I'm not sure if this qualifies for the rewards program, as it involves local dll loading, but seems a significant security issue as it allows an attacker to impersonate Google's identity.

Basically, GoogleUpdate.exe checks the code signing of some libraries before loading, but will also load a goopdate.dll file without signature on the same dir.

For example, this allows an attacker to distribute GoogleUpdate.exe together with a malware dll which requests for rights elevation, and trick the user into accepting it, as the request screen will show Google's signature.

I attached a sample dll which when loaded exploits this vulnerability. Just execute GoogleUpdate.exe, and note how the elevation request assures Google's identity.

Shouldn't GoogleUpdate.exe always check for code signature before calling LoadLibrary?
 

Deleted: goopdate.zip 88.0 KB

goopdate.zip 88.0 KB Download