Malware delivery via automatic software updates. An interesting case was published by Volexity experts. Let’s say you have some software on the host. It periodically goes online to check for updates and then installs them… And instead of updating, malware is installed. 😱👾
And this is NOT a case of a compromised software vendor website. 🙂
To achieve this result, the StormBamboo bad guys carried out a DNS poisoning attack at the Internet service provider (ISP) level. The attackers changed the responses to DNS queries for certain domains. Accordingly, the “update” was downloaded from the IP addresses of the villains. 😈
Naturally, for this trick to work, the software must use insecure update mechanisms: connect via HTTP, do not check installer digital signatures, etc. 🤷♂️ Volexity mentions an attack via 5KPlayer media player updates. The victims were infected with MACMA and POCOSTICK / MGBot malware.
Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.
А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.