3

In my chrome browser if I google for Windows Update the first hit is

windowsupdate.microsoft.com/‎

When I click on it I am redirected to

http://www.update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5

Now this to me looks like my machine has been hijacked and somebody with bad graphics ability has redirected my page to this dodgy graphic telling me to use windows update.

However I cant find details anywhere. On some other machines I get a different (slightly more professional looking) page.

Can anyone tell me if this is a spoof page due to malware or virus on the machine. My Norton isn't showing anything?

|improve this question
  • 1
    Yup, it's legitimate. – Xander Jul 17 '13 at 17:14
8

This is a genuine Microsoft Update site. If you go to any Microsoft KB article you'll see the link in the INTRODUCTION section (example). All old Windows Update addresses such as windowsupdate.microsoft.com and windowsupdate.com now redirect to the new update.microsoft.com.

The new domain seems to be a policy of unifying the update site for Microsoft's products under one name: Microsoft Update. As for the bad graphics and malware suspicions, a malware wouldn't really tell you to use a Microsoft application to update system. A malware usually tells you to click on shady links or asks you to download some "update helpers".

|improve this answer
  • any proof of this? – 2xMax Feb 7 '15 at 18:46
  • 5
    @2xMax You want a proof that *.microsoft.com domains are legitimate Microsoft domains? – Adi Feb 7 '15 at 19:06
  • I was unsure that windowsupdate.com is a valid ms domain since only indirect pages like this support.microsoft.com/en-us/kb/2792100 provided the information about this host. I expected to see something like an msdn article with the full list of WU domains. – 2xMax May 12 '16 at 15:47
4

To complete what @Adnan says: yes, the page is legitimate, however, it is an HTTP-only page, so it could potentially be hijacked (without HTTPS, attackers have ways to present you with fake pages), although it is rather unclear what an attacker could gain that way. Either way, using the menu entry to reach the update site is safe from external interference (or, at least, as safe as these things can be).

As for graphics abilities... well, even Microsoft designers are not necessarily tasteful.

|improve this answer
  • 2
    I'm not sure what's "unclear" about what an attacker would hope to gain by spoofing Windows Update. They could be wanting to re-direct the user to a malicious page hosting browser exploits, phish a user for data and/or credentials by claiming Windows Update requires registration, or simply trick them into downloading and running a fake update, etc. I suppose the only thing "unclear" to me is which among the plethora of options a random attacker might choose. – Iszi Jul 17 '13 at 23:32
  • 1
    Well, isn't it s clear "gain" to be able to present a fake list of updates to download, and let the user download malware instead? – TheBlastOne Jul 17 '13 at 23:35
  • and @Iszi hits again. Thomas is saying it's unclear what the attacker could gain by highjacking the page and telling you to use the official Windows Update application on your computer. That's what is unclear. Clear for you now? – Adi Jul 18 '13 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.