Malicious Updates
- •
def
- •
a threat vector where a software update itself is the delivery mechanism for malware — not every update is equally secure
- •
- •
best practices
- •
always have a known-good backup before updating; install only from trusted sources; confirm the source directly (a random pop-up during browsing may not be legitimate) rather than trusting a random update button; visit the developer's site directly
- •
automatic updates are relatively trustworthy since they come straight from the developer and often include digital signature checks — but supply chain compromise is still possible
- •
- •
example
- •
the SolarWinds Orion supply chain attack (reported December 2020) — attackers gained access to SolarWinds' own development system and added malicious code directly into legitimate software updates, ultimately reaching hundreds of government agencies and companies
- •
- •
related