Windows Update used to download malware updates

By

Hackers have used a Windows Update process to inject malicious code onto a system while avoiding firewalls, according to researchers at Symantec.

Windows Update used to download malware updates
Researchers at Symantec Security Response reported last week that a spammed malicious email captured two months ago in Germany contained a trojan using Background Intelligent Transfer Service (BITS) to download malware updates.

Malware must be already present on the PC for the malicious download to occur, said Symantec researchers. BITS is a component used by Windows Update to download patches and other software.

The program is part of the Windows operating system, so it can download software without raising red flags, according to Symantec. There is no available workaround against this type of attack, according to the Cupertino, Calif.-based anti-virus giant.

Alfred Huger, senior director of development at Symantec Security Response, told SCMagazine.com that the attack shows malicious users continue to gain in cleverness.

"It shows that the attackers have a pretty intimate understanding of the Windows operating system," he said. "The level of sophistication continues to go up."  

The tool is used by Microsoft to download files, including patches, without consuming bandwidth, Symantec researcher Elia Florio said on the company’s Security Response Weblog on Thursday.

"It’s a very nice component, and if you consider that it supports HTTP and can be programmed via COM API, it’s the perfect tool to make Windows download anything you want," said Florio. "Unfortunately, this can also include malicious files."

A Microsoft spokesperson told SCMagazine.com today attacks taking advantage of BITS are reliant on malware already being installed on a system.

"Microsoft is aware of public reports that Background Intelligent Transfer Service is being used by TrojanDownloader.Win32/Jowspry to bypass policy-based firewalls in order to install additional malware. The bypass relies on [the trojan] already being present on the system; it is not an attack vector for initial infection," said the spokesperson.

"The bypass most commonly occurs after a successful social engineering attempt lures the user into inadvertently running [the trojan], which then utilizes BITS to download additional malware."
Got a news tip for our journalists? Share it with us anonymously here.
Tags:

Most Read Articles

Qantas facing 'significant' data theft after cyber attack

Qantas facing 'significant' data theft after cyber attack

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

International Criminal Court hit by cyber attack

International Criminal Court hit by cyber attack

Log In

  |  Forgot your password?