Diebold Nixdorf Warsaw static analysis

TL;DR it installs a self signed certificate in your browser, then starts a daemon - that is not good. I suspect this is malware that is going to do a MITM (Man in the middle) attack.

Steps

go to https://www.bb.com.br/ from a Linux or *BSD box (Windows or Macos will give you a different download)
click [ACESSE SUA CONTA]
click [INSTALAR O MODULO DE SEGURANCA]
Save diagbb-1.0.32.run to a file
bbdiag-1.0.32.run is a kind of shar file - remove the ascii part - a .tar.gz part is left
untar the file
see .../warsaw_x32/src/wscertmgr creating and installing a self signed certificate in your browser
see .../warsaw_x32/src/warsaw start a daemon with name "core" - I expect it is doing a MITM attack on some or all traffic in your browser

Even if it is not a MITM attack, this is a lot of third party software, that may never be updated, that runs as root.
Time for dynamic analysis.

References

The FAQ for this product.
Some sources.
The thing on Github. Note the broken link.

Listings

The download and the zipped tarfile

$ ls -lsa
21952 -rw-r--r--  1 user  wheel   22430684 Jan 24 16:29 diagbb-1.0.32.run
21952 -rw-r--r--  1 user  kiersb  22427107 Jan 24 16:31 diagbb-1.0.32.tar.gz

The files in it

./tmp
./tmp/ModSegBB_war
./tmp/ModSegBB_war/warsaw_x32
./tmp/ModSegBB_war/warsaw_x32/src
./tmp/ModSegBB_war/warsaw_x32/src/libxcb-render.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libdatrie.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXcomposite.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libfontconfig.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libstdc++.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libgpg-error.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wsftbid.so
./tmp/ModSegBB_war/warsaw_x32/src/wslbmid.so
./tmp/ModSegBB_war/warsaw_x32/src/libp11-kit.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wsftbco.so
./tmp/ModSegBB_war/warsaw_x32/src/libhogweed.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5.so.26
./tmp/ModSegBB_war/warsaw_x32/src/libdl.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libxcb.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libpng12.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libffi.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libhx509.so.5
./tmp/ModSegBB_war/warsaw_x32/src/wsftbmo.so
./tmp/ModSegBB_war/warsaw_x32/src/ws.cnf
./tmp/ModSegBB_war/warsaw_x32/src/libcrypto.so.1.0.0
./tmp/ModSegBB_war/warsaw_x32/src/libXcursor.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libldap_r-2.4.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgmp.so.10
./tmp/ModSegBB_war/warsaw_x32/src/libroken.so.18
./tmp/ModSegBB_war/warsaw_x32/src/libselinux.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXdamage.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libwind.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgmodule-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libcrypt.so.1
./tmp/ModSegBB_war/warsaw_x32/src/features.dat
./tmp/ModSegBB_war/warsaw_x32/src/core
./tmp/ModSegBB_war/warsaw_x32/src/librtmp.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5support.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libX11.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libatk-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpcre.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libsystemd.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libSM.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libXi.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libharfbuzz.so.0
./tmp/ModSegBB_war/warsaw_x32/src/wscertmgr
./tmp/ModSegBB_war/warsaw_x32/src/libssl.so.1.0.0
./tmp/ModSegBB_war/warsaw_x32/src/wsatspi
./tmp/ModSegBB_war/warsaw_x32/src/wsftup.so
./tmp/ModSegBB_war/warsaw_x32/src/warsaw.desktop
./tmp/ModSegBB_war/warsaw_x32/src/libcurl.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libm.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libexpat.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXinerama.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libpangocairo-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgdk_pixbuf-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libidn.so.11
./tmp/ModSegBB_war/warsaw_x32/src/libXfixes.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libglib-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpango-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libkeyutils.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libc.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libnettle.so.6
./tmp/ModSegBB_war/warsaw_x32/src/wsftdl.so
./tmp/ModSegBB_war/warsaw_x32/src/libXxf86vm.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libgobject-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libthai.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libpthread.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libcares.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libresolv.so.2
./tmp/ModSegBB_war/warsaw_x32/src/dbldwrsw.ttf
./tmp/ModSegBB_war/warsaw_x32/src/liblber-2.4.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libz.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libgraphite2.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libpixman-1.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libheimbase.so.1
./tmp/ModSegBB_war/warsaw_x32/src/uninstall.dat
./tmp/ModSegBB_war/warsaw_x32/src/libhcrypto.so.4
./tmp/ModSegBB_war/warsaw_x32/src/libtasn1.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libpangoft2-1.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libXext.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libgdk-x11-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libasn1.so.8
./tmp/ModSegBB_war/warsaw_x32/src/libsqlite3.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgssapi_krb5.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libdbus-1.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libgio-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/warsaw
./tmp/ModSegBB_war/warsaw_x32/src/libgcc_s.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libsasl2.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgtk-x11-2.0.so.0
./tmp/ModSegBB_war/warsaw_x32/src/config.cfg
./tmp/ModSegBB_war/warsaw_x32/src/libheimntlm.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libgnutls.so.30
./tmp/ModSegBB_war/warsaw_x32/src/libcom_err.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libgcrypt.so.20
./tmp/ModSegBB_war/warsaw_x32/src/libk5crypto.so.3
./tmp/ModSegBB_war/warsaw_x32/src/libxcb-shm.so.0
./tmp/ModSegBB_war/warsaw_x32/src/libXrandr.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libkrb5.so.3
./tmp/ModSegBB_war/warsaw_x32/src/ld-linux.so.2
./tmp/ModSegBB_war/warsaw_x32/src/libcairo.so.2
./tmp/ModSegBB_war/warsaw_x32/src/copyright
./tmp/ModSegBB_war/warsaw_x32/src/wsbrmu.so
./tmp/ModSegBB_war/warsaw_x32/src/librt.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libICE.so.6
./tmp/ModSegBB_war/warsaw_x32/src/liblzma.so.5
./tmp/ModSegBB_war/warsaw_x32/src/libXau.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libXdmcp.so.6
./tmp/ModSegBB_war/warsaw_x32/src/wsftuan.so
./tmp/ModSegBB_war/warsaw_x32/src/libfreetype.so.6
./tmp/ModSegBB_war/warsaw_x32/src/libuuid.so.1
./tmp/ModSegBB_war/warsaw_x32/src/libXrender.so.1
./tmp/ModSegBB_war/warsaw_x32/src/gas.dbd
./tmp/ModSegBB_war/warsaw_x32/src/libgssapi.so.3
./tmp/ModSegBB_war/warsaw_x32/src/migratecache
./tmp/ModSegBB_war/warsaw_x32/src/ws.cnf.xxx
./tmp/ModSegBB_war/warsaw_x32/warsaw_x32_uninstall.sh
./tmp/ModSegBB_war/warsaw_install.sh
./tmp/ModSegBB_war/distro.sh
./tmp/ModSegBB_war/preinstall.sh
./tmp/ModSegBB_war/conf
./tmp/ModSegBB_war/conf/lib
./tmp/ModSegBB_war/conf/libpm
./tmp/ModSegBB_war/conf/info
./tmp/ModSegBB_war/conf/paths
./tmp/ModSegBB_war/conf/distro
./tmp/ModSegBB_war/conf/digbbconf
./tmp/ModSegBB_war/conf/pm
./tmp/ModSegBB_war/path.sh
./tmp/ModSegBB_war/postinstall.sh
./tmp/ModSegBB_war/install.sh
./tmp/ModSegBB_war/checalib.sh

webmaster@itsx / Warsaw / created 2019-01-24 / last update 2019-01-24