Keep in mind that I am not a security specialist or a networking specialist. I am a software developer dealing with this kind of software for the first time.
Our software is used to control user session on Windows computers. Users are assigned a workstation and get to use it for a finite period of time. Our software ensures that unauthorized users cannot use the computer and also that every user is kicked out after the allotted time runs out.
The software first runs a service, which is responsible for constantly checking that the software is running and launching it if it's not. The software itself displays a login screen and prevents bypassing the login. Once the user is logged in, a timer window persists, which shows the time left and allows the user to log out at any time. The software also helps manage printing but that's off-topic for now.
We want to be able to auto-update the software, ideally through the service. This auto-update feature is so that we can fix bugs on our end and not have system administrators go through the process of manually updating potentially hundreds of computers. This process is a real pain right now.
The issue that we're having is that it is possible for the user download software off the Internet or use a USB devices. The vast majority of our clients' computers are protected by automatic restore systems like Deep Freeze. So long term installation of malware is usually not an issue, except for our software, because it will need to update itself and will therefore be on an exclusion list.
We have worked around most issues (verification, download, etc.) however we cannot devise how to protect against MITM attacks that would involve software installed, even temporarily, on the computer in order to intercept the update and inject it with malware.
I know that software like Wireshark require the installation of Npcap (or WinPcap). Users will not have any administrative rights whatsoever so installation of additional protocols or networking drivers should be impossible.
Given that fact, is there any serious security issue with having our software self-update, as long as the computer and server are not compromised? Is there any way for a hostile user to intercept the update and inject malicious software and if so, how can we ensure this does not happen?
