CVE-2017-10818
📋 TL;DR
MaLion for Windows and Mac versions 3.2.1 to 5.2.1 use a hardcoded cryptographic key, allowing attackers to modify Terminal Agent connection settings and spoof the Relay Service. This affects all users running vulnerable versions of MaLion communication software.
💻 Affected Systems
- MaLion for Windows
- MaLion for Mac
📦 What is this software?
Malion by Intercom
Malion by Intercom
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of MaLion communications allowing man-in-the-middle attacks, data interception, and potential credential theft from all connected systems.
Likely Case
Attackers redirect communications to malicious servers, intercept sensitive data, and potentially gain unauthorized access to connected systems.
If Mitigated
Limited impact if network segmentation prevents external access to MaLion services and strict outbound firewall rules are in place.
🎯 Exploit Status
Exploitation requires network access to MaLion services but uses a known hardcoded key, making attacks straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.2 or later
Vendor Advisory: http://www.intercom.co.jp/information/2017/0801.html
Restart Required: Yes
Instructions:
1. Download MaLion version 5.2.2 or later from official vendor site. 2. Install the update following vendor instructions. 3. Restart all MaLion services and affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate MaLion services from untrusted networks to prevent external exploitation.
Firewall Restrictions
allImplement strict firewall rules to limit access to MaLion services only to trusted IP addresses.
🧯 If You Can't Patch
- Segment MaLion services on isolated network segments with strict access controls
- Monitor network traffic for unusual connections to/from MaLion services
🔍 How to Verify
Check if Vulnerable:
Check MaLion version in application settings or About dialog. Versions 3.2.1 through 5.2.1 are vulnerable.Check Version:
Check MaLion application menu → About or version information in program filesVerify Fix Applied:
Verify MaLion version is 5.2.2 or later and check that cryptographic operations use unique keys instead of hardcoded values.📡 Detection & Monitoring
Log Indicators:
- Unusual connection attempts to MaLion services
- Changes to MaLion configuration files
- Failed authentication attempts from unexpected sources
Network Indicators:
- Unexpected connections to MaLion Relay Service ports
- Traffic redirection to unknown servers
- Unencrypted or suspiciously encrypted communications
SIEM Query:
source="malion*" AND (event_type="config_change" OR dest_ip NOT IN [trusted_ips])