Diebold Nixdorf Warsaw static analysis

TL;DR it installs a self signed certificate in your browser, then starts a daemon - that is not good. I suspect this is malware that is going to do a MITM (Man in the middle) attack.

Steps

Even if it is not a MITM attack, this is a lot of third party software, that may never be updated, that runs as root.
Time for dynamic analysis.

References

The FAQ for this product.
Some sources.
The thing on Github. Note the broken link.

Listings

The download and the zipped tarfile
$ ls -lsa
21952 -rw-r--r--  1 user  wheel   22430684 Jan 24 16:29 diagbb-1.0.32.run
21952 -rw-r--r--  1 user  kiersb  22427107 Jan 24 16:31 diagbb-1.0.32.tar.gz
		
The files in it
./tmp
./tmp/ModSegBB_war
./tmp/ModSegBB_war/warsaw_x32
./tmp/ModSegBB_war/warsaw_x32/src
./tmp/ModSegBB_war/warsaw_x32/src/libxcb-render.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libdatrie.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXcomposite.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libfontconfig.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libstdc++.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libgpg-error.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wsftbid.so
./tmp/ModSegBB_war/warsaw_x32/src/wslbmid.so
./tmp/ModSegBB_war/warsaw_x32/src/libp11-kit.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wsftbco.so
./tmp/ModSegBB_war/warsaw_x32/src/libhogweed.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5.so.26
./tmp/ModSegBB_war/warsaw_x32/src/libdl.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libxcb.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libpng12.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libffi.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libhx509.so.5
./tmp/ModSegBB_war/warsaw_x32/src/wsftbmo.so
./tmp/ModSegBB_war/warsaw_x32/src/ws.cnf
./tmp/ModSegBB_war/warsaw_x32/src/libcrypto.so.1.0.0
./tmp/ModSegBB_war/warsaw_x32/src/libXcursor.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libldap_r-2.4.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgmp.so.10
./tmp/ModSegBB_war/warsaw_x32/src/libroken.so.18
./tmp/ModSegBB_war/warsaw_x32/src/libselinux.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXdamage.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libwind.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgmodule-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libcrypt.so.1
./tmp/ModSegBB_war/warsaw_x32/src/features.dat
./tmp/ModSegBB_war/warsaw_x32/src/core
./tmp/ModSegBB_war/warsaw_x32/src/librtmp.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5support.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libX11.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libatk-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpcre.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libsystemd.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libSM.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libXi.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libharfbuzz.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wscertmgr
./tmp/ModSegBB_war/warsaw_x32/src/libssl.so.1.0.0
./tmp/ModSegBB_war/warsaw_x32/src/wsatspi
./tmp/ModSegBB_war/warsaw_x32/src/wsftup.so
./tmp/ModSegBB_war/warsaw_x32/src/warsaw.desktop
./tmp/ModSegBB_war/warsaw_x32/src/libcurl.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libm.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libexpat.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXinerama.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libpangocairo-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgdk_pixbuf-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libidn.so.11
./tmp/ModSegBB_war/warsaw_x32/src/libXfixes.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libglib-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpango-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libkeyutils.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libc.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libnettle.so.6
./tmp/ModSegBB_war/warsaw_x32/src/wsftdl.so
./tmp/ModSegBB_war/warsaw_x32/src/libXxf86vm.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libgobject-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libthai.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpthread.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libcares.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libresolv.so.2
./tmp/ModSegBB_war/warsaw_x32/src/dbldwrsw.ttf
./tmp/ModSegBB_war/warsaw_x32/src/liblber-2.4.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libz.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libgraphite2.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libpixman-1.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libheimbase.so.1
./tmp/ModSegBB_war/warsaw_x32/src/uninstall.dat
./tmp/ModSegBB_war/warsaw_x32/src/libhcrypto.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libtasn1.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libpangoft2-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libXext.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libgdk-x11-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libasn1.so.8
./tmp/ModSegBB_war/warsaw_x32/src/libsqlite3.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgssapi_krb5.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libdbus-1.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libgio-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/warsaw
./tmp/ModSegBB_war/warsaw_x32/src/libgcc_s.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libsasl2.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgtk-x11-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/config.cfg
./tmp/ModSegBB_war/warsaw_x32/src/libheimntlm.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgnutls.so.30
./tmp/ModSegBB_war/warsaw_x32/src/libcom_err.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgcrypt.so.20
./tmp/ModSegBB_war/warsaw_x32/src/libk5crypto.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libxcb-shm.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libXrandr.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5.so.3
./tmp/ModSegBB_war/warsaw_x32/src/ld-linux.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libcairo.so.2
./tmp/ModSegBB_war/warsaw_x32/src/copyright
./tmp/ModSegBB_war/warsaw_x32/src/wsbrmu.so
./tmp/ModSegBB_war/warsaw_x32/src/librt.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libICE.so.6
./tmp/ModSegBB_war/warsaw_x32/src/liblzma.so.5
./tmp/ModSegBB_war/warsaw_x32/src/libXau.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libXdmcp.so.6
./tmp/ModSegBB_war/warsaw_x32/src/wsftuan.so
./tmp/ModSegBB_war/warsaw_x32/src/libfreetype.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libuuid.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXrender.so.1
./tmp/ModSegBB_war/warsaw_x32/src/gas.dbd
./tmp/ModSegBB_war/warsaw_x32/src/libgssapi.so.3
./tmp/ModSegBB_war/warsaw_x32/src/migratecache
./tmp/ModSegBB_war/warsaw_x32/src/ws.cnf.xxx
./tmp/ModSegBB_war/warsaw_x32/warsaw_x32_uninstall.sh
./tmp/ModSegBB_war/warsaw_install.sh
./tmp/ModSegBB_war/distro.sh
./tmp/ModSegBB_war/preinstall.sh
./tmp/ModSegBB_war/conf
./tmp/ModSegBB_war/conf/lib
./tmp/ModSegBB_war/conf/libpm
./tmp/ModSegBB_war/conf/info
./tmp/ModSegBB_war/conf/paths
./tmp/ModSegBB_war/conf/distro
./tmp/ModSegBB_war/conf/digbbconf
./tmp/ModSegBB_war/conf/pm
./tmp/ModSegBB_war/path.sh
./tmp/ModSegBB_war/postinstall.sh
./tmp/ModSegBB_war/install.sh
./tmp/ModSegBB_war/checalib.sh
		

webmaster@itsx / Warsaw / created 2019-01-24 / last update 2019-01-24