Hackers Are Finding New Ways to Hide Malware in Trusted Software Updates

Companies depend on software updates to fix problems and keep their systems safe from cyberattacks. But if hackers take control of the systems that deliver those updates, they can use them to spread malware instead.

That’s what researchers from Google’s Threat Intelligence Group (GTIG) and Mandiant found in an investigation published October 15. They discovered that hackers had gained access to the software update system of AOMEI Technology, a company that makes backup and remote access software.

The hackers didn’t need to control AOMEI’s update servers for long. They made changes that lasted just five to 10 minutes before restoring the original files. Computers that checked for updates during that time could end up downloading malware. But computers that checked just a few minutes later would get the normal, safe files.

The researchers found that the hackers changed configuration files to direct computers to malicious downloads and run malware. The attacks affected organizations in 11 countries, including companies in IT services and telecommunications, as well as higher education institutions.

The incident raises concerns about how much businesses can trust software updates from outside vendors. It also raises questions about whether security teams can catch attacks that last only a few minutes and how they can find evidence after hackers remove the malicious files.

Are Businesses Putting Too Much Trust in Software Updates?

Most companies rely on software vendors to provide updates that keep their systems secure. Many install these updates automatically, especially when they fix security problems. But hackers can take advantage of that trust to spread malware.

“Organizations that don’t have comprehensive endpoint logging are essentially blind to this type of attack retroactively.”

Omair Manzoor, Founder, CEO, and Chief Hacker, ioSENTRIX

Organizations often give software updates more access to their systems than they should, said Omair Manzoor, founder, CEO, and chief hacker at ioSENTRIX.

“Most organizations treat vendor updates as inherently trusted,” he told Techopedia. “They’re whitelisted in endpoint protection, bypass application control policies, and often deploy automatically without human review.”

Manzoor said his firm’s security assessments often find that companies don’t pay enough attention to how software updates reach their systems. They spend a lot of money protecting their networks but may not check updates carefully before installing them on company computers.

Companies rely on software vendors to provide updates, Steve Povolny, vice president of AI strategy and security research at Exabeam, told Techopedia. When vendors release updates, thousands of company computers may install them automatically, without security teams checking them first.

Povolny said companies haven’t necessarily made a deliberate decision to trust every update. Instead, automatic updates have become a routine part of keeping systems running.

“I’ve seen many cases where visibility tools and security teams were great at detecting attacks that persisted for a long time but had a hard time finding something that lasted for a few minutes at best.”

Daniel Di Nardo, Network and Security Consultant, IntelliBreach

Organizations have little choice but to trust software vendors to some extent. Otherwise, they’d never install updates, said Daniel Di Nardo, a network and security consultant at IntelliBreach.

“Unfortunately, once a company trusts an initial software update, it becomes significantly harder to question all the subsequent ones since, for many organizations, the act of trusting an outside vendor is a one-time affair,” he told Techopedia.

Why Short-Lived Attacks Are Hard to Detect

The AOMEI investigation shows how quickly attackers can compromise software update systems and disappear.

Google and Mandiant identified three periods when the attackers changed the company’s update configuration files: 10 minutes on May 28, six minutes on July 16, and five minutes on July 20.

The attackers directed computers to download malicious files and then restored the original configurations, making the servers appear normal again. That makes these attacks particularly difficult for security teams to identify.

Manzoor said hackers can make changes to a vendor’s update system for just five to 10 minutes without setting off security alerts.

He said security teams often take hours to look into alerts, and even if their tools pick up suspicious activity, a malicious update may look like a normal one. By the time they investigate, the hackers may have already put the vendor’s servers back the way they were.

Di Nardo said many security tools work well when hackers remain inside a network for an extended period. But they may struggle to detect attacks that last only a few minutes.

“I’ve seen many cases where visibility tools and security teams were great at detecting attacks that persisted for a long time but had a hard time finding something that lasted for a few minutes at best,” he said.

How Companies Can Find Evidence After Hackers Remove Malicious Files

Once hackers remove the malicious files from a vendor’s servers, companies may have trouble figuring out which computers received them. By the time they learn about the attack, the vendor’s website and software updates may appear normal again.

Di Nardo said security teams should check their own computers for signs of an attack instead of looking for evidence on the vendor’s servers. They should look for suspicious programs, unusual network activity, and signs that malware is still running.

Manzoor said companies should also keep records of the updates they download, including their cryptographic hashes, which act like digital fingerprints. Investigators can use these records to find out whether a computer downloaded a malicious update.

Security teams should also look for files created in unexpected locations, changes to system settings, and programs that started running after an update was installed.

“Organizations that don’t have comprehensive endpoint logging are essentially blind to this type of attack retroactively,” Manzoor said.

Povolny said comparing activity across multiple computers can also help companies identify attacks they might otherwise miss. For example, one computer connecting to an unfamiliar server after an update might not raise concerns. But if hundreds of computers make similar connections after installing the same update, that could point to a larger problem.

However, Povolny warned that companies often don’t keep their security logs long enough. By the time researchers identify an attack, the records needed to investigate may already be gone.

“I would not recommend delaying zero day or high security patches because unpatched systems can create even greater risks for an organization.”

Kishore Bitra, Lead of Collaboration Engineering, City of Baltimore

Kishore Bitra, lead of collaboration engineering at the City of Baltimore, recommended using a security information and event management system to collect and store information from computers, applications, and networks in one place.

Security teams can review those records to see which updates were installed, what programs ran afterward, and whether computers connected to suspicious servers, he told Techopedia. That information can help them figure out what happened, even after hackers have removed the malicious files from the vendor’s servers.

Protecting Systems Without Delaying Important Updates

Despite these risks, experts don’t recommend that businesses stop installing software updates. Delaying security patches can leave computers exposed to vulnerabilities that hackers already know how to exploit.

Instead, companies need to balance the risks of compromised updates against the dangers of leaving their systems unpatched.

“For example, our teams often skip cycles to wait and see whether that patch was successful.”

Rahul Mahna, National Practice Leader and Partner, Outsourced IT Services, EisnerAmper

Rahul Mahna, national practice leader and partner for outsourced IT services at EisnerAmper, told Techopedia that his teams follow a process that includes managing, measuring, deploying, monitoring, and retesting updates.

He said they test updates in a separate environment before installing them throughout an organization. After installation, they continue monitoring the systems for problems and ensure they can reverse an update if necessary. However, smaller businesses may not have the resources to test updates before installing them.

Mahna said his team sometimes holds off on installing patches because software vendors occasionally release updates that cause problems.

“For example, our teams often skip cycles to wait and see whether that patch was successful,” he said.

Manzoor also recommended staged deployments, starting with a small group of computers and monitoring them before expanding the rollout.

He suggested watching those systems for 24 to 48 hours for unusual behavior. Businesses should also restrict communication between parts of their networks to limit the damage if an update contains malware.

In addition, Manzoor said companies should review vendors’ security practices, including how they protect the systems that deliver software updates.

Bitra said businesses should distinguish between routine updates and patches for urgent security problems. For routine updates, he generally recommended waiting 24 hours while checking vendor advisories and reports from other IT professionals.

But companies should move faster when patches address vulnerabilities that attackers are actively exploiting.

“I would not recommend delaying zero day or high security patches because unpatched systems can create even greater risks for an organization,” Bitra said.

Software Updates Need More Scrutiny

The AOMEI attack showed why businesses can’t assume that software delivered through a legitimate update system is always safe.

Google’s researchers found that attackers needed only a few minutes to redirect software updates and deliver malware. Once they restored the original files, the vendor’s servers no longer showed the malicious changes.

Security experts said companies need to do more than check whether an update comes from a trusted vendor. They also need to watch for suspicious activity after installation, keep security records that can help them investigate attacks, and have a plan for responding if something goes wrong.

Povolny said staged deployments can help, but businesses often use them to identify software crashes rather than malicious behavior. Security teams should also watch what updated applications do while they’re testing them.

As Manzoor warned, companies that trust software vendors without examining their update processes are leaving an important part of their security in someone else’s hands.