Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In my chrome browser if I google for Windows Update the first hit is

windowsupdate.microsoft.com/‎

When I click on it I am redirected to

http://www.update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5

Now this to me looks like my machine has been hijacked and somebody with bad graphics ability has redirected my page to this dodgy graphic telling me to use windows update.

However I cant find details anywhere. On some other machines I get a different (slightly more proffessional looking) page.

Can anyone tell me if this is a spoof page due to malware or virus on the machien. My norton isn't showing anything?

share|improve this question
1  
Yup, it's legitimate. –  Xander Jul 17 '13 at 17:14

2 Answers 2

up vote 5 down vote accepted

This is a genuine Microsoft Update site. If you go to any Microsoft KB article you'll see the link in the INTRODUCTION section (example). All old Windows Update addresses such as windowsupdate.microsoft.com and windowsupdate.com now redirect to the new update.microsoft.com.

The new domain seems to be a policy of unifying the update site for Microsoft's products under one name: Microsoft Update. As for the bad graphics and malware suspicions, a malware wouldn't really tell you to use a Microsoft application to update system. A malware usually tells you to click on shady links or asks you to download some "update helpers".

share|improve this answer

To complete what @Adnan says: yes, the page is legitimate, however, it is an HTTP-only page, so it could potentially be hijacked (without HTTPS, attackers have ways to present you with fake pages), although it is rather unclear what an attacker could gain that way. Either way, using the menu entry to reach the update site is safe from external interference (or, at least, as safe as these things can be).

As for graphics abilities... well, even Microsoft designers are not necessarily tasteful.

share|improve this answer
    
I'm not sure what's "unclear" about what an attacker would hope to gain by spoofing Windows Update. They could be wanting to re-direct the user to a malicious page hosting browser exploits, phish a user for data and/or credentials by claiming Windows Update requires registration, or simply trick them into downloading and running a fake update, etc. I suppose the only thing "unclear" to me is which among the plethora of options a random attacker might choose. –  Iszi Jul 17 '13 at 23:32
    
Well, isn't it s clear "gain" to be able to present a fake list of updates to download, and let the user download malware instead? –  TheBlastOne Jul 17 '13 at 23:35
    
and @Iszi hits again. Thomas is saying it's unclear what the attacker could gain by highjacking the page and telling you to use the official Windows Update application on your computer. That's what is unclear. Clear for you now? –  Adnan Jul 18 '13 at 8:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.