August 11, 2015 By Douglas Bonderud 2 min read

How does malware make it onto corporate systems? Most companies can easily spot common attack vectors such as dire warning messages riddled with external links or suspicious email attachments that demand swift action. But malicious actors aren’t resting on their laurels and are now targeting supposedly secure processes and services to deliver malware payloads. Topping the list is a new Windows update vulnerability that was showcased during the recent Black Hat conference. The problem stems from less-than-stellar simple object access protocol (SOAP) settings — here’s how to stay clean and safe.

An Unlikely Avenue

According to Techworld, U.K. firm Context Information Security broke the news of the vulnerability at Black Hat, demonstrating that it’s possible for “a user with low privileges to install software as if they were genuine parts of the Windows Update process on internal networks.” Techworld called the vulnerability “surprising,” and it’s no wonder: This type of automated, high-level recurring Windows process has long been seen as invincible since Microsoft has a vested interest in steering cybercriminals clear of these updates.

But there’s a problem. While all update packages are signed with a Microsoft signature that cannot be altered, it’s possible to inject malware by altering SOAP XML transmission metadata and making it seem as though there’s a legitimate Windows Server Update Services (WSUS) patch waiting for download. Attackers could also compromise third-party driver signatures and create fake updates, which in turn prompt familiar “searching for drivers” or “Windows update” dialogue boxes.

Properly executed, this kind of man-in-the-middle (MitM) attack appears entirely legitimate, prompting IT admins to download and install the supposed update across all network machines. Cybercriminals, meanwhile, gain the ability to execute arbitrary commands virtually undetected since admins don’t typically put Windows updates at the top of their security hit list.

Cleaning Up the Windows Update

Fortunately, there’s a straightforward solution to the problem: Use SSL-encrypted HTTPS delivery. While WSUS does support this feature, it’s not turned on by default, meaning companies need to do some leg work if they want to protect their update process. Microsoft suggests using SSL in its guidelines for WSUS but, according to Context, there is other defense in depth mitigation that the software giant could add to enhance security.

To check if they’re protected, admins need to examine registry keys. As noted by ITProProtal, any URL that doesn’t start with HTTPS is vulnerable; upgrading to HTTPS delivery negates the possibility of MitM attacks. It’s also worth noting that Windows 10 offers no inherent protection from this flaw since the Update Services server is the same regardless of Windows version. As a result, companies can’t afford to wait on making sure they’re protected, especially since Context just announced the vulnerability at the largest hacking conference in the world.

Here’s how it all shakes out: Using subpar SOAP settings for WSUS updates leaves businesses vulnerable to malicious infections. Staying safe means always using HTTPS for any kind of update service, no matter the source. Cybercriminals specialize in leveraging public trust in big names, hoping admins will turn a blind eye to updates from a reputable source. But common doesn’t mean clean; dirt now lives in the metadata.

More from

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything.But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists in…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its C2 communication mechanisms, which include misusing the Internet-of-Things (IoT) messaging protocol MQTT. WailingCrab, also known as WikiLoader, is a sophisticated, multi-component malware delivered almost exclusively by an initial access broker that X-Force tracks as Hive0133, which overlaps with TA544. WailingCrab…

Operationalize cyber risk quantification for smart security

4 min read - Organizations constantly face new tactics from cyber criminals who aim to compromise their most valuable assets. Yet despite evolving techniques, many security leaders still rely on subjective terms, such as low, medium and high, to communicate and manage cyber risk. These vague terms do not convey the necessary detail or insight to produce actionable outcomes that accurately identify, measure, manage and communicate cyber risks. As a result, executives and board members remain uninformed and ill-prepared to manage organizational risk effectively.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today