the target of [a bait-and-switch attack by a state actor](https://yro.slashdot.org/story/17/03/12/1932250/notepad-update-fixes-cia-hacking-issue), in which a modified DLL replaced one included with the program.\r\n\r\nWidely-used open-source applications such as this, are a large vulnerability surface for such social-engineering and DLL hijack attacks, since its large install base ensures that a malicious actor's \"toolbox\" targeting popular applications, can have ShareX in its library.\r\n\r\nSee also: #578. concerning signatures on the updater."},"comment":{"url":"https://api.github.com/repos/ShareX/ShareX/issues/comments/313706753","html_url":"https://github.com/ShareX/ShareX/issues/2615#issuecomment-313706753","issue_url":"https://api.github.com/repos/ShareX/ShareX/issues/2615","id":313706753,"user":{"login":"TheOddball","id":16966979,"avatar_url":"https://avatars2.githubusercontent.com/u/16966979?v=3","gravatar_id":"","url":"https://api.github.com/users/TheOddball","html_url":"https://github.com/TheOddball","followers_url":"https://api.github.com/users/TheOddball/followers","following_url":"https://api.github.com/users/TheOddball/following{/other_user}","gists_url":"https://api.github.com/users/TheOddball/gists{/gist_id}","starred_url":"https://api.github.com/users/TheOddball/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TheOddball/subscriptions","organizations_url":"https://api.github.com/users/TheOddball/orgs","repos_url":"https://api.github.com/users/TheOddball/repos","events_url":"https://api.github.com/users/TheOddball/events{/privacy}","received_events_url":"https://api.github.com/users/TheOddball/received_events","type":"User","site_admin":false},"created_at":"2017-07-07T15:01:10Z","updated_at":"2017-07-07T15:01:10Z","body":"Wouldn't this destroy being able to edit the source for yourself?"}}
{"actor":{"display_login":"TheOddball"}}