{"action":"created","issue":{"url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556","repository_url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-","labels_url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556/labels{/name}","comments_url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556/comments","events_url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556/events","html_url":"https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556","id":140547577,"number":556,"title":"Update Checks are performed via plain HTTP","user":{"login":"ctrezevant","id":7227500,"avatar_url":"https://avatars.githubusercontent.com/u/7227500?v=3","gravatar_id":"","url":"https://api.github.com/users/ctrezevant","html_url":"https://github.com/ctrezevant","followers_url":"https://api.github.com/users/ctrezevant/followers","following_url":"https://api.github.com/users/ctrezevant/following{/other_user}","gists_url":"https://api.github.com/users/ctrezevant/gists{/gist_id}","starred_url":"https://api.github.com/users/ctrezevant/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ctrezevant/subscriptions","organizations_url":"https://api.github.com/users/ctrezevant/orgs","repos_url":"https://api.github.com/users/ctrezevant/repos","events_url":"https://api.github.com/users/ctrezevant/events{/privacy}","received_events_url":"https://api.github.com/users/ctrezevant/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-03-14T00:36:34Z","updated_at":"2016-03-14T10:13:45Z","closed_at":"2016-03-14T10:13:45Z","body":"**OS:** OS X and Linux, but presumably all.\r\n\r\n**Issue Descriptions:** \r\n\r\nGPMDP's update mechanism is based on [Squirrel](https://github.com/Squirrel/Squirrel.Windows), which checks for updates by making an http call to a JSON feed. This feed will return a JSON response containing update information if the requested version exists. For example, GPMDP's feed (located at http://update.googleplaymusicdesktopplayer.com/update/{platform}/{versionnumber}) currently looks like this:\r\n\r\n    {  \r\n       \"url\":\"http://update.googleplaymusicdesktopplayer.com/download/version/3.0.1/osx_64?filetype=zip\",\r\n       \"name\":\"3.0.1\",\r\n       \"notes\":\"This is a bugfix release of...\",\r\n       \"pub_date\":\"2016-03-11T02:53:45.000Z\"\r\n    }\r\n\r\nBecause this call is performed via plain http, an attacker can perform a man-in-the-middle attack to push a malicious update to unsuspecting users. Compounding this, not only is the API endpoint HTTP only- the url property, which contains the download link, is plain HTTP as well!\r\n\r\nIn fact, I was able to create my own imitation update server that successfully triggered an update on 2 different macs after changing the IP of update.googleplaymusicdesktopplayer.com in my router's config (simulating DNS poisoning): \r\n\r\n![mac 1](https://cloud.githubusercontent.com/assets/7227500/13732169/57e2c76c-e952-11e5-85cb-09ff08f19508.png)\r\n\r\n![mac 2](https://cloud.githubusercontent.com/assets/7227500/13732173/6dd26d20-e952-11e5-8a33-f91428d7481a.png)\r\n\r\n**Steps to Reproduce:** \r\n\r\nMy web server configuration and false JSON response can be found in [this gist](https://gist.github.com/ctrezevant/cdcf8a9f89b40304d6c9). This also contains an excerpt from my web server logs showing the behavior of GPMDP as it parses the fake update information I served.\r\n\r\n**Suggested fixes:**\r\n\r\nAll of the Squirrel API endpoints for googleplaymusicdesktopplayer.com should be served over HTTPS. As it currently sits, the domain has [no HTTPS support at all whatsoever](https://www.ssllabs.com/ssltest/analyze.html?d=update.googleplaymusicdesktopplayer.com&latest). \r\n\r\nOnce HTTPS has been implemented, [autoUpdater.js](https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/blob/master/src/main/features/core/autoUpdater.js) should be updated (heh) to reflect the changes. "},"comment":{"url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/comments/196239331","html_url":"https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556#issuecomment-196239331","issue_url":"https://api.github.com/repos/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/issues/556","id":196239331,"user":{"login":"MarshallOfSound","id":6634592,"avatar_url":"https://avatars.githubusercontent.com/u/6634592?v=3","gravatar_id":"","url":"https://api.github.com/users/MarshallOfSound","html_url":"https://github.com/MarshallOfSound","followers_url":"https://api.github.com/users/MarshallOfSound/followers","following_url":"https://api.github.com/users/MarshallOfSound/following{/other_user}","gists_url":"https://api.github.com/users/MarshallOfSound/gists{/gist_id}","starred_url":"https://api.github.com/users/MarshallOfSound/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MarshallOfSound/subscriptions","organizations_url":"https://api.github.com/users/MarshallOfSound/orgs","repos_url":"https://api.github.com/users/MarshallOfSound/repos","events_url":"https://api.github.com/users/MarshallOfSound/events{/privacy}","received_events_url":"https://api.github.com/users/MarshallOfSound/received_events","type":"User","site_admin":false},"created_at":"2016-03-14T10:13:45Z","updated_at":"2016-03-14T10:13:45Z","body":"SSL pushed to master"}}