Cybersecurity Challenges Associated with Software Updates

Abstract

In the past, software distribution was one of the tougher problems for independent developers. With the rise and ubiquitousness of broadband internet connectivity, this problem has been solved as these developers have the ability to directly distribute software updates to their customers. As the focus is on fast-paced software delivery, they may lack practical knowledge in some other, more subtle aspects of software distribution, e.g. information security.

Our hypothesis is that there is a lack of security auditing before the final distribution. Using a controlled environment, we analyzed outgoing network traffic to identify the communicating during update sequence.

We used acquired data to identify a specific service that serves software update packages. After we identified the service, we tried to force the software to use our modified service, download a modified update package and execute it. As we were able to succeed, this outcome fully supports our above assumptions.