Vulnerabilities / Threats
8/4/2009
02:06 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Software Updates Vulnerable To Hijacking

Public Wi-Fi networks present a risk to connected users even if they're not surfing the Internet, thanks to applications that try to update themselves automatically.

The security risks posed by the use public Wi-Fi networks have been known for years, but even cautious computer users may be vulnerable to attack when connected to public Wi-Fi networks as a result of the widespread insecurity of automated software updates.

In a recent presentation at the DEFCON security conference in Las Vegas, Radware security researchers Itzik Kotler and Tomer Bitton revealed that hundreds of popular applications are vulnerable to a man-in-the-middle attack because they rely on a flawed software update process.

To demonstrate the flaw, Kotler and Bitton have released software called ippon-mitm that can hijack software update sessions and answer update queries by returning malware to the requesting computer. Often, a user will be unaware that an update query has been sent and intercepted and may continuing to enter sensitive information into the compromised computer.

The researchers said that the update mechanisms in Alcohol 120, Adobe PDF Reader, GOM Player, Hex Workshop, iMesh, and Skype, among other applications, were vulnerable.

Kotler declined to name the rest of the vulnerable applications, saying that his company has been in contact with the appropriate vendors to inform them about the problem. A company spokesperson was not immediately available to clarify whether any of the vulnerable applications have been patched since the DEFCON presentation.

"In a clear Wi-Fi situation everything is open," Kotler said. "I can pretend to be Google. If I know the victim, I can DNS poison the cache."

Kotler warns that the attack, once successful, can turn an infected machine into a source of contagion that attacks other machines on the network.

Unlike Microsoft, which uses public key cryptography to keep its updates secure, most vendors have no update authentication system built into their update process.

"They have to take the time and invest in research to figure out how to conduct updates in a more secure manner," said Kotler.

InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6335
Published: 2014-08-26
The Backup-Archive client in IBM Tivoli Storage Manager (TSM) for Space Management 5.x and 6.x before 6.2.5.3, 6.3.x before 6.3.2, 6.4.x before 6.4.2, and 7.1.x before 7.1.0.3 on Linux and AIX, and 5.x and 6.x before 6.1.5.6 on Solaris and HP-UX, does not preserve file permissions across backup and ...

CVE-2014-0480
Published: 2014-08-26
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL ...

CVE-2014-0481
Published: 2014-08-26
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a d...

CVE-2014-0482
Published: 2014-08-26
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors relate...

CVE-2014-0483
Published: 2014-08-26
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.