evil upgrade demoed via wi-fi
This “evilgrade” is definitely not new:
Researchers here tomorrow will demonstrate a way to hijack the application update process via WiFi and replace the updates with malware.
But when the “hypothetical” becomes the easy and pragmatic, the threat is taken more seriously.
The solution is for software companies to digitally sign their updates:
Microsoft apps are immune to the attack because Microsoft digitally signs its application updates, Kotler says. "If [an application developer] distributes a public key and signs every binary with their own private key, it’s safe" from the attack, he says.