Feeds

Security patch distribution – it's trojan time

Crackers could turn cure into disease

  • alert
  • submit to reddit

New hybrid storage solutions

The way operating system vendors issue security patches is insecure, in many cases, and could let crackers exploit this to trick users into loading trojan horses onto their systems.

Security firm BindView, whose Razor team of security researchers completed the research, questioned 27 different vendors of commonly used products on whether patches are accompanied by digital signatures or other forms of cryptographic authentication. Its findings, available in full here, are a real eye-opener because they highlight glaring security gaps, not least that a minority of vendors, including Apple and Compaq, provide no authentication for their patches.

"A number of the vendors (including some Fortune 500 companies) do not offer patch authentication via any cryptographic method. This can make it very difficult for customers to verify that they have obtained a correct patch rather than a trojan horse," said Matt Power, of BindView's Razor security team.

"A trojan-horse patch might be stored on the vendor's server if that server were compromised by intruders," he added, a risk that has to be taken more seriously given the recent hack of Microsoft's network, and the defacement of web sites of security vendor Network Associates.

Power added that even if a vendor's server is not compromised, well-known weaknesses in Internet protocols can be exploited to deliver a trojan-horse patch to users.

Interestingly the research threw up an admission by Microsoft's Security Response Center that "no more than several thousand people have downloaded our PGP key". This means that only a very small number of users are checking the authenticity of bulletins.

Richard Stagg, senior security architect at Information Risk Management, said getting people to install trojan horses through deceiving people into believing they were security updates was "a standard hacking technique" which was "an extension of social engineering".

Attacks based on subverting security patches were not common, because they are difficult to arrange, but could potentially be "very bad" and extend into the inclusion of trojan horses into software available on CD-ROMs.

"Vendors have a duty to provide security patches, a pre-requisite to which is that there must be a straightforward method to validate the content. Its naive for vendors to expects users to automatically check patches," said Stagg.

"If it takes time to verify patches the instinct of most people will be to just grab a file and install it," he added. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.