Feeds

Security patch distribution – it's trojan time

Crackers could turn cure into disease

  • alert
  • submit to reddit

Security for virtualized datacentres

The way operating system vendors issue security patches is insecure, in many cases, and could let crackers exploit this to trick users into loading trojan horses onto their systems.

Security firm BindView, whose Razor team of security researchers completed the research, questioned 27 different vendors of commonly used products on whether patches are accompanied by digital signatures or other forms of cryptographic authentication. Its findings, available in full here, are a real eye-opener because they highlight glaring security gaps, not least that a minority of vendors, including Apple and Compaq, provide no authentication for their patches.

"A number of the vendors (including some Fortune 500 companies) do not offer patch authentication via any cryptographic method. This can make it very difficult for customers to verify that they have obtained a correct patch rather than a trojan horse," said Matt Power, of BindView's Razor security team.

"A trojan-horse patch might be stored on the vendor's server if that server were compromised by intruders," he added, a risk that has to be taken more seriously given the recent hack of Microsoft's network, and the defacement of web sites of security vendor Network Associates.

Power added that even if a vendor's server is not compromised, well-known weaknesses in Internet protocols can be exploited to deliver a trojan-horse patch to users.

Interestingly the research threw up an admission by Microsoft's Security Response Center that "no more than several thousand people have downloaded our PGP key". This means that only a very small number of users are checking the authenticity of bulletins.

Richard Stagg, senior security architect at Information Risk Management, said getting people to install trojan horses through deceiving people into believing they were security updates was "a standard hacking technique" which was "an extension of social engineering".

Attacks based on subverting security patches were not common, because they are difficult to arrange, but could potentially be "very bad" and extend into the inclusion of trojan horses into software available on CD-ROMs.

"Vendors have a duty to provide security patches, a pre-requisite to which is that there must be a straightforward method to validate the content. Its naive for vendors to expects users to automatically check patches," said Stagg.

"If it takes time to verify patches the instinct of most people will be to just grab a file and install it," he added. ®

Website security in corporate America

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
'People have forgotten just how late the first iPhone arrived ...'
Plus: 'Google's IDEALISM is an injudicious justification for inappropriate biz practices'
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.