Risk 'Comparable' to SolarWinds Incident Lurks in Popular Software Update Tool

Researchers have identified a supply chain risk in Advanced Installer, a popular installer authoring tool, describing it as potentially enabling cyberattacks comparable in scope to notable supply chain incidents. The risk centres on Advanced Installer’s update feature, which uses a -url parameter to retrieve remote update configurations, allowing attackers to supply a malicious file that masquerades as a legitimate update.

Cyderes revealed the bring your own update (BYOU) risk and notes that, while there is no known active campaign, vendors should review their update signing practices before the threat assessment grows. The issue arises because the update process can accept unsigned packages, and the update file itself is unsigned and unverified from the victim’s perspective, even though it appears to come from a trusted updater.

Advanced Installer is used by developers and system administrators in more than 60 countries to package or repackage software, and its customer list includes brands such as Microsoft, Apple, Dell, Motorola, Sony, McAfee, and Adobe, among others, according to Cyderes.