Windows Server Update Services (WSUS) - can I pivot to a client machine?

Question

I'm considering setting up WSUS on a Server 2008 machine to push updates to my Windows 7 clients. If I do, I'll be following the hardening guidelines issued by MS (such as enabling SSL).

One thing I couldn't seem to find out (and apologies in advance if I have missed the relevant MS documentation!) is how the updates are signed. Obviously, the updates it downloads from MS onto the WSUS server are signed by MS, and verified by the WSUS server (right?) but does the client machine validate the certificate too, or are updates re-signed by the WSUS server for transfer to the client? Surely not, right?

My concern here is that an attacker with root on the WSUS server may be able to easily break in to all the connected machines, by sending a bogus update to them. Is this a valid concern, or does the client perform the same validation of updates as it would when downloading updates directly from Windows Update?

I'm not concerned, in this scenario, about MS's Windows Update key being compromised, and I'm also not concerned about an attacker on the WSUS box preventing updates from being pushed to clients.

Also, the client machines are not joined to an AD domain, if that is relevant. Configuration is done locally on each client.

Thanks.

Answer 1

Okay, I've done some investigation on this one. I still can't find any word from MS about it - presumably they feel it's such an obvious thing to do that it needs no such assertion.

Examining the WindowsUpdate.log file suggests that signature checking is taking place, and examining the wuaueng.dll file with a debugger verifies this. Windows update will reject images signed by someone other than MS.

I've done a blog post containing the gory details - http://strange.systems/a-quick-check-that-windows-update-validates-updates-against-mss-certificate.