Update system "hacked"

[Shotokan]

Hi guys,
I've found that the update is done all in "clear http": no https, no check.. nothing!
Even the update.archos.com's ip isn't checked at all!
So I've decided to attack the Archos 70 with a man in the middle attack, spoofing then the update.archos.com's ip to 192.168.1.60 (local webserver) where i've uploaded an edited "update_archos_gen8_daos.xml" and.. lol attack done.
well, these are the results:
P1020557.JPG
P1020558.JPG
P1020559.JPG
P1020560.JPG

Well.. why don't you even put update.archos.com into the hosts file?
And.. why don't you even use ssl to exchange data? (checking ssl headers is a good idea!)
If you need help, i'm here.

[nz]

Hi guys,
I've found that the update is done all in "clear http": no https, no check.. nothing!
Even the update.archos.com's ip isn't checked at all!
So I've decided to attack the Archos 70 with a man in the middle attack, spoofing then the update.archos.com's ip to 192.168.1.60 (local webserver) where i've uploaded an edited "update_archos_gen8_daos.xml" and.. lol attack done.
well, these are the results:
P1020557.JPG
P1020558.JPG
P1020559.JPG
P1020560.JPG

Well.. why don't you even put update.archos.com into the hosts file?
And.. why don't you even use ssl to exchange data? (checking ssl headers is a good idea!)
If you need help, i'm here.

with your attack, what are you able to do?

[Shotokan]

I can 'fake' an update, and then send an edited one (with a virus maybe?) to the archos

[nz]

I can 'fake' an update, and then send an edited one (with a virus maybe?) to the archos

yes, but how will you sign your virus update correctly?

[Shotokan]

haven't tried it yet, but I guess I can reverse the 'sign algorythm' from the linux tool (the 'unpacker')
Do you want me to try?

[nz]

haven't tried it yet, but I guess I can reverse the 'sign algorythm' from the linux tool (the 'unpacker')
Do you want me to try?

if you can do this, you can just install a hacked update aos over usb, no need to spoof the server.

[Shotokan]

I guess you don't get what's the problem:
An 'attacker' when reversed the 'sign algorythm' can make & sign a fake update, and then the user will be prompted to download and execute it, doing that this way, an attacker can install a 'virussed' version to inconcious users

[nz]

I guess you don't get what's the problem:
An 'attacker' when reversed the 'sign algorythm' can make & sign a fake update, and then the user will be prompted to download and execute it, doing that this way, an attacker can install a 'virussed' version to inconcious users

by editing their hosts file on their pc? or by taking over their ISP?

[Shotokan]

I guess you don't get what's the problem:
An 'attacker' when reversed the 'sign algorythm' can make & sign a fake update, and then the user will be prompted to download and execute it, doing that this way, an attacker can install a 'virussed' version to inconcious users

by editing their hosts file on their pc? or by taking over their ISP?

No, performing a "Man in the middle (MITM)" attack an attacker can edit data before they're sent/received by the device (in this case, the archos).
As you've seen in the pic, the my netbook (attacker) have spoofed the update.archos.com address to a local address, but i could even fake data as they're sent from the update.archos.com ip, not a local one, and all of that is 'user-invisible' and kinda easy to do.
I've done it in 2 minutes.
(for other details see wikipedia: http://en.wikipedia.org/wiki/Man-in-the-middle_attack )

[nz]

I guess you don't get what's the problem:
An 'attacker' when reversed the 'sign algorythm' can make & sign a fake update, and then the user will be prompted to download and execute it, doing that this way, an attacker can install a 'virussed' version to inconcious users

by editing their hosts file on their pc? or by taking over their ISP?

No, performing a "Man in the middle (MITM)" attack an attacker can edit data before they're sent/received by the device (in this case, the archos).
As you've seen in the pic, the my netbook (attacker) have spoofed the update.archos.com address to a local address, but i could even fake data as they're sent from the update.archos.com ip, not a local one, and all of that is 'user-invisible' and kinda easy to do.
I've done it in 2 minutes.
(for other details see wikipedia: http://en.wikipedia.org/wiki/Man-in-the-middle_attack )

yes, yes, I understand all that.