Have You Updated Your computer's antivirus software today?have you configured your desktop to automatically download and install its security updates? Presumably your answer to these question is yes. But there is a problem with many updating systems,as a recent paper by three researches at the University of Massachusetts makes alarmingly clear. many Update systems, it seems, are themselves riddled with security vulnerabilities. In the paper, professor Kevin Fu shows that Update systems in popular software packages like McAfee Virus Scan and Mozilla Firefox can actually be used to take over a computer that's trying to update itself!
The so-called secure update problem is twofold, say the researchers. First and foremost, programs need to have some way of authenticating their updates to establish their legitimacy. But it is also critically important that programs have an authenticated connection to the update server.
THE CODE'S SOURCE
AN AUTHENTICATED UPDATE means that there is some way for the software doing the update to assure itself that the update is an authentic version from the intended source. Without authentication, a Clever attacker can arrange for the program doing the update to download and run an exploit instead.
IN PRACTICE, UPDATES should be authenticated with a digital signature they should should be signed with a private key. The matching public key should be embedded inside the application doing the update. Before the update is run, the application should verify the digital signature. If the signature doesn't verify, the update should be deleted.
The UMass researchers discovered that many programs don't authenticate their updates. That may not be so surprising-lots of software has security vulnerabilities, after all. But what is surprising is that among the products that didn't have digitally signed updates were McAfee Virus Scan and McAfee Virex, two antivirus, anti-malware programs. Exploiting the flaw is actually a lot easier than you might think. Most of these unsecured update systems simply go to a Web of FTP server, check the time stamp on the most recent file and download the file if it's new enough.
The address of the Server is usually hard-coded into the program doing the update, although occasionally it is stored in a configuration file. To exploit the flaw, all the attacker needs to do is send the program doing the update to a server that's run by the attacker. One way to send the program to the wrong website is with a DNS-based attack. Though signing updates with a digital signature doesn't prevent the hostile code from being downloaded, but it does prevent the code from being run. Unfortunately, this is only half the battle. Even if updates are signed, an attacker capable of intercepting DNS requests or diverting Internet traffic can still use an update service to take over an unsuspecting victim's computer.
Another way that an attacker can subvert the update process is to run an update server that always responds, "No updates today!" Clients will then connect, find no update and disconnect-and never know that they have been deceived. A well -placed attacker could prevent an entire organization from installing security updates for a period of time, then attack all vulnerable machines.
CONNECTION CHECK
TO DETECT SUCH attacks, the Client needs to authenticate not just the update itself but also the connection to the update server.
One way to do this is by having the client connect to the server using SSL; this assures the authenticity of the server's DNS name, assuming that the SSL client's built-in certificate authority certificates haven't been corrupted. A slightly more clever way to authenticate the server is to have it publish a signed message on a daily or hourly basis that reports the date of the most recent update.
The advantage of this approach is that the updates don't need to be downloaded with SSL and don't depend upon the public-key infrastructure. Updates could even be mirrored on unsecured public FTP servers.
Of course, an attacker who controls the Internet connection can simply prevent the client from reaching its update server entirely.
but in this case, the client will at least know that something is wrong. It might then notify its human operator or shut down refuse to operate until it can verify for sure that there are no new updates available.
The U Mass paper evaluated the update systems built into Apple's Mac OS, Microsoft Windows, Adobe Acrobat, Microsoft Office on the Mac, Mozilla Firefox, Fungu McAfee Virus Scan, McAfee Virex and Debian Linux.
None of the systems properly authenticated the connection between the update client and the update server at the time that the study was performed, although Windows Update and Mozilla Firefox made some attempt. The Problem here is that updates are becoming a more and more vital part of our information infrastructure. An increasing number of computers with embedded software including those in navigation systems., cell phones, and even implanted medical devices require regular software updates.
Indeed, a system that doesn't have provisions for taking software updates but potentially takes data from the outside world, risks catastrophic failure, for there is no way to fix a security vulnerability if one should be discovered. It would be far better if secure updates were a service provided by the operating systems on servers, desktops and cell phones.
Just as these platforms provided SSL and secure storage, they could also give developers a way to register for automatic version tracking and updating of their applications.
