1

I downloaded MongoDB 3.4 from the MongoDB website here

When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi

A Google search for a39adfe.msi turns up nothing.

Does anyone know if this is something expected and if not, why would it happen?

MongoDB permission for a39adfe.msi

CodyBugstein
  • 579
  • 5
  • 12
  • Well the original filename [appers only on the official site of mongoDB](https://www.google.com/search?dcr=0&ei=VdaGWsTYFpKUkwWk8IygDg&q=mongodb-win32-x86_64-2008plus-ssl-3.4.13-signed.msi&oq=mongodb-win32-x86_64-2008plus-ssl-3.4.13-signed.msi&gs_l=psy-ab.3...2487.4190.0.4528.8.8.0.0.0.0.188.718.7j1.8.0....0...1c.1.64.psy-ab..0.0.0....0.RoOyltbRsc4&gws_rd=cr) where you say you downloaded it. So this seems legit to me. Do you have any reason to believe that you were the target of an attack? – Tom K. Feb 16 '18 at 13:03
  • So what is `a39adfe.msi`? – CodyBugstein Feb 16 '18 at 13:51
  • More info on .msi [here](http://whatis.techtarget.com/fileformat/MSI-Installer-package-Microsoft-Windows). `a39adfe` is probably a name of a package that is part of the installer. If you are still unsure, download the installer from another source and compare the md5 hashes. – Tom K. Feb 16 '18 at 14:01
  • @TomK. As MD5 is easy to create collisions with, it would be possible for MongoDB's developers to release a legitimate version of the software, and an evil version, both with the same MD5. – forest Feb 23 '18 at 06:16
  • @forest The MSI has a digital signature which should be significantly stronger reassurance than MD5, but the general approach of checksums can be also used with a more robust algorithm like SHA-256. The certificate can be verified via the UAC prompt ("Show information about the publisher's certificate") or via `signtool.exe`. There's a relevant DOCS improvement in the MongoDB issue tracker showing how to use `signtool` to verify the certificate and a SHA-256 hash of the installer: [DOCS-10909: Windows signed MSI package verification steps](https://jira.mongodb.org/browse/DOCS-10909). – Stennie Feb 23 '18 at 09:23

1 Answers1

4

This is expected behaviour. When you install an MSI package, Windows caches a copy of the installer in "%windir%\installer" (a hidden system folder) and renames it using a random hex name. You can delve into the Windows registry to divine the mapping between original installer and the cached version, but if you'd like extra assurance it is probably easier (and more definitive) to compare the two .msi files.

Aside from the filename, the cached .msi file should be the same as the original .msi: you could compare details like file size, signing information, and checksums. In your screenshot, the verified publisher is "MongoDB, Inc".

You can confirm the install behaviour using:

 msiexec.exe /i <path_to_MSI> /lfvmous output.txt

Example output:

MSI (s) (14:A8) [14:00:05:398]: Original package ==> C:\Users\User\Desktop\mongodb-win32-x86_64-2008plus-ssl-3.4.13-signed.msi

MSI (s) (14:A8) [14:00:05:398]: Package we're running from ==> C:\WINDOWS\Installer\2c8ddfd2.msi

For some related information, see: Where the MSI file is copied after the installation?.

Stennie
  • 178
  • 1
  • 6