While speaking to a friend regarding protecting personal computers from ransomware, I mentioned that I use a limited user account with application white-listing via SRP (I am running Windows). He responded by telling me that it's just a feel good measure, because I still install updates (via Microsoft update) using admin credentials, and someone can use DNS hijacking to install a malicious update.

My question is, is this true? If not, are there any other known ways an attacker can access my computer (not counting password guessing) to install ransomware?

  • 1
    No, Windows updates are signed. You can't trick a Windows machine into downloading a malicious update by manipulating the download source via DNS hijacking. – Arminius May 23 '17 at 22:05
  • The MalwareBytes case comes to mind in terms of trusted third party apps installed that can be used to infect the host: securityaffairs.co/wordpress/44226/hacking/… – Ed Daniel May 23 '17 at 22:43
  • Plus, one thing you should know is you don't need to be logged in as admin on 'doze to action updating, you will just need to give the credz when it asks to install. – Ed Daniel May 23 '17 at 22:50
  • @EdDaniel And the difference is... – Ploni May 23 '17 at 23:03
  • @Ploni can you be more precise, please? Also, re: different attack vectors, this will illuminate:microsoft.com/en-us/security/portal/mmpc/help/… thus a challenge you have is ensuring the white-listed applications do not themselves become compromised and offer an attack vector, such as your browser: cvedetails.com/vulnerability-list/vendor_id-26/product_id-32367/…. Understanding how EKs (Exploit Kits) work would be a good investment of your time: youtube.com/watch?v=j1aBqoPine4 – Ed Daniel May 25 '17 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.