Software Updates Vulnerable To HijackingSoftware Updates Vulnerable To Hijacking
Public Wi-Fi networks present a risk to connected users even if they're not surfing the Internet, thanks to applications that try to update themselves automatically.
August 4, 2009
The security risks posed by the use public Wi-Fi networks have been known for years, but even cautious computer users may be vulnerable to attack when connected to public Wi-Fi networks as a result of the widespread insecurity of automated software updates.
In a recent presentation at the DEFCON security conference in Las Vegas, Radware security researchers Itzik Kotler and Tomer Bitton revealed that hundreds of popular applications are vulnerable to a man-in-the-middle attack because they rely on a flawed software update process.
To demonstrate the flaw, Kotler and Bitton have released software called ippon-mitm that can hijack software update sessions and answer update queries by returning malware to the requesting computer. Often, a user will be unaware that an update query has been sent and intercepted and may continuing to enter sensitive information into the compromised computer.
The researchers said that the update mechanisms in Alcohol 120, Adobe PDF Reader, GOM Player, Hex Workshop, iMesh, and Skype, among other applications, were vulnerable.
Kotler declined to name the rest of the vulnerable applications, saying that his company has been in contact with the appropriate vendors to inform them about the problem. A company spokesperson was not immediately available to clarify whether any of the vulnerable applications have been patched since the DEFCON presentation.
"In a clear Wi-Fi situation everything is open," Kotler said. "I can pretend to be Google. If I know the victim, I can DNS poison the cache."
Kotler warns that the attack, once successful, can turn an infected machine into a source of contagion that attacks other machines on the network.
Unlike Microsoft, which uses public key cryptography to keep its updates secure, most vendors have no update authentication system built into their update process.
"They have to take the time and invest in research to figure out how to conduct updates in a more secure manner," said Kotler.
InformationWeek Analytics has published an independent analysis on data-loss prevention. Download the report here (registration required).
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
Get the Gartner Report: SOC Model Guide
Gone Phishing: How to Defend Against Persistent Phishing Attempts Targeting Your Organization
The Evolving Ransomware Threat: What Business Leaders Should Know About Data Leakage