SUBVERTING CODE INTEGRITY CHECKS TO LOCALLY BACKDOOR SIGNAL, 1PASSWORD, SLACK, AND MORE

Summary from the TLDR InfoSec newsletter

A new vulnerability in popular Electron-based apps like Signal, 1Password, and Slack allows attackers to get around code integrity checks by hiding backdoors in overlooked V8 heap snapshot files. Electron's integrity protections often miss these files, meaning backdoors can be inserted without failing code signatures or integrity checks, especially when apps are installed in user-writable folders. This post shows a proof of concept to demonstrate keylogging and privilege escalation with the exploit, showing that even patched applications may have missed attack surfaces.