"...may automatically have received and installed the malicious software..."
That is nice. Automatic installation of malware. It's the way to go :)
That is nice. Automatic installation of malware. It's the way to go :)
Users checking for updates or visible automatic update prompts during that timeframe that Opera said was offering the infected update would still get the malware.
People assume that getting automatic update prompts would allow them to stop the update if they heard about an infected update. The problem with that logic is that by the time the companies know about a breach, they would've shut down the automatic update FIRST and then fix the breach, then resume it. Customers would rarely know about that breach in advance, so the prompt wouldn't change anything here.
- Spreads the exposure time, creating a much larger window in which updates may be deployed, reducing the number of systems affected, and reducing the likelihood of a targeted attack succeeding.
- Prevents targeted 'midnight' updates in which an attacker can deploy code at-will to target systems during hours that nobody will be around to see them.
- Requires producing reasonable looking update notes, which will likely be noticed by everyone involved in the release process, resulting in an additional warning to those that can detect the issue.
A silent update can go out without anyone knowing that an update was even deployed.