Mailing-List: contact flex-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: flex-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: local policy)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1257)
Subject: Re: Signed RSL from Apache
From: Paul Evans <paulevans@creative-cognition.co.uk>
In-Reply-To: <6F473191-BEBC-419B-B19D-4BB4191177EA@creative-cognition.co.uk>
Date: Mon, 20 Feb 2012 12:55:14 +0000
Content-Transfer-Encoding: quoted-printable
Message-Id: <907C09B9-E8E5-4197-AE77-A26494EC7E09@creative-cognition.co.uk>
References: 
 <CANcBHEAwdOqZS_aQzezbfd9tE0SvSOFCDXrw1dyTerbme8Gkag@mail.gmail.com>
 <CAAgciqrzDS=oLkKoEy+axKHQO3R72qS8k3a020ELpQ_OFfhw6g@mail.gmail.com>
 <CAJ16SzC+5X+cqoU6kMJSKgCWk68wF83jUefS2C5HbqZ8YZduVQ@mail.gmail.com>
 <05b201ccefb3$64f95cb0$2eec1610$@davidarno.org>
 <CAKPa920isfvdW2pDr-oHzd7LFVLc_wusBe4HtrZRTSReEo=tUg@mail.gmail.com>
 <CAKPa9226=rNeSqoSJ+h47-YUZHm5qq+3tdB_-JAbM_Eo0M961Q@mail.gmail.com>
 <05c501ccefb5$a6951950$f3bf4bf0$@davidarno.org>
 <4FBB9E17-C536-44F6-9FDC-0BE0AF86646C@creative-cognition.co.uk>
 <001501ccefc5$e8628bf0$b927a3d0$@davidarno.org>
 <6F473191-BEBC-419B-B19D-4BB4191177EA@creative-cognition.co.uk>
To: flex-dev@incubator.apache.org


On 20 Feb 2012, at 12:41, Paul Evans wrote:

> * Can I 'man-in-the-middle' and inject badLibrary with corresponding =
md5 to make it look good - i.e. spoof the central repository
> * can i get a badLoader into the application

more specifically... If attacker succeeds in the above, every app that =
wants to use  the same library version is compromised by that browser =
cache even after leaving the 'man-in-the-middle' compromised network.