Feeds

Security patch distribution – it's trojan time

Crackers could turn cure into disease

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

The way operating system vendors issue security patches is insecure, in many cases, and could let crackers exploit this to trick users into loading trojan horses onto their systems.

Security firm BindView, whose Razor team of security researchers completed the research, questioned 27 different vendors of commonly used products on whether patches are accompanied by digital signatures or other forms of cryptographic authentication. Its findings, available in full here, are a real eye-opener because they highlight glaring security gaps, not least that a minority of vendors, including Apple and Compaq, provide no authentication for their patches.

"A number of the vendors (including some Fortune 500 companies) do not offer patch authentication via any cryptographic method. This can make it very difficult for customers to verify that they have obtained a correct patch rather than a trojan horse," said Matt Power, of BindView's Razor security team.

"A trojan-horse patch might be stored on the vendor's server if that server were compromised by intruders," he added, a risk that has to be taken more seriously given the recent hack of Microsoft's network, and the defacement of web sites of security vendor Network Associates.

Power added that even if a vendor's server is not compromised, well-known weaknesses in Internet protocols can be exploited to deliver a trojan-horse patch to users.

Interestingly the research threw up an admission by Microsoft's Security Response Center that "no more than several thousand people have downloaded our PGP key". This means that only a very small number of users are checking the authenticity of bulletins.

Richard Stagg, senior security architect at Information Risk Management, said getting people to install trojan horses through deceiving people into believing they were security updates was "a standard hacking technique" which was "an extension of social engineering".

Attacks based on subverting security patches were not common, because they are difficult to arrange, but could potentially be "very bad" and extend into the inclusion of trojan horses into software available on CD-ROMs.

"Vendors have a duty to provide security patches, a pre-requisite to which is that there must be a straightforward method to validate the content. Its naive for vendors to expects users to automatically check patches," said Stagg.

"If it takes time to verify patches the instinct of most people will be to just grab a file and install it," he added. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.