Slashdot Mirror
Malware Hijacks Windows Update
clickclickdrone writes "The BBC are reporting a new piece of malware is in the wild that can hijack Windows Update's functionality and bypass firewalls allowing it to install malicious code on users PCs. The new code was discovered by Frank Boldewin in an email. The attack utilizes the BITS system."
...son of a BITS.
FLR
Sheesh, evil *and* a jerk. -- Jade
I would've sworn ZoneAlarm flagged Windows Update attempts. I guess I need to double check when I get home.
"It is a miracle that curiosity survives formal education." -Albert Einstein
14 new virusses have just been installed
please restart your machine to become a zombie
. . . why didn't this happen before?
Did it happen before and just now somebody found out?
Ah! One of the many Microshite's patents that didn't manage to make it into the Linux sourcecode. Perhaps Novell could implement this feature?
Frank Boldewins site is http://www.reconstructer.org/, not http://www.reconstruction.org/.
With a lot of people doing auto-updates might as well target what will be the predictable weak link. I'd bet some people have their auto-update run more often then their virus scanners anways.
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
What is a DDoS attack?
A: Guerilla activism by open source software advocates in which they uninstall Windows on a PC and replace it with Linux
That's one botnet I'd happily join
Any sufficiently advanced bug is indistinguishable from a feature.
Hi,
I have my own awesome blog whose url I certainly don't need to post here since I expect you all to know it already.
I just talked with my friends at Microsoft and they told me that
"Windows is safe!"
and it seems ridiculous to care about such small issues when 9/11 was only 6 years ago. You people should really step aside and look at the things from another perspective.
Maybe from above like the Lord does.
I rather go to church and pray to the Lord for less terrorists than being part in this smear campain against the blessed world leader of IT.
Bill and Melinda think of the children. Do YOU?
I've come to the conclusion that reformed ministers in Japan do moonlight as malware/bug/virus hunters. Too bad I couldn't find anything on his site tho :)
Also, Brian Krebs' blog has an informative post on the phenomenon.
Email came from reconstructer.org NOT reconstruction.org. The latter is a religious site.
www.tomandemily.com
http://www.tomandemily.com
Please, proof your links when posting. the "discovered by Frank Boldewin" link takes you to http://www.reconstruction.org/, a "christian reconstruction" website instead of the proper http://www.reconstructer.org/ (Frank Boldewin website).
Granted, TFA links to the proper website while displaying "reconstruction.org". Still...
That's not a nick, that's my NAME.
Yes, it makes life a little easy for the hackers, after they have compromised your system. But all users whitelist their browsers in their firewall software to make outbound connections. So in what way is it more dangerous than the virus using IE (or Firefox for that matter) to download more bad stuff into the computer? Once the machine is compromised, it can use even ftp to download stuff. Dont blame ftp or Firefox or IE. Blame the OS that allows the machine to be compromised so easily.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The good news is that it only installs the malware if you're running Genuine windows.
It sounds from the article (yes, I read it, no, I'm not new here...) like surfing to a malicious website will cause this BITS background downloader to then pull in additional firewall-bypassing malware right at that time.
If I only ever do manual updates on windows, by manually surfing to windowsupdate.com, am I at risk for this? It's not actually necessary to run BITS in order to keep a Windows system up to date.
Also, it's not clear from TFA whether this can be stopped by privilege separation -- if I'm surfing as a low-priority user and hit this malware, can it still make BITS do the more-malware download?
2*3*3*3*3*11*251
Is your Windows Update not infected yet? Click here to infect it!
This guy's the limit!
If you were all using Linux or OS/X, you could watch this catastrophe with detached amusement instead of butt-clenching fear.
Me, I'm relaxed and enjoying a soda.
NO CARRIER
It should be pointed out that malicious code needs to already be running on the host machine to use this.
However, I've never found anything more specific -- does anyone know the consequences of disabling BITS?
...infected machine!! Man who knew that would be even possible?
and yet, people still believe this crap - that MS is only hit far more often per install because it's a more tempting target due to numbers alone, not lack of security as part of the design process.
Eh. What can ya do.
Dear Sirs,
Your Trojan, named 1337-5ki11z, violates 387 Microsoft patents, included patent 666-1345-876-666 ("screwing the user over"). We do not wish to actually pursue legal action, but would rather license our Windows Update APIs to you for the paltry sum of 100.00 (per infection).
Thank You
Kindly,
The MS Legal Eagles
Its not really Windows Update that's being used in this exploit, its the Background Intelligent Transfer Service which, in a nutshell, is a service that downdaloads data to your PC while minimising disruption to other network activity i.e. surfing the net, gaming, or downloading other files. Its a built-in feature of Windows XP but has only been implemented once or twice.
Windows update makes use of the BITS service. Malware can make use of the BITS service. Its not logical to then say that Malware is exploiting Windows update. Any more than an attack that utilised Java would be exploiting Azureus (A java application).
The reason malware utilising BITS is a problem is because with any application-level firewall, permission for BITS to access the net is already granted and so unlike a regular trojan, the firewall won't spit a potentially suspicious permission request up when it tries to download more malware from the 'net. This same exploit is true of the JVM too.
A solution to the problem might be to instance such services. But by doing that it sort of renders them not services anymore.
So eh, mark my stats +1 pedantry, but to perpetuate this as a Windows Update exploit isn't accurate.
Actually, once a system is infected with a Trojan, it can open up avenues for other attacks. This can happen to any machine, regardless of whether it's running Windows or Linux or OSX.
and everything except automatic updates works (which is what I want). However, to manually update windows, you still must enable automatic updates, since updater ActiveX control checks is the service is set to run automatically and actually running.
Automatic Updates service depends on BITS, so you have to start both and change their startup type to Automatic, at least temporarily until you finish with the manual updates.
I have (an MKS) Korn Shell script that does this before I do manual updates and sets them back to disabled after the update.
As the island of our knowledge grows, so does the shore of our ignorance.
I've always been curious (not enough to do the research I guess) what kind of security the windows update does to prevent someone from using control of DNS and or routers to get windows update to install malware. Given that people often use DNS and routers that the cannot really trust, is there something that prevents a bad guy from just redirecting all traffic that is attempting to hit MS's update site to their their own server that is set up to look like it is MS's update site? Given how many people have their laptops set up to do automatic updates, I would think that it would be easy to just take a loptop to a coffee shop, and watch as other patrons 'update' from your access point.
Are you still infected with those old fashioned beagle or Zotob viruses? Now, with our new Windows Virus Updates, you no longer have to worry about being the loser with old variants on your machine. You will get the newest, most zombie-rific viruses the wild web has to offer. All for, you guessed it, FREE. Windows will automatically update your viruses to the most virulent forms of code out there. Be sure and upgrade TODAY!!
Crap, I forgot to say "I know I'll get modded down for this" first.
Kwisatz Haderach
Sell the spice to CHOAM
This Mahdi took Shaddam's Throne
Spammers and botmasters the world over want to know.
If you mod me down, I shall become more powerful than you could possibly imagine.
I've had more than enough with malware writers. They are absolutely useless to polite society. 10 years in jail and a life-time ban against ever touching another computer on the first conviction.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
BITS stands for "Background Intelligent Transfer Service" and is simply a way to download files using idle bandwith. It's fully documented in MSDN, see http://msdn2.microsoft.com/en-us/library/aa362708. aspx, and among many things it's used by some browser downloading plugins (similar to DownloadThemAll) that enhance downloading of large files. It's not just used by Windows Update.
Do we need additional articles to state that a malicious program on a compromised machine could use FTP to download additional files? Or HTTP? Or BitTorrent? Or roll their own protocol?
Based on the article, it sounds like the only concern is that because BITS is a service (daemon in the Unix world), it means that firewalls or malware detection tools that attempt to block outgoing requests (which most don't; they block listening ports) may not currently detect this because it's not the malicious .EXE itself that's opening a port; it calls into BITS, which opens the port. However, the app still has to use a public API to instantiate the BITS object, so there's no reason such a program couldn't hook that as well.
Unfortunately the article summary (and headline of the BBC article!) completely misrepresents the issue and blows it way out of proportion. They are not Hijacking Windows Update. They're using a generic well-documented downloading service that also happens to be used by Windows Update simply because it enables WU to download updates without gobbling up all your bandwidth.
The problem isn't BITS. The problem is the idea that BITS is "trusted". Should you trust every FTP server your computer connects to? Every HTTP server? Of course not. Then why BITS?
The Windows firewall model of "trust this program" is inherently incorrect, and that's the real source of this issue. I really hate to say it, but Internet Explorer gets this right - programs aren't trusted, places you can connect to are trusted.
MSFT will sue the spyware authors for breaching Microsoft patented technology.
I'm sitting here on Windows chuckling over so called geeks that don't understand the issue at hand. If a computer is compromised, then the software firewall can be disabled. The BITS stream that comes out of the comp can be emulated by software on Linux and Mac OS, to the same effect as Windows.
The "news" here is that there is software capable of doing this, not that it can't be done. True, BITS is a protocol created to work around firewalls, but it is hardly the only protocol engineered to do that.
Oh, and Mac's suck because they crash all the time. *ducks*
How will your computer work?
Tsunami -- You can't bring a good wave down!
Singling out "BITS" is stupid. The exact same thing can be done with virtually any service or application that is allowed to pass through the local outgoing software firewall. As long as the software has some kind of programmatic interface, it can easily be used to bypass these firewalls.
I wrote a proof of concept application that bypassed all of the major outgoing software firewalls (BlackIce, Zonealarm, McAfee, Symantec) by utilizing the COM interfaces for Internet Explorer and funneling all my requests through it. This is almost impossible to detect. Even better, I wrote this app in freakin' VB!
The real problem is that local outgoing software firewalls simply don't work in an environment where all the users are admin. Once the machine is compromised, it's compromised. No number of software defenses are going to help. This includes, by the way, Symantec's expensive and incredibly crappy products. These products are there to make users feel secure, not actually make them secure.
Remember WordMasters from grade school? You know, the analogy test they used to give every once in a while. Here is an analogy for you:
Symantec is to computer security as the Bush Administration is to homeland security.
They do their best to scare the crap out of people in an attempt to get them to buy their software... or vote for their party. Don't trust either of them and you'll be better off.
No, I don't agree.
No matter what, buggy drivers, compromised machine, spilled coffee, you can always count on your trustworthy old friend, mister Blue-Screen©® !
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
I don't know why the parent has been modded flamebait; s/he makes an excellent point; especially about Symantec.
m ent-32657, an explot that gives an attacker "full access to the system". A little lower down, it is noted that the attack "requires... administrator [privileges]", but goes on to say that "a determined attacker can always find workarounds". WTF??? It's an attack the purpose of which is to malware running with admin privileges, that... requires admin privileges. Right. Sure. (He's torn apart in the comments).
Mcaffee do it to -- have a look at http://www.avertlabs.com/research/blog/?p=218#com
What's purple and commutes? An Abelian grape.
Mac OS X open source? Snorts again. Sure, the kernel is open source but only Apple maintains it anyway.
Being 'the computer guy' I've been pulled along for free tech support more often than I would like, and I know that Linux, Windows and even the glorious Mac OS X all have their issues. One thing I can say with absolute certainty is that if I owned, say, a PowerMac and a real deal Windows vulnerability cropped up I would _not_ feel smug about it.
What is humorous is people like you, feeling good because you use an alternate OS. You're treating operation systems like religions. Not that having an OS as a religion is any less stupid than being religious. *ducks*
It should be possible to delete your own posts, or at least moderate them down. I apologize for losing my cool.
I just wanted to say it amuses me when people get emotional over operation systems. This is true for both Windows and non-windows users alike; I recall several Winlots being on cloud 9 when that Mac scripting error deleted a bunch of files.
I'm probably also guilty of being amused by others misery at one time or another.
No, all you would need to do is set up an open wifi access point. You would in essence be the ISP, and you would control the DNS for any system that was getting their DNS server via DHCP. This wouldn't be a way to hack into someones home PC. It would be a way to compromise a system that attached to your open wifi.
Getting users to go through your router and use your DNS isn't the hard part. The only question would be is, does windows update do any kind of authentication that would prevent me impersonating Microsoft's site.
BITS =
Background Infection Transfer Service,
Bad Idea Turned Sideways (ouch),
Bad Idea Taken Seriously,
Bent-over Intrusion Thrusting Skillfully (yeeha!/ouch!).
Better Infections Than Sony.
So with animated characters (dog, clippy) I suppose you can say that Microsoft included all the
"BITS and Bobs" possible in Windows.
Have you read the moderator guidelines? Well, have you, PUNK? (and I want a Karma: Gnarly option)
My God, that's the root of all evil.
Anyway, while anecdotes are fun, they don't prove much of anything. I got an anecdote myself, I've only been troubled by malware twice. One when my mom installed it just when it became popular, and twice when I deliberately installed it myself to see what the fuzz was about.
What conclusions can I draw from this? Nothing.
As for Norton Internet Security, that program is undiluted evil (From my anecdotal experience). You can't just disable it; it has to be uninstalled... preferable with holy water.
These days most computer problems (in my anecdotal experience) resolve around crappy access points that's so cheep the manufacturer can't afford a website, but at the same time can't be replaced because it's supplied by the telco. Crud. That and small children ripping out cables.
It's still surprises me when people who can fix cars and leads troops can't plug in a USB cable. Sigh. Sincerely doubt going Linux/OS X will help with those issues.
As for feeling smug. If using Mac/Linux/whatever make you feel smug, then perhaps you're on to something. Whatever works I say. I don't feel smug about using Vista or XP, though Win 3.0 give me a nostalgia kick Oh yeah!
BITS sounds almost like snarf, where it resumes its download. I think I remember using snarf before windows had a windows update.
Only 'flamers' flame!
Does slashdot hate my posts?
One of my biggest complaints about Windows and OS X is the lack of decent universal package management. Basically, Apple's Software Update is great, for Apple software only. Microsoft Update is great, for MS software only, assuming your version of Office is recent enough. If you want anything else to auto-update, you have to provide your own auto-update mechanism (like Java/Firefox/etc does), and the user may or may not pay attention, even if they follow Microsoft Updates religiously.
And it's a hassle either way, because many of them will want you to reboot for no good reason, and may or may not ask nicely before doing so.
That's the ones that auto-update at all. There are quite a few that don't -- for instance, the nvidia drivers. Here, you have to go manually check each app (or driver) for an update.
Compare that to Ubuntu/Kubuntu: One system-tray icon. Click it and you'll download/install updates for every single app installed on your system. Afterwards, it will automatically restart the services that it figures it can restart without asking you, and then tell you what else you should do -- if there was a kernel update, it will suggest a reboot, for example. If it was something like Firefox, and it sees you have Firefox open, it'll suggest you restart Firefox whenever you're ready. If it was a shared library (like openssl, say), it will often suggest some services that use that library (like openssh, openvpn, etc).
If you can wait long enough, it will even cover things like nvidia drivers.
So, the big question here: Is Microsoft likely to close this "security hole"? Or is it a potential opportunity for legitimate software to "hijack" Microsoft Update, and use it for non-microsoft products?
Don't thank God, thank a doctor!
Now you're FUDing. IME the Macs crash a lot (especially when doing large jobs) that's a lot of lost time! I've seen an entire Linux lab go down almost simultaneously, that's lost time (granted this must have been a bug, as the problem was fixed by the next version).
In other words, Mac OS X/Linux/BeOS/etc, are not immune to taking up your time. Are they better than Windows? I doubt it. My XP installs can go for years without me tinkering with them, hell I had a four year old Win95 install going strong before the comp crashed to the floor.
Windows has its problems but simply ain't that bad.
Cheers
I'm no fan of Microsoft, but let's get real folks.
If a trojan has penetrated your system with administrative privileges, then it doesn't really matter what protocol gets used to piggyback additional malware into the penetrated system. If the malware has admin privileges, it can bypass any download security and filtering protocol you invent. Period.
It's like putting more and more money into a safe after the thieves have tunneled through and built a secret back door. The vault door locks just fine, but the money disappears anyway.
This is why I'm generally logged in as a user and not as an admin, even with home machines. It doesn't make you invulnerable but it reduces your risk profile a lot. It's something that Vista (finally) is trying to do right, tho' I think OS/X does a tolerable job of it already.
My install of 98 is connected to a network, but have no malware on it. That poor woman I talked about is using Vista, the Win98 box is my P133 laptop. WinXP runs on it, but do not support the widescreen monitor.
If you honestly believe that all Win98 boxes that are connected to the internet have malware on it, then you've fallen for FUD. Learn about firewalls, open ports and attack vectors.