Vendor Updates
Updates a product's maker pushes to it, from Windows Update to SolarWinds Orion.
About
Commercial products update from their maker. Microsoft Update covers Windows, SQL Server and SharePoint, and each vendor has its own channel for products such as Confluence or a firewall. Updates are signed and trusted by design, and often install themselves. That trust is why a poisoned update does so much harm.
An update runs as soon as it installs, with the product's own rights. For monitoring and management tools that often means admin rights across the whole network.
If It Is Malicious
If a vendor update is malicious, it runs inside the product it updates with that product's own rights, on every customer system that installs it.
Its code runs inside these technologies.
Examples
These are well-known names from Vendor Updates, written as you would meet them in an inventory, an alert or a lockfile, the file that records every version a build installed.
Microsoft Update- Fixes for Windows, SQL Server, SharePoint and Exchange.
SolarWinds Orion- Network monitoring whose 2020 updates carried a backdoor.
Kaseya VSA- Remote management that service providers use to update their customers' machines.
3CX Desktop App- A business phone app whose 2023 installers carried malware.
How Bad Code Gets In
These are the ways bad code can reach your systems through Vendor Updates. None of them needs a flaw in your own code, so outside code needs checking as much as your own.
- Attackers get into the vendor's build and ship a signed update with their code inside.
- A flaw in a management tool lets attackers push their own update through it.
- A vendor's update server or download site is taken over.
- A machine at the vendor is infected through another supplier's software, and the attack moves on from there.
How to Check
These checks show what came from Vendor Updates, whether a known bad version is in use, and how to keep one out next time.
- Know which products update themselves and with what rights, and give monitoring tools no more than they need.
- Watch vendor advisories and national alerts, such as CISA and the NCSC, for named bad versions.
- Roll updates out to a few machines before the whole estate, where the product allows it.
- Alert on unusual outbound connections from servers that run vendor tools.
Well-Known Incidents
Each incident below is a real case, told at the level of its public advisory. The tag says how the bad code got in, and the link opens the primary source.
Compromised Build or Release2017
NotPetya Through M.E.Doc
Attackers got into the update system of M.E.Doc, the most popular accounting software in Ukraine, and used an update to spread NotPetya, destructive malware disguised as ransomware.
Reach It reached multinational firms that did business in Ukraine and spread to organisations with no obvious link to the country, destroying data on the machines it hit.
Source: blog.talosintelligence.com (opens in a new tab)Compromised Build or Release2020
SolarWinds Orion
Attackers got into SolarWinds' build system and added a backdoor to Orion updates, which went out signed by SolarWinds.
Reach Thousands of organisations installed the update. The attackers then went further into a chosen few, US government agencies among them.
Source: cisa.gov (opens in a new tab)Hijacked Management Tool2021
Kaseya VSA
Ransomware attackers used a flaw in on-premises Kaseya VSA servers to push a malicious update through VSA to the machines those servers managed.
Reach It hit managed service providers and, through their VSA servers, many of the businesses they looked after.
Source: blog.talosintelligence.com (opens in a new tab)Compromised Build or ReleaseCVE-2023-290592023
3CX Desktop App
Attackers reached 3CX's build systems through an employee's own computer, infected by another company's trojanised app, and shipped installers carrying malware.
Reach Businesses running the 3CX phone app on Windows and Mac installed the infected versions.
Affected
Source: 3cx.com (opens in a new tab)3CXDesktopApp
In Common Stacks
These common stacks take code from Vendor Updates. Open one to see where that code sits among its layers and who runs each one.