OSNews

You don't have to compromise the server ... you just have to spoof the client into believing that your data came from such a server.

Likewise, you don't necessarily have to be able to sign your data as Microsoft ... you just have to get WU to believe that it is so signed.

Tricks like these are the essential reason why it is a good idea to require manual input of credentials from a local user before any execute permissions are set. That requirement should ideally also be subject to audit ... it should be possible for end users to examine OS source code so as to assure themselves that execute permissions can only be set by them.

These are the reasons why any type of "automatic update without local user authorisation" is an utterly bad idea ... from an end-user perspective.

Edited 2007-09-15 13:42

Ok, so how do you get WU to believe it is signed? You make it sound so simple, yet no one has done it yet.

How are you going to do that? The WU-servers NEVER contact the client.

It is always the client that contacts the servers, so in order to spoof the client you need to compromise the servers - or hacking the User's ISP or somehow get control over the User's internet conneciton. OR replace the WU-client in which case you already has access to the core of the User's system.