Updating your PC may outdate it...
Automatic software updates can provide patches to fix security flaws and introduce new features on installed applications, but they also can expose mobile computers to malicious code, say researchers from the application security firm Radware.
“Most applications today support an update feature,” said Itzik Kotler, Security Operation Center team leader. When online, they automatically open an http connection to the vendor site to request updates, and then prompt the user to approve the download. “You will check ‘yes’ because you are expecting it to download a file.”
But in an unsecured environment such as a public WiFi network, the user can be subject to a man-in-the-middle attack that can hijack the session, direct it to an alternative site and download malicious software.
Kotler and Tomer Bitton, a security researcher at Radware, will demonstrate this attack and release a tool to build and inject false update replies at the DEFCON hacker convention, a sister event to the Black Hat Briefings at the Riviera Hotel and Casino.
Kotler said the release of the tool is intended to spur better security for applications and for network infrastructures. “There is a need for continued education on emerging online and network security threats,” he said.
The attack has not yet been seen in the wild, but relatively few vendors protect against it by digitally signing software updates. An incomplete survey of applications found more than 100 that are vulnerable to hijacking on unsecured networks, Kotler said.
But in an unsecured environment such as a public WiFi network, the user can be subject to a man-in-the-middle attack that can hijack the session, direct it to an alternative site and download malicious software.
Kotler said the release of the tool is intended to spur better security for applications and for network infrastructures. “There is a need for continued education on emerging online and network security threats,” he said.
The attack has not yet been seen in the wild, but relatively few vendors protect against it by digitally signing software updates. An incomplete survey of applications found more than 100 that are vulnerable to hijacking on unsecured networks, Kotler said.
“This is a fundamental flaw of http,” he said. “It does not tell you where you are really going.” Update features depend on the security of the infrastructure to ensure that the connection is reliable.
“We have an assumption that the network is reliable and secure,” he said. This might be true within an enterprise, but mobile devices increasingly are being used on wireless connections over WiFi in public places, where sessions are subject to sniffing by nearby devices.
“It can hijack your antivirus update,” and download code that could disable an antivirus engine or block a signature for a specific piece of malicious code, Kotler said. “It can also turn the victim into an attacker,” with commands to sniff for other wireless sessions in the area.
The solution against an update attack is for vendors to digitally sign updates and make the public key available to browsers so that the code can be verified before they are executed and the application “won’t run just anything,” he said. Only a relatively small handful of companies are signing updates now, but they include some of the largest vendors, including Microsoft, Sun’s Java and Google.
“This is an investment that vendors need to make to protect their customers,” Kotler said. He said he planned to approach vendors prior to his presentation on Saturday to inform them of the exploit and the need for protecting updates. Until signing becomes common, mobile users should use caution when outside of the enterprise. “When you go to an insecure network, you should consider all of the potential outcomes.”
“We have an assumption that the network is reliable and secure,” he said. This might be true within an enterprise, but mobile devices increasingly are being used on wireless connections over WiFi in public places, where sessions are subject to sniffing by nearby devices.
The solution against an update attack is for vendors to digitally sign updates and make the public key available to browsers so that the code can be verified before they are executed and the application “won’t run just anything,” he said. Only a relatively small handful of companies are signing updates now, but they include some of the largest vendors, including Microsoft, Sun’s Java and Google.
“This is an investment that vendors need to make to protect their customers,” Kotler said. He said he planned to approach vendors prior to his presentation on Saturday to inform them of the exploit and the need for protecting updates. Until signing becomes common, mobile users should use caution when outside of the enterprise. “When you go to an insecure network, you should consider all of the potential outcomes.”
With the tool, an attacker can scan a Wi-Fi network for computers checking for new updates via HTTP (Hyper Text Transport Protocol). If the system detects a computer sending a software-update request, the tool replies before the app update server can respond, Kotler said.
Ippon customises messages for the particular application and sends a message indicating there is an update available even when the system already has the most recent legitimate update, he said. A malicious file is then downloaded from the attacker's server onto the victim's computer.
The researchers said they had not tested whether Firefox or other major browsers are vulnerable. Microsoft software is not vulnerable because it uses digital signatures in its update process, which all software updates should, Kotler said. People should be careful when using public Wi-Fi networks and avoid doing software updates on them, he said.
0 comments:
Post a Comment