Robert Hensing's Blog

Software Security . . . and stuff.

Today's Fail Open Goat Award goes to: Insecure 3rd party software updaters

Today's Fail Open Goat Award goes to: Insecure 3rd party software updaters

  • Comments 3
  • Likes

You'll notice Microsoft's auto-updaters (Windows Update / Microsoft Update / Automatic Updates) are not on the list.  Why?  Because we're paranoid, and we anticipated this type of threat years ago and mitigated it by signing all of our binaries and only allowing our updater to install binaries signed by us.  I guess other vendors didn't get the memo. :)

Excerpt:

'....A security research outfit in Argentina has released a malcode distribution toolkit capable of launching man-in-the-middle attacks against popular products that use insecure update mechanisms.

The first version of the toolkit ships with exploit modules for several widely deployed software, including Apple’s Mac OS X and iTunes, WinZip, Winamp, OpenOffice and Sun Java.

A demo video provides a scary look at how a sophisticated blended attack can be used to target millions of Windows users.

In the video, Evilgrade uses HD Moore’s recent DNS exploit in tandem with Sun’s Java update mechanims to execute code and hijack a fully patched Windows machine......'

To read the complete article see:
http://blogs.zdnet.com/security/?p=1576
http://www.infobyte.com.ar/down/isr-evilgrade-Readme.txt

 

Comments
Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment