Bug 103053 - Avoiding Trojan horse “DCM”
Summary: Avoiding Trojan horse “DCM”
Status: RESOLVED INVALID
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-07 15:10 UTC by Volga
Modified: 2016-10-08 13:07 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Volga 2016-10-07 15:10:13 UTC 
Description:
Recently a Chinese blog have an article mentioned a Trojan horse called “DCM”, also known as “黑暗幽灵木马” (hēiàn yōulíng mùmǎ) in Chinese, which have been exposed by Tencent Corp. in April. 

Steps to Reproduce:
As the author, this Trojan using DNS poisoning to distribute itself, and insert itself within software pack when user update. 

Actual Results:  
After update, this Trojan can be inserted within LibreOffice, but the user cannot be mentioned.

Expected Results:
To avoid this Trojan, using encrypted proctol to check and download update is necessary, and creating an validate machenism after download the update pack is also useful.

Source: https://program-think.blogspot.com/2016/08/Trojan-Horse-DCM.html


Reproducible: Always

User Profile Reset: No

Additional Info:


User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:49.0) Gecko/20100101 Firefox/49.0
Comment 1 Joel Madero 2016-10-08 04:33:05 UTC 
Closing as INVALID. This isn't a bug report. If you think there's a security issue with libreoffice see https://www.libreoffice.org/about-us/security/.

This isn't a valid report so I'm closing it.
Comment 2 Volga 2016-10-08 13:07:22 UTC 
(In reply to Joel Madero from comment #1)
> Closing as INVALID. This isn't a bug report. If you think there's a security
> issue with libreoffice see https://www.libreoffice.org/about-us/security/.
> 
> This isn't a valid report so I'm closing it.

Thanks.