81

This morning, I noticed that a new Windows update was offered to me. It looks very suspicious to me:

Malicious Windows update

Here are the update details:

gYxseNjwafVPfgsoHnzLblmmAxZUiOnGcchqEAEwjyxwjUIfpXfJQcdLapTmFaqHGCFsdvpLarmPJLOZYMEILGNIPwNOgEazuBVJcyVjBRL

Download size: 4,3 MB

You may need to restart your computer for this update to take effect.

Update type: Important

qQMphgyOoFUxFLfNprOUQpHS

More information:
https://hckSLpGtvi.PguhWDz.fuVOl.gov
https://jNt.JFnFA.Jigf.xnzMQAFnZ.edu

Help and Support:
https://IIKaR.ktBDARxd.plepVV.PGetGeG.lfIYQIHCN.mil

Obviously, this seems way too fishy to install, but I would like to know more. Has everyone received this update (Google only has a couple of hits for this)? Could this be an attack? Is there a way to download the update data without installing it?

I'm open to any ideas.

I'm running an Windows 7 Pro (64-bit).

As @Buck pointed out below, the update is no longer available through Windows Update. I'm not sure how this question will be resolved.

Improve this question
7
  • 1
    The information links looks like randomly generated domains which is a known behavior of botnets called Domain generation algorithm (DGA) used to hide the real controllers. However, the domains are NX (not registered) so either there was a data corruption, or I don't see a point. Did everybody get the same values in their updates or are these unique? (FYI, I can't post answers because it is protected)
    – Ehsan Foroughi
    Sep 30, 2015 at 16:14
  • Based on a Google search, it seems that at least some other people have received the exact same update (domains included).
    – executifs
    Sep 30, 2015 at 17:14
  • There's also a thread over on Answers about this.
    – Xander
    Sep 30, 2015 at 18:12
  • 4
    “We incorrectly published a test update and are in the process of removing it.“ – a Microsoft spokesperson
    – Xander
    Sep 30, 2015 at 18:58
  • The Register just issued this: theregister.co.uk/2015/09/30/windows_update_glitch
    – Hannah Vernon
    Sep 30, 2015 at 19:58

2 Answers 2

Reset to default
67

The official communication from Microsoft at this time:

“We incorrectly published a test update and are in the process of removing it.“ – a Microsoft spokesperson

I won't add commentary, but will update the answer as more information becomes available.

Improve this answer
8
  • 2
    For commentary one can see a news report: zdnet.com/article/…
    – Kevin Cathcart
    Sep 30, 2015 at 19:07
  • 2
    There's also an article about this on ARS: arstechnica.com/security/2015/09/…
    – executifs
    Sep 30, 2015 at 19:11
  • 4
    I won't add commentary either because it will get flagged as Microsoft-offensive otherwise. Wow. Just wow.
    – Deer Hunter
    Sep 30, 2015 at 19:32
  • 4
    I'll only dub this patch: "Move over to Windows 10 or else".
    – Deer Hunter
    Sep 30, 2015 at 19:35
  • 19
    @sebi: To be honest I suspect that Microsoft has an internal library with functions that can generate "random" strings, urls, numbers, etc. Such a library is really useful for certain fuzz testing applications, and just generating junk data to fill in required records you don't care about while testing. Since it is helpful if the URLs would pass any validation regexes, picking a random TLD from a list of known TLDs (such as the original handful of TLDs) would make good sense. I suspect such a library was used here, and all the URLs were generated like that.
    – Kevin Cathcart
    Sep 30, 2015 at 21:25
13

Yes, it seems very strange to include a .mil domain for an update for a commercial software product. I'm unable to reciprocate the issue, but you could run the specific update in a virtual machine, close all inbound and outbound connections on the host machine(and any possible running guest machines) and monitor the update through tcpdump/wireshark.

Then at least, you could check where the update is being distributed from. Afterwards, you could check the involved remote addresses against black lists as well as their location.

You could change the default download location of the update:

net stop wuauserv
mklink /j c:\windows\softwaredistribution d:\other\desired\location
net start wuauserv

and try to reverse engineer it.

Improve this answer
3
  • 5
    Strange to include a .mil, and a .gov, and a .edu...
    – Iszi
    Sep 30, 2015 at 15:36
  • Yep, out of place and eye catching.
    – Sebi
    Sep 30, 2015 at 15:42
  • 4
    @Iszi I think those specific TLDs are being used here for the reason that they are unregisterable for everyone but government or military agencies and educational institutions. That way nobody can register one of those domains if an update is say, published accidentally as happened in this case.
    – Austin Burk
    Oct 1, 2015 at 22:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .