Feeds

Security patch distribution – it's trojan time

Crackers could turn cure into disease

  • alert
  • submit to reddit

Designing a Defense for Mobile Applications

The way operating system vendors issue security patches is insecure, in many cases, and could let crackers exploit this to trick users into loading trojan horses onto their systems.

Security firm BindView, whose Razor team of security researchers completed the research, questioned 27 different vendors of commonly used products on whether patches are accompanied by digital signatures or other forms of cryptographic authentication. Its findings, available in full here, are a real eye-opener because they highlight glaring security gaps, not least that a minority of vendors, including Apple and Compaq, provide no authentication for their patches.

"A number of the vendors (including some Fortune 500 companies) do not offer patch authentication via any cryptographic method. This can make it very difficult for customers to verify that they have obtained a correct patch rather than a trojan horse," said Matt Power, of BindView's Razor security team.

"A trojan-horse patch might be stored on the vendor's server if that server were compromised by intruders," he added, a risk that has to be taken more seriously given the recent hack of Microsoft's network, and the defacement of web sites of security vendor Network Associates.

Power added that even if a vendor's server is not compromised, well-known weaknesses in Internet protocols can be exploited to deliver a trojan-horse patch to users.

Interestingly the research threw up an admission by Microsoft's Security Response Center that "no more than several thousand people have downloaded our PGP key". This means that only a very small number of users are checking the authenticity of bulletins.

Richard Stagg, senior security architect at Information Risk Management, said getting people to install trojan horses through deceiving people into believing they were security updates was "a standard hacking technique" which was "an extension of social engineering".

Attacks based on subverting security patches were not common, because they are difficult to arrange, but could potentially be "very bad" and extend into the inclusion of trojan horses into software available on CD-ROMs.

"Vendors have a duty to provide security patches, a pre-requisite to which is that there must be a straightforward method to validate the content. Its naive for vendors to expects users to automatically check patches," said Stagg.

"If it takes time to verify patches the instinct of most people will be to just grab a file and install it," he added. ®

Boost IT visibility and business value

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Chrome browser has been DRAINING PC batteries for YEARS
Google is only now fixing ancient, energy-sapping bug
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
Big Blue Apple: IBM to sell iPads, iPhones to enterprises
iOS/2 gear loaded with apps for big biz ... uh oh BlackBerry
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.