Time for an Evilgrade
By Dan Goodin in San Francisco
Published Monday 28th July 2008
A researcher from Argentina has released an exploit package that can install malware on end user machines that run iTunes, Mac OS X, Winzip and a host of other popular software.
Evilgrade is the brainchild of Francisco Amato and works by exploiting weaknesses in the automatic upgrade feature of an affected program or operating system. It works only when a man-in-the-middle attack has first been carried out, but thanks to the domain name system vulnerability that has dominated security coverage ever since researcher Dan Kaminsky sounded the alarm three weeks ago, that's not much of a problem.
The demo here shows just how effective Evilgrade is now that the exploit code for the devastating DNS bug was folded into Metasploit. It shows how the upgrade feature on Sun's ubiquitous Java runtime environment can be targeted to remotely execute arbitrary code on a fully-patched machine.
This one tip will help you sleep better tonight
A few seconds are all you need to get a better night's rest.