Topics

Microsoft Update and The Nightmare Scenario

Microsoft Update and The Nightmare Scenario

2012-06-07
Source: F Secure


About 900 million Windows computers get their updates from Microsoft Update. In addition to the DNS root servers, this update system has always been considered one of the weak points of the net. Antivirus people have nightmares about a variant of malware spoofing the update mechanism and replicating via it.Turns out, it looks like this has now been done. And not by just any malware, but by Flame.

The full mechanism isn’t yet completely analyzed, but Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update or Windows Server Update Services (WSUS) system. If successful, the attack drops a file called WUSETUPV.EXE to the target computer.

This file is signed by Microsoft with a certificate that is chained up to Microsoft root.

Except it isn’t signed really by Microsoft.

Turns out the attackers figured out a way to misuse a mechanism that Microsoft uses to create Terminal Services activation licenses for enterprise customers. Surprisingly, these keys could be used to also sign binaries.....





Popular Posts

Previous


  • 2013-05-11
    Aikido Steven Seagal - The Path Beyond Thought


  • 2013-05-11
    2 Living ETs Working with US Government


  • 2013-05-12
    Top 5 Things You Should Know About Litecoin


  • 2013-05-11
    The Fascinating Life of An Orthodox Jewish Surfer


  • 2013-05-11
    How Women May Have Shaped Men’s Penises
Next

Related Posts

Like us on Facebook

Elsewhere in DazeNews

Like us on Facebook
1 1 1 1 1 1 1 1 1 1
Copyright © 2012 Dazenews.com
Share