I was wondering, a lot of software nowadays automatically connect to a server at launch to check for updates, even basic software, and, to my knowledge, this is a new trend. Before you had to download it all again from the website.
My guess is that some of them weren't designed with security in mind and simply check an FTP or non-SSL HTTP, thus allowing a pen-tester that succeeded his MitM to easily take control over the computers, assuming the user launched the software and accepted the update.
My question, thus, is: Is there someone out there that publicly keeps a list of those vulnerable softwares?
With a little work, it could be implemented into Metasploit in the same fashion as the Browser Autopwn was for an easy, fool-proof exploitation :
- redirect the query for an update
- check version of software
- create corrupted but working executable with higher software version
- Delivery
I know that the probability of success isn't great if you only have 1 rogue update server for a tiny program nobody uses, but if you have 1 rogue update server for all of them, that could be interesting.
Second question: is there a public tool that does the 4 points described above? (i know you would have to know how to communicate with each program, and that might be time consuming, but still).