Tool for hijacking application update sessions to be demonstrated at hackers conference

By William Jackson

Connecting state and local government leaders

| July 31, 2009

Security company Radware is releasing the tool to demonstrate the vulnerabilities of software updates done over insecure public networks.

Authentication

“Most applications today support an update feature,” said Itzik Kotler, Security Operation Center team leader. When online, they automatically open an http connection to the vendor site to request updates, and then prompt the user to approve the download. “You will check ‘yes’ because you are expecting it to download a file.”But in an unsecured environment such as a public WiFi network, the user can be subject to a man-in-the-middle attack that can hijack the session, direct it to an alternative site and download malicious software.Kotler and Tomer Bitton, a security researcher at Radware, will demonstrate this attack and release a tool to build and inject false update replies at the DEFCON hacker convention, a sister event to the Black Hat Briefings, being held this weekend at the Riviera Hotel and Casino.Kotler said the release of the tool is intended to spur better security for applications and for network infrastructures. “There is a need for continued education on emerging online and network security threats,” he said.The attack has not yet been seen in the wild, but relatively few vendors protect against it by digitally signing software updates. An incomplete survey of applications found more than 100 that are vulnerable to hijacking on unsecured networks, Kotler said.“This is a fundamental flaw of http,” he said. “It does not tell you where you are really going.” Update features depend on the security of the infrastructure to ensure that the connection is reliable.“We have an assumption that the network is reliable and secure,” he said. This might be true within an enterprise, but mobile devices increasingly are being used on wireless connections over WiFi in public places, where sessions are subject to sniffing by nearby devices.“It can hijack your antivirus update,” and download code that could disable an antivirus engine or block a signature for a specific piece of malicious code, Kotler said. “It can also turn the victim into an attacker,” with commands to sniff for other wireless sessions in the area.The solution against an update attack is for vendors to digitally sign updates and make the public key available to browsers so that the code can be verified before they are executed and the application “won’t run just anything,” he said. Only a relatively small handful of companies are signing updates now, but they include some of the largest vendors, including Microsoft, Sun’s Java and Google.“This is an investment that vendors need to make to protect their customers,” Kotler said. He said he planned to approach vendors prior to his presentation on Saturday to inform them of the exploit and the need for protecting updates. Until signing becomes common, mobile users should use caution when outside of the enterprise. “When you go to an insecure network, you should consider all of the potential outcomes.”

LAS VEGAS—Automatic software updates can provide patches to fix security flaws and introduce new features on installed applications, but they also can expose mobile computers to malicious code, say researchers from the application security firm Radware.

More news from the Black Hat Briefings:

Security pro calls for replacement of digital certificate standard

Microsoft calls for united front in war against malware, hackers

Microsoft program to help quantify costs, risks, returns of patch management

New tool could help computer forensics move off the disk and into memory

New weapon revealed for defense against zero-day attacks

NEXT STORY: New metrics needed for cloud computing

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies