Slashdot Mirror
Malware Hijacks Windows Update
clickclickdrone writes "The BBC are reporting a new piece of malware is in the wild that can hijack Windows Update's functionality and bypass firewalls allowing it to install malicious code on users PCs. The new code was discovered by Frank Boldewin in an email. The attack utilizes the BITS system."
...son of a BITS.
FLR
Sheesh, evil *and* a jerk. -- Jade
14 new virusses have just been installed
please restart your machine to become a zombie
Ah! One of the many Microshite's patents that didn't manage to make it into the Linux sourcecode. Perhaps Novell could implement this feature?
Frank Boldewins site is http://www.reconstructer.org/, not http://www.reconstruction.org/.
With a lot of people doing auto-updates might as well target what will be the predictable weak link. I'd bet some people have their auto-update run more often then their virus scanners anways.
I'm sure "SlashdotMedia" will improve on all the wonders that Dice Holdings blessed us all with
What is a DDoS attack?
A: Guerilla activism by open source software advocates in which they uninstall Windows on a PC and replace it with Linux
That's one botnet I'd happily join
Any sufficiently advanced bug is indistinguishable from a feature.
Hi,
I have my own awesome blog whose url I certainly don't need to post here since I expect you all to know it already.
I just talked with my friends at Microsoft and they told me that
"Windows is safe!"
and it seems ridiculous to care about such small issues when 9/11 was only 6 years ago. You people should really step aside and look at the things from another perspective.
Maybe from above like the Lord does.
I rather go to church and pray to the Lord for less terrorists than being part in this smear campain against the blessed world leader of IT.
Bill and Melinda think of the children. Do YOU?
Yes, it makes life a little easy for the hackers, after they have compromised your system. But all users whitelist their browsers in their firewall software to make outbound connections. So in what way is it more dangerous than the virus using IE (or Firefox for that matter) to download more bad stuff into the computer? Once the machine is compromised, it can use even ftp to download stuff. Dont blame ftp or Firefox or IE. Blame the OS that allows the machine to be compromised so easily.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
The good news is that it only installs the malware if you're running Genuine windows.
Is your Windows Update not infected yet? Click here to infect it!
This guy's the limit!
If you were all using Linux or OS/X, you could watch this catastrophe with detached amusement instead of butt-clenching fear.
Me, I'm relaxed and enjoying a soda.
NO CARRIER
It should be pointed out that malicious code needs to already be running on the host machine to use this.
However, I've never found anything more specific -- does anyone know the consequences of disabling BITS?
...infected machine!! Man who knew that would be even possible?
John
Dear Sirs,
Your Trojan, named 1337-5ki11z, violates 387 Microsoft patents, included patent 666-1345-876-666 ("screwing the user over"). We do not wish to actually pursue legal action, but would rather license our Windows Update APIs to you for the paltry sum of 100.00 (per infection).
Thank You
Kindly,
The MS Legal Eagles
Its not really Windows Update that's being used in this exploit, its the Background Intelligent Transfer Service which, in a nutshell, is a service that downdaloads data to your PC while minimising disruption to other network activity i.e. surfing the net, gaming, or downloading other files. Its a built-in feature of Windows XP but has only been implemented once or twice.
Windows update makes use of the BITS service. Malware can make use of the BITS service. Its not logical to then say that Malware is exploiting Windows update. Any more than an attack that utilised Java would be exploiting Azureus (A java application).
The reason malware utilising BITS is a problem is because with any application-level firewall, permission for BITS to access the net is already granted and so unlike a regular trojan, the firewall won't spit a potentially suspicious permission request up when it tries to download more malware from the 'net. This same exploit is true of the JVM too.
A solution to the problem might be to instance such services. But by doing that it sort of renders them not services anymore.
So eh, mark my stats +1 pedantry, but to perpetuate this as a Windows Update exploit isn't accurate.
How is this Microsoft's fault? It's a trojan. The system has already been compromised. Hey, if I can get you to run my shell script as root, then I can add my own sources to your sources.list and use apt to install my rootkit! Debian must be insecure!!@#!#!#!
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I've always been curious (not enough to do the research I guess) what kind of security the windows update does to prevent someone from using control of DNS and or routers to get windows update to install malware. Given that people often use DNS and routers that the cannot really trust, is there something that prevents a bad guy from just redirecting all traffic that is attempting to hit MS's update site to their their own server that is set up to look like it is MS's update site? Given how many people have their laptops set up to do automatic updates, I would think that it would be easy to just take a loptop to a coffee shop, and watch as other patrons 'update' from your access point.
BITS stands for "Background Intelligent Transfer Service" and is simply a way to download files using idle bandwith. It's fully documented in MSDN, see http://msdn2.microsoft.com/en-us/library/aa362708. aspx, and among many things it's used by some browser downloading plugins (similar to DownloadThemAll) that enhance downloading of large files. It's not just used by Windows Update.
Do we need additional articles to state that a malicious program on a compromised machine could use FTP to download additional files? Or HTTP? Or BitTorrent? Or roll their own protocol?
Based on the article, it sounds like the only concern is that because BITS is a service (daemon in the Unix world), it means that firewalls or malware detection tools that attempt to block outgoing requests (which most don't; they block listening ports) may not currently detect this because it's not the malicious .EXE itself that's opening a port; it calls into BITS, which opens the port. However, the app still has to use a public API to instantiate the BITS object, so there's no reason such a program couldn't hook that as well.
Unfortunately the article summary (and headline of the BBC article!) completely misrepresents the issue and blows it way out of proportion. They are not Hijacking Windows Update. They're using a generic well-documented downloading service that also happens to be used by Windows Update simply because it enables WU to download updates without gobbling up all your bandwidth.
Yeah, cos Apache HTTPD powers 2/3 of all web servers (and about half the rest are based on bastardised versions of the Apache codebase or its NCSA predecessor), and gets 2/3 of all web server exploits directed at it.
Oh, wait, that's bollocks. And so is your argument.
Je fume. Tu fumes. Nous fûmes!
But does it run on Linux???
"an experienced, industrious, ambitious, and often, quite often, picturesque liar" - Mark Twain
I'm sitting here on Windows chuckling over so called geeks that don't understand the issue at hand. If a computer is compromised, then the software firewall can be disabled. The BITS stream that comes out of the comp can be emulated by software on Linux and Mac OS, to the same effect as Windows.
The "news" here is that there is software capable of doing this, not that it can't be done. True, BITS is a protocol created to work around firewalls, but it is hardly the only protocol engineered to do that.
Oh, and Mac's suck because they crash all the time. *ducks*
Singling out "BITS" is stupid. The exact same thing can be done with virtually any service or application that is allowed to pass through the local outgoing software firewall. As long as the software has some kind of programmatic interface, it can easily be used to bypass these firewalls.
I wrote a proof of concept application that bypassed all of the major outgoing software firewalls (BlackIce, Zonealarm, McAfee, Symantec) by utilizing the COM interfaces for Internet Explorer and funneling all my requests through it. This is almost impossible to detect. Even better, I wrote this app in freakin' VB!
The real problem is that local outgoing software firewalls simply don't work in an environment where all the users are admin. Once the machine is compromised, it's compromised. No number of software defenses are going to help. This includes, by the way, Symantec's expensive and incredibly crappy products. These products are there to make users feel secure, not actually make them secure.
Remember WordMasters from grade school? You know, the analogy test they used to give every once in a while. Here is an analogy for you:
Symantec is to computer security as the Bush Administration is to homeland security.
They do their best to scare the crap out of people in an attempt to get them to buy their software... or vote for their party. Don't trust either of them and you'll be better off.
BITS is just yet another way of delivering software to your machine. It's supposed to allow you to download stuff like updates without hogging all your bandwidth. Works well on cable/dsl. Dial up or ISDN, not so much. There are other companies that use BITS for various other applications, for example Sony OE uses it when they are rolling out a big big patch in SW: Galaxies to roll parts of it out early, in theory while you are playing without impacting your game. Again, on Dial up or ISDN that doesn't work so well, so they let you turn it off. Imho it was only a matter of time before BITS was hijacked for this purpose. I'm not saying I saw this coming, I really hadn't thought about it, but it's just another vector for malware to get to the internet and download software to your machine. A vector that is normally 'trusted'.
Again, the kicker is that (as I understand things) there has to already be some program (malware) on your computer to request additional malware through BITS. That malware could conceivably be a Java or ActiveX program running in your browser, or something an exploit causes to be dropped and run. BITS is not an attack vector in and of itself at this time.
I imagine Vista would probably pop up a confirmation window about allowing something access to BITS if you were running as a low-privilage user, but I'm not sure.
No, I don't agree.
No matter what, buggy drivers, compromised machine, spilled coffee, you can always count on your trustworthy old friend, mister Blue-Screen©® !
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
It should be possible to delete your own posts, or at least moderate them down. I apologize for losing my cool.
I just wanted to say it amuses me when people get emotional over operation systems. This is true for both Windows and non-windows users alike; I recall several Winlots being on cloud 9 when that Mac scripting error deleted a bunch of files.
I'm probably also guilty of being amused by others misery at one time or another.