Unity 5 Security Concerns

In my last blog post, I talked about how to [Deploy Unity 5]({% post_url 2015-05-07-deploying-unity-5 %}). While working on that project, I uncovered a small, but important attack vector that should be fixed by Unity.

As I describe in the blog post, I introspect the Unity Download Assistant.app for a Settings.ini file which yields some URLs. This settings.ini file has 4 URLs, all of which are served over HTTP. The first 3 URLs seem to work, but the 4th has been unrepsonsive every time I try.

The bigger issue here is that these files are served over HTTP and the resulting packages are installed on users machines as a privledged user. NOT serving over HTTPS make the installer highly susceptible to a man-in-the middle attack and should be rectified ASAP. The Unity developer tool is installed on easily 10s of thousands, if not 100s of thousands of machines and Unity should fix the problem ASAP.

[settings]
ini_url1=http://netstorage.unity3d.com/unity/5a2e8fe35a68/unity-5.0.1f1-osx.ini
ini_url2=http://download.unity3d.com/download_unity/5a2e8fe35a68/unity-5.0.1f1-osx.ini
ini_url3=http://beta.unity3d.com/download/5a2e8fe35a68/unity-5.0.1f1-osx.ini
ini_url4=http://files.unity3d.com/bootstrapper/5a2e8fe35a68/unity-5.0.1f1-osx.ini
view raw settings.ini hosted with ❤ by GitHub
[Unity]
title=Unity 5
description=Unity Editor
url=MacEditorInstaller/Unity.pkg
md5=7195c195cad30c830ba8c8d8663c9924
install=true
mandatory=false
size=1768723729
installedsize=5143914000
[WebPlayer]
title=Web Player
description=Development Unity Web Player
url=MacWebPlayerInstaller/WebPlayer.pkg
md5=6e3e061b3d0306c618b43dff125b2976
install=true
mandatory=false
size=2774892
installedsize=6911000
[StandardAssets]
title=Standard Assets
description=Unity Standard Assets for easily getting started building projects in Unity
url=MacStandardAssetsInstaller/StandardAssets.pkg
md5=e065daaabd7eb45aa4d06fc9589e7491
install=true
mandatory=false
size=208121155
installedsize=203179000
[Example]
title=Example Project
description=Unity 5 Example Project
url=MacExampleProjectInstaller/Examples.pkg
md5=6c396fe228239de236bbb582955ec43d
install=false
mandatory=false
size=347282616
installedsize=616170000