How does malware make it onto corporate systems? Most companies can easily spot common attack vectors such as dire warning messages riddled with external links or suspicious email attachments that demand swift action. But malicious actors aren’t resting on their laurels and are now targeting supposedly secure processes and services to deliver malware payloads. Topping the list is a new Windows update vulnerability that was showcased during the recent Black Hat conference. The problem stems from less-than-stellar simple object access protocol (SOAP) settings — here’s how to stay clean and safe.

An Unlikely Avenue

According to Techworld, U.K. firm Context Information Security broke the news of the vulnerability at Black Hat, demonstrating that it’s possible for “a user with low privileges to install software as if they were genuine parts of the Windows Update process on internal networks.” Techworld called the vulnerability “surprising,” and it’s no wonder: This type of automated, high-level recurring Windows process has long been seen as invincible since Microsoft has a vested interest in steering cybercriminals clear of these updates.

But there’s a problem. While all update packages are signed with a Microsoft signature that cannot be altered, it’s possible to inject malware by altering SOAP XML transmission metadata and making it seem as though there’s a legitimate Windows Server Update Services (WSUS) patch waiting for download. Attackers could also compromise third-party driver signatures and create fake updates, which in turn prompt familiar “searching for drivers” or “Windows update” dialogue boxes.

Properly executed, this kind of man-in-the-middle (MitM) attack appears entirely legitimate, prompting IT admins to download and install the supposed update across all network machines. Cybercriminals, meanwhile, gain the ability to execute arbitrary commands virtually undetected since admins don’t typically put Windows updates at the top of their security hit list.

Cleaning Up the Windows Update

Fortunately, there’s a straightforward solution to the problem: Use SSL-encrypted HTTPS delivery. While WSUS does support this feature, it’s not turned on by default, meaning companies need to do some leg work if they want to protect their update process. Microsoft suggests using SSL in its guidelines for WSUS but, according to Context, there is other defense in depth mitigation that the software giant could add to enhance security.

To check if they’re protected, admins need to examine registry keys. As noted by ITProProtal, any URL that doesn’t start with HTTPS is vulnerable; upgrading to HTTPS delivery negates the possibility of MitM attacks. It’s also worth noting that Windows 10 offers no inherent protection from this flaw since the Update Services server is the same regardless of Windows version. As a result, companies can’t afford to wait on making sure they’re protected, especially since Context just announced the vulnerability at the largest hacking conference in the world.

Here’s how it all shakes out: Using subpar SOAP settings for WSUS updates leaves businesses vulnerable to malicious infections. Staying safe means always using HTTPS for any kind of update service, no matter the source. Cybercriminals specialize in leveraging public trust in big names, hoping admins will turn a blind eye to updates from a reputable source. But common doesn’t mean clean; dirt now lives in the metadata.

More from

Data Privacy: How the Growing Field of Regulations Impacts Businesses

The proposed rules over artificial intelligence (AI) in the European Union (EU) are a harbinger of things to come. Data privacy laws are becoming more complex and growing in number and relevance. So, businesses that seek to become — and stay — compliant must find a solution that can do more than just respond to current challenges. Take a look at upcoming trends when it comes to data privacy regulations and how to follow them. Today's AI Solutions On April…

Why Zero Trust Works When Everything Else Doesn’t

The zero trust security model is proving to be one of the most effective cybersecurity approaches ever conceived. Zero trust — also called zero trust architecture (ZTA), zero trust network architecture (ZTNA) and perimeter-less security — takes a "default deny" security posture. All people and devices must prove explicit permission to use each network resource each time they use that resource. Using microsegmentation and least privileged access principles, zero trust not only prevents breaches but also stymies lateral movement should a breach…

5 Golden Rules of Threat Hunting

When a breach is uncovered, the operational cadence includes threat detection, quarantine and termination. While all stages can occur within the first hour of discovery, in some cases, that's already too late.Security operations center (SOC) teams monitor and hunt new threats continuously. To ward off the most advanced threats, security teams proactively hunt for ones that evade the dashboards of their security solutions.However, advanced threat actors have learned to blend in with their target's environment, remaining unnoticed for prolonged periods. Based…

Third-Party App Stores Could Be a Red Flag for iOS Security

Even Apple can’t escape change forever. The famously restrictive company will allow third-party app stores for iOS devices, along with allowing users to “sideload” software directly. Spurring the move is the European Union’s (EU) Digital Markets Act (DMA), which looks to ensure open markets by reducing the ability of digital “gatekeepers” to restrict content on devices. While this is good news for app creators and end-users, there is a potential red flag: security. Here’s what the compliance-driven change means for…