How does malware make it onto corporate systems? Most companies can easily spot common attack vectors such as dire warning messages riddled with external links or suspicious email attachments that demand swift action. But malicious actors aren’t resting on their laurels and are now targeting supposedly secure processes and services to deliver malware payloads. Topping the list is a new Windows update vulnerability that was showcased during the recent Black Hat conference. The problem stems from less-than-stellar simple object access protocol (SOAP) settings — here’s how to stay clean and safe.

An Unlikely Avenue

According to Techworld, U.K. firm Context Information Security broke the news of the vulnerability at Black Hat, demonstrating that it’s possible for “a user with low privileges to install software as if they were genuine parts of the Windows Update process on internal networks.” Techworld called the vulnerability “surprising,” and it’s no wonder: This type of automated, high-level recurring Windows process has long been seen as invincible since Microsoft has a vested interest in steering cybercriminals clear of these updates.

But there’s a problem. While all update packages are signed with a Microsoft signature that cannot be altered, it’s possible to inject malware by altering SOAP XML transmission metadata and making it seem as though there’s a legitimate Windows Server Update Services (WSUS) patch waiting for download. Attackers could also compromise third-party driver signatures and create fake updates, which in turn prompt familiar “searching for drivers” or “Windows update” dialogue boxes.

Properly executed, this kind of man-in-the-middle (MitM) attack appears entirely legitimate, prompting IT admins to download and install the supposed update across all network machines. Cybercriminals, meanwhile, gain the ability to execute arbitrary commands virtually undetected since admins don’t typically put Windows updates at the top of their security hit list.

Cleaning Up the Windows Update

Fortunately, there’s a straightforward solution to the problem: Use SSL-encrypted HTTPS delivery. While WSUS does support this feature, it’s not turned on by default, meaning companies need to do some leg work if they want to protect their update process. Microsoft suggests using SSL in its guidelines for WSUS but, according to Context, there is other defense in depth mitigation that the software giant could add to enhance security.

To check if they’re protected, admins need to examine registry keys. As noted by ITProProtal, any URL that doesn’t start with HTTPS is vulnerable; upgrading to HTTPS delivery negates the possibility of MitM attacks. It’s also worth noting that Windows 10 offers no inherent protection from this flaw since the Update Services server is the same regardless of Windows version. As a result, companies can’t afford to wait on making sure they’re protected, especially since Context just announced the vulnerability at the largest hacking conference in the world.

Here’s how it all shakes out: Using subpar SOAP settings for WSUS updates leaves businesses vulnerable to malicious infections. Staying safe means always using HTTPS for any kind of update service, no matter the source. Cybercriminals specialize in leveraging public trust in big names, hoping admins will turn a blind eye to updates from a reputable source. But common doesn’t mean clean; dirt now lives in the metadata.