Hi everybody,
First of all: I’m not a professional developer or anything, so please forgive me if I ask something stupid. 🙂 Since a couple of years I’m distributing a small non-commercial application with an NSIS installer I’ve built. This works great, but I want to go a step further now. I want users to be able to receive automatic updates of my application in a secure way.
I’ve thought of the following update process, which works but doesn’t feel very secure to me:
- In the initial installer I added an ‘updater’ which is also made with NSIS, it will be deployed upon installation.
- The updater will be executed when a user logs in.
- The updater downloads an INI-file containing version information from my server and compares the version with that of the installed application.
- If the version in the INI-file is newer it will download the newest installer and run it silently.
That’s all it does. I use the Inetc plugin to download the files (via https). Besides that the installer / updater are signed with an EV certificate. I think this update process is vulnerable to for example MiM attacks, so I want it to be more secure. First I thought of adding an MD5 or SHA1 checksum to the INI-file and comparing that to the checksum that should generated by the updater after downloading the newest installer. This has two downsides: first of all the plugins Crypto and MD5 turned out to be unreliable after some testing, and besides that the INI-file is still vulnerable.
Does anybody have good ideas how to make a secure updating process? I’ve already taken a look at this: http://nsis.sourceforge.net/Remote_Secure_Installer but I seem to be missing information about how this works.
I hope somebody can give me some good tips. Thanks in advance!
Securing automatic updates
8 posts
If the exe you download is signed then you can just verify the certificate before executing/updating.
This MitM issue seems a little unlikely though. Is your software so popular that people would be willing to script some kind of custom thing to rewrite the .ini?
This MitM issue seems a little unlikely though. Is your software so popular that people would be willing to script some kind of custom thing to rewrite the .ini?
Thanks for your reply. I also thought of verifying the certificate, but I couldn't find a method how to do that?
I know it seems unlikely that somebody would go to so much trouble of rewriting the .ini. And maybe it is, but it's a very popular application and it's used by healthcare professionals, so it just has to be safe.
I know it seems unlikely that somebody would go to so much trouble of rewriting the .ini. And maybe it is, but it's a very popular application and it's used by healthcare professionals, so it just has to be safe.
Also why do you have to do the ini file at all the app, updater, or installer can check a webpage variable for that information I think
You mean by requesting an http header with Inetc for example? Is that more secure?
The sysinternals forum has a code sample for checking the cert, doing it with the system plugin is a bit more work I would imagine...
You can use the WinVerifyTrust API:
Stu
Performs a trust verification action on a specified object.
The WinVerifyTrust API can be used to verify the signature of a portable executable file.
Stu
Thanks guys.
@ Anders, you're probably referring to: http://forum.sysinternals.com/howto-...opic19247.html ?
@ Afrow UK, that looks very useful as well.
Verifying the certificate should solve my problem. Now I just have to figure out how I should implement the suggested solutions in NSIS.
@ Anders, you're probably referring to: http://forum.sysinternals.com/howto-...opic19247.html ?
@ Afrow UK, that looks very useful as well.
Verifying the certificate should solve my problem. Now I just have to figure out how I should implement the suggested solutions in NSIS.