10

Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi?

Obviously good news: you get the latest security tweaks.

Possible bad news: just how likely is it that you've opened up path for malware to get into the heart of the machine?

Improve this question
0

2 Answers 2

Reset to default
12

In this document explaining Windows Update from 2008 (a bit outdated, but you get the idea), it is stated in the Security Protections section that:

  1. Windows Update uses the Secure Socket Layer (SSL) protocol to send and receive information. SSL is used to encrypt the information being transferred, prevents hackers from tampering with information being transferred, and verifies that the Windows Update agent is transferring data from an authorized Microsoft server.
  2. Each update is individually signed using the Secure Hashing Algorithm (SHA-1). This technology allows Windows Update to confirm that the update has been downloaded correctly and hasn’t been changed by anyone. The update signature is also compared to information in the update metadata that was previously downloaded.
  3. Windows Update also checks for the certificate associated with each update. This certificate provides a means for Windows Update to validate the source of each update. Currently Windows Update will only install updates that have certificates issued by Microsoft or other providers that are trusted by Microsoft.

Therefore, you should not be worried about downloading Windows Update on a public Wi-Fi unless the security provided by Windows itself is broken.

Improve this answer
10
  • 1
    Although SHA-1 is being deprecated...
    – Deer Hunter
    Commented Sep 18, 2014 at 16:53
  • 7
    @DeerHunter Deprecated, but not broken.
    – Xander
    Commented Sep 18, 2014 at 16:56
  • 5
    @DeerHunter In this case the collision weakness of SHA-1 (which made it deprecated for certs) doesn't matter, as the updates only come from microsoft.
    – user10008
    Commented Sep 18, 2014 at 17:07
  • 2
    It checks the SHA-1 hashs only against the metadata it received earlier over the same channel, so this step doesn't add much security anyway. However, the steps 1 and 3 are additional security layers which are independent from this, and either one alone would be enough to make the update secure, even when over a completely untrusted connection.
    – Philipp
    Commented Sep 18, 2014 at 17:45
  • A DNS based attack on a compromised access point might defeat #1, but #3 would still protect you. Unless they use some sort of certificate pinning, which on second thought is pretty likely. So a DNS attack would probably not affect #1 either.
    – ntoskrnl
    Commented Sep 18, 2014 at 19:32
3

Unless the bad guys have the keys used to authenticate updates, you are OK. If the bad guys can break or cajole Microsoft, you are likely already compromised.

The situation gets weird when the bad guys are able to track Microsoft's critical patches, and reverse-engineer them.

There is one attack vector that may be used: blocking access to Windows Update servers while exploiting the remote vulnerability that the updates were supposed to patch.

After they install the rootkit on your machine, the patch may be allowed to proceed. This method relies on high numbers of compromised routers and rather sophisticated attackers who aren't content with password phishing.

To answer your question directly: being abroad does increase the risk, since you are by definition visiting many places where you haven't been before. Hotel chains are known to be compromised.

Improve this answer
2
  • While true, this doesn't answer the question at all.
    – Xander
    Commented Sep 18, 2014 at 17:24
  • @Xander - kind of fixed.
    – Deer Hunter
    Commented Sep 18, 2014 at 17:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .