Urgent update: why install as soon as possible

Vendors publish updates to fix flaws. If a criminal gets in through a security flaw, they then look for sensitive information to exploit¹. As long as the update is not installed on your device, the flaw stays there.

MITRE describes a common attack route, drive-by compromise. A user visits a website that hosts the attacker's content. Scripts then look for the version of the browser and its plugins, searching for a vulnerable version. If one is found, the exploit code is sent to the browser. If it succeeds, the attacker gets code execution on the machine, unless other protections are in place⁵. Visiting a legitimate site that has been compromised, or a malicious ad served by a legitimate ad provider, can be enough to trigger the chain⁵.

MITRE classes separately the exploitation of client-side software to obtain code execution. Among its examples, one group exploited numerous ActiveX flaws, including zero-days⁶, and a piece of malware used a known Adobe Flash zero-day flaw to run on victims' machines⁶.

• Install updates as soon as notified, without choosing "Remind me later"¹.
• Check by hand if needed that the update worked³.
• Turn on automatic updates in the settings¹.
• Use a period of inactivity (lunch, a meeting, overnight) if the update is long: it can last from a few seconds to several minutes or hours³.
• Download updates only from the official sites or channels of vendors and manufacturers³.
• Report to the IT department a device that cannot be updated. Cybermalveillance.gouv.fr states that such a device must be protected another way, for example by disconnecting it from the Internet or isolating it from the rest of the network³.

Putting off the update

CISA tells the story of Veda, who regularly clicked "Remind Me Later" on her computer and her phone. According to the account, the malware probably came from her son, who had clicked a link leading to an infected site. The malware then exploited a known flaw in her old operating system. She lost access to several accounts and money was withdrawn from her bank account¹. The CISA account carries no date, and the page is marked "Archived Content": it may not reflect current policy¹.

Accepting a site's warnings and notifications

MITRE notes that, in a drive-by attack, the user may have to help the process along by enabling scripts or notifications, or by ignoring warning windows⁵. Accepting a site's notifications can also give it permission to run JavaScript code in the browser⁵.

Fake updates

Messages that look like update alerts can appear while browsing: fake ads or malicious pop-up windows. This can be a technique to get you to install a fake fix that is really a virus³. MITRE describes actions the attacker can get from the user: opening a link or a file, downloading and running malware, turning on a remote access tool⁷.

The following illustration is neutralized: the address is invented and leads nowhere.

[Illustration] Window that appears while browsing:
"Update required. Download the fix now."
Button: hxxps://mise-a-jour-navigateur[.]exemple[.]invalid/correctif

Editorial advice: close the window, download nothing, and start the update from the device or browser settings. Cybermalveillance.gouv.fr also reminds people to watch for pre-checked boxes during installation, which can amount to accepting unwanted software³.

Putting off an update alone

The UK NCSC adds that the decision not to update belongs at management level, as a risk accepted by the organization⁴. The NCSC also recommends, against phishing, using only supported software and devices kept up to date with the latest patches⁸.