Malware Finds Another Way

Malware is a thorn in the side of computer users from all walks of life. Malware, short for malicious software, is software designed to infiltrate or damage a computer system without the owner's informed consent. The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code. Software is considered malware based on the perceived intent of the creator rather than any particular features. Malware can include viruses, worms, trojan horses, most rootkits, spyware, dishonest adware, crimeware, badware and other terms for malicious and unwanted software.

According to a recent CNET article a new form of malware called Ippon, which means "game over" in Judo, allows an attacker to scan an unsecured Wi-Fi network for computers checking for new updates via HTTP (Hyper Text Transport Protocol). If the system detects a computer sending a software update request, the tool replies before the app update server can respond (This is similar to a "Man in the Middle" attack.) Ippon customizes messages for the particular application and sends a message indicating that there is an update available even when the system already has the most recent legitimate update. A malicious file is then downloaded from the attacker's server onto the victim's computer.

This program would not affect Windows updates as they use digital signatures as part of the process to ensure all updates are legitimate. The most susceptible users are those performing updates over an unsecured Wi-Fi network, similar to one which populate coffee shops and major airports.

After speaking with one of our knowledgeable consultants I gained a better understanding of how this program works, and where a PC would be most susceptible. If a user's laptop were automatically searching for updates for Skype, AIM, or other application while using an unsecured Wi-Fi connection it would be an easy target for the Ippon software.

While most secure wired connections, and reliable web browsers have a built in defense against this type of malicious software, this warning should be heeded by those who use unsecured Wi-Fi networks frequently. The danger in this new type of malware is that in the past, the best way to defend against it was to constantly keep your compute updated with the most recent version of all programs. While this is still the case, users need to be sure to perform these updates solely over a secured connection, and be wary of unusual update bubbles popping up on their screens.

For more information regarding this, and other security and privacy issues, let me know what you’re thinking at jcarretta@thetnsgroup.com

Joe Carretta