Windows Update used to download malware updates

By Frank Washkuch on May 15, 2007 2:14PM

Hackers have used a Windows Update process to inject malicious code onto a system while avoiding firewalls, according to researchers at Symantec.

Researchers at Symantec Security Response reported last week that a spammed malicious email captured two months ago in Germany contained a trojan using Background Intelligent Transfer Service (BITS) to download malware updates.

Malware must be already present on the PC for the malicious download to occur, said Symantec researchers. BITS is a component used by Windows Update to download patches and other software.

The program is part of the Windows operating system, so it can download software without raising red flags, according to Symantec. There is no available workaround against this type of attack, according to the Cupertino, Calif.-based anti-virus giant.

Alfred Huger, senior director of development at Symantec Security Response, told SCMagazine.com that the attack shows malicious users continue to gain in cleverness.

"It shows that the attackers have a pretty intimate understanding of the Windows operating system," he said. "The level of sophistication continues to go up."

The tool is used by Microsoft to download files, including patches, without consuming bandwidth, Symantec researcher Elia Florio said on the company’s Security Response Weblog on Thursday.

"It’s a very nice component, and if you consider that it supports HTTP and can be programmed via COM API, it’s the perfect tool to make Windows download anything you want," said Florio. "Unfortunately, this can also include malicious files."

A Microsoft spokesperson told SCMagazine.com today attacks taking advantage of BITS are reliant on malware already being installed on a system.

"Microsoft is aware of public reports that Background Intelligent Transfer Service is being used by TrojanDownloader.Win32/Jowspry to bypass policy-based firewalls in order to install additional malware. The bypass relies on [the trojan] already being present on the system; it is not an attack vector for initial infection," said the spokesperson.

"The bypass most commonly occurs after a successful social engineering attempt lures the user into inadvertently running [the trojan], which then utilizes BITS to download additional malware."