Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1

This blog (part 1 of 2) documents research showing how, when WSUS uses an external MSSQL database, an attacker who can coerce the WSUS computer account to authenticate to the SQL server can leverage the webService role's execute-only permissions to call WSUS stored procedures and import, host, target, and deploy malicious updates to specific machines—effectively enabling targeted malware distribution and lateral movement via the update infrastructure.