2

I was wondering, a lot of software nowadays automatically connect to a server at launch to check for updates, even basic software, and, to my knowledge, this is a new trend. Before you had to download it all again from the website.

My guess is that some of them weren't designed with security in mind and simply check an FTP or non-SSL HTTP, thus allowing a pen-tester that succeeded his MitM to easily take control over the computers, assuming the user launched the software and accepted the update.

My question, thus, is: Is there someone out there that publicly keeps a list of those vulnerable softwares?

With a little work, it could be implemented into Metasploit in the same fashion as the Browser Autopwn was for an easy, fool-proof exploitation :

  1. redirect the query for an update
  2. check version of software
  3. create corrupted but working executable with higher software version
  4. Delivery

I know that the probability of success isn't great if you only have 1 rogue update server for a tiny program nobody uses, but if you have 1 rogue update server for all of them, that could be interesting.

Second question: is there a public tool that does the 4 points described above? (i know you would have to know how to communicate with each program, and that might be time consuming, but still).

Improve this question
2

Yes, there is a public list:

CVE is searchable. Here is a search for "MITM" over the last 3 years

As to your second question, I don't see the value - think of it as an effort vs goal calculation. If I was going to go to the effort of compromising an update server or changing a route, on the off chance that an update would be required, why would I not just attack the outdated server anyway?

Improve this answer
2
  • Thank you for the reply. Yes, i just didn't think of CVE because in my mind it has always been "reserved" to softwares that have reached a critical mass of users. My question was more oriented on small, often "cheap" software one can download for specific use (burning a disc, create a USB boot, read ebooks on the computer, typically what we can find on sites like download.cnet.com), that i think few people actually assessed. About the second question, i meant something else,eg: dns/arp/dhcp spoof on LAN and redirect to all update querys from client to local server that contains your exes.
    – zX8iqV
    Jun 6 '14 at 12:43
  • And i found (i actually knew its existence, but i forgot about it) the answer of the 2nd question: it's called Evilgrade. I'm going to add an answer for more visibility.
    – zX8iqV
    Jun 6 '14 at 12:44
0

I realize this isnt exactly an ansrwe to the question, but I have thought about this as well for a somewhat different reason.

If you are looking at a hardened environment this would provide you a foothold without needing to work through the firewall nearly as hard.

A lot of third party update checks require disabling anti malware, allowing the download of encrypted binaries, etc that weaken a firewalls analysis.

Assuming the use of DNS posioning (for a long enough time for both the check and download to run) it would even be possible to compromise software that is 100% up to date using the version bump mentioned by the OP.

Improve this answer
1
  • I didn't know about the third party update that needed AV disabling, that's interesting. This+unknown signature of the payload embedded in the exe should be effective as the user trusts the program he installed when it asks permission to modify the system. :)
    – zX8iqV
    Jun 6 '14 at 12:57
0

For the second question, Evilgrade does this (assuming you worked the MitM part) with a nice set of softwares.

but i haven't tested it yet & i don't know if it's up to date (no pun intended)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.