Using software updates to spread malware
Itzik Kotler and Tomer Bitton of Radware
(Credit: Elinor Mills/CNET News)LAS VEGAS--Two researchers from Israeli security firm Radware have figured out a way to trick computers into downloading malware or take over a computer by hijacking the communications during the update process for Skype and other applications.
About 100 applications, many among the most popular on CNET's Download.com, can be targeted, said Itzik Kotler, team leader of Radware's security operations center, before his presentation here at the Defcon conference.
Kotler and colleague Tomer Bitton are releasing a tool called Ippon (which means "game over" in Judo) that enables the attack and offers a 3D view of potential victims on a network.
With the tool, an attacker can scan a Wi-Fi network for computers checking for new updates via HTTP (Hyper Text Transport Protocol). If the system detects a computer sending a software update request, the tool replies before the app update server can respond, Kotler said.
Ippon customizes messages for the particular application and sends a message indicating that there is an update available even when the system already has the most recent legitimate update, he said. A malicious file is then downloaded from the attacker's server onto the victim's computer.
The researchers said they had not tested whether Firefox or other major browsers are vulnerable. Microsoft software is not vulnerable because it uses digital signatures in its update process, which all software updates should, Kotler said. People should be careful when using public Wi-Fi networks and avoid doing software updates on them, he said.
"You have to assume when on a public infrastructure that the infrastructure can be attacked," he added.
There is also the possibility that someone could spread an "airborne virus" via software updates that uses victim machines to attack and infect other machines on a network, according to Kotler.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
Why would people have assumed it was bad before now. At least I hadn't heard of it.
95% of the population who isn't a security nut.
....or still using Windows ME, just like yourself
If you can't stay relevent and stop trolling for one comment don't post at all.
So Windows users?
Only digital signatures can reliably validate the payload*, assuming the keys have not been compromised.
* well manually verifying a secure hash could work too, but very few people actually check hashes on programs they download.
Just one more reason to stay away from public WiFi networks.
/sarcasm
Excuse me for asking this , but why are they releasing a tool that ENABLES the attack? Isn't that like giving your car keys to the thief..should they not be locking it away in a safe and releasing a fix?
Get back to your kiddy games and leave articles like these alone. Persons like you are the first ones to get hacked because you are simply dumb.
Vista and Win 7 are immune to viruses and drivebys as is OSX.
Any OS can be attacked with malware if a idiot is using it open your damn eyes and you will realize that there is about 6 or 7 malware programs for OSX and more are being developed.
Hey genius...
Vista and Win 7 are immune to viruses and drivebys as is OSX.
lol thus speaketh the CNET über troll. Hey you my want to repost that when you're not stoned, lol priceless!
Find me a Vista virus that gets through UAC
@sargess
"Find me a Vista virus that gets through UAC"
lol, you mentioned UAC? man you really are out of your depth, as they if you're in a hole stop digging (or trolling in your case). Pity you can't afford a Mac, but then again ....
Apparently you couldn't find one this is shown by instead of you answering my question you resorting to insults.
You've failed.
Also don't judge my financial status based on me not wanting a Mac.
I think I can well enough afford a Mac considering I have a loaded 2010 Mustang sitting in my driveway..
Really? I guess that demo given by a friend at a local security con last week didn't really show a drive by on Vista?
You are a total moron if you think that Vista or 7 are immune to driveby's. The vast majority of the Fista exploits require NO user intervention.
Then put your money where your mouth is and show me one.
Go look on cert for the many examples of Vista malware that requires no user intervention. AS for 7 read this and cry:
http://netsecurity.about.com/b/2009/02/04/modified-uac-in-windows-7-exposes-potential-security-issues.htm
http://www.osnews.com/story/21085/Editorial_Windows_7_s_UAC_Is_Broken_and_Insecure
The white listing makes elevation of privileges trivial, thus drive-by's will increase even more then they did with Vista, whose memory protections were completely broken 2 years ago and are not fixable by a patch because it is a architectural flaw.
Windows 7 is better then say 98, but Windows remains a security nightmare.
it checks for updates using SSL and demands a valid certificate
(look at https://aus2.mozilla.org/update/3/Firefox/3.6a1pre/20090729045158/WINNT_x86-msvc/en-US/nightly/Windows_NT%206.1/default/default/update.xml?force=1
for and example of such update data).
While the actual update data is pushed unencrypted, the signed update
description includes a hash value that the update data is checked
against, so in order to get another binary to install, you'd need it
to have the same hash value, which is at best as likely as somebody
guessing the certificate itself.
(Hopefully somebody with a better knowledge of encryption can give us a summary)
Stop worrying about what you think everyone else thinks about you. Have a drink and solve the problem.
Truth is, we don't know how to deal with it. Creating a solution is by far harder than talking about how much smarter you are than everybody else.
The problem is that we have to deal with thousands of legacy applications. Even if we introduced a centralized update facility à la Linux, then those applications would still behave like they always did. There's no way to force an application to use a provided update facility.
Then there's the problem of applications actually needing their own system. A centralized update facility could not possibly support everything that application developers want and since their old update programs would continue to work, why would those developers want to use it? Maybe the developer has his own routines for load balancing which the standard update system doesn't support? And suddenly we're back at square one: People still writing their own flawed update systems.
DO NOT USE WI-FI FOR UPDATES, WAIT UNTIL YOUR HOME AND SECURE.
Duh!!!!!
You see the problem: assuming, assuming, assuming.
Chances are not many are going to exploit this and a firewall will quickly protect you.
The difference in difficulty level between attacking via wired and wireless is so small as to be non-existent.
- by Garken August 3, 2009 9:11 AM PDT
- Some of you are missing the point. This is not a drive by, it's an interception. Almost all software gives you the option to turn off auto updates. Chrome i'm not sure about, but I don't trust Google anyway. The simple fact is to just not let your computer auto update anything, set it to ask permission first and then you have control when you are out of your network.
- Like this Reply to this comment
-
Showing 1 of 2 pages (63 Comments)