← ACARA Digital Technologies Years 9–10

Compromised software updates

A software update from a trusted supplier that criminals have secretly infected with malicious code, so users install it believing it is safe.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 76, WA Computer Science ATAR Year 11 — Cyber Security — Module 59

Understanding Compromised software updates in ACARA Digital Technologies Years 9–10

What it does: The code installs anything from a trusted sender without extra checks, which is exactly the trust that criminals exploit in a compromised update. Attackers infect the update at the supplier's end, so every user who downloads it receives the malicious code. Using official sources and watching for security notices helps you avoid fake updates and learn quickly about a compromised one. Automatic updates are convenient, but if the update is infected, the malware spreads quickly because users never review it.

Common mistakes: The check is reversed. This would install updates that are NOT signed and block the signed ones. It should be 'if is_signed(update):' so only verified updates are installed. A single = assigns a value, and it can't be used as a condition. To compare the supplier name you need the == operator.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Compromised software updates to a class →

This module's key terms are also in a printable crossword (Modules 810–827) and word search (Modules 810–859).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A criminal hides malicious code inside a real update from a trusted software supplier. What is this called?
A compromised software updateA normal security patch
Matches
if source == "trusted": install(update) # so it must be safe
↓
Assuming an update is safe just because it comes from a trusted supplier. The supplier's system may have been compromised.
Applying
Meanings
Term
compromised software update
Meaning
A software update from a trusted supplier that criminals have secretly infected with malicious code, so users install it believing it is safe.
Practice
RECEIVE update FROM supplier
Testing
Gaps
autoUpdate =
Check Answer
Spots
1update = download(supplier)
2if not is_signed(update):

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Woodpecker' badge — Tap Tap Tap, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A criminal hides malicious code inside a real update from a trusted software supplier. What is this called?
A. A compromised software update ✓
B. A normal security patch
In a compromised software update, attackers infect the supplier's genuine update so users install the malicious code believing it is safe.
2. Why do users install a compromised update without worry?
A. It appears to come from a supplier they already trust ✓
B. It always asks them to disable their antivirus
The update looks genuine and arrives from a trusted supplier, so users have no reason to be suspicious.
3. Where does the malicious code get added in a compromised software update?
A. Into the supplier's update before it reaches users ✓
B. Only onto the user's device after installing
Attackers infect the update at the supplier's end, so every user who downloads it receives the malicious code.
4. A program has automatic updates switched on. A compromised update is released. What could happen?
A. The update waits until the user approves each line of code
B. The malicious update may install on many devices without the user choosing it ✓
Automatic updates install without a user check, so a compromised update can spread quickly to many devices.
5. Which statement is true?
A. Anything from a trusted supplier is always safe
B. An update can be dangerous even when it comes from a trusted supplier ✓
Trust is the weakness being abused. If the supplier is compromised, a genuine-looking update can carry malicious code.

Match the Pairs

update_server.upload("app_v2.1.exe") # contains hidden malware → A criminal slips malicious code into a genuine update on the supplier's own server, so it looks like normal software.
auto_update = True # installs without asking → Updates install by themselves, so a compromised update can reach many devices before anyone notices the problem.
Users trust an update because it comes from a supplier they already use and believe is safe. → if sender == "trusted_supplier": install(update)
A safer approach is to check that an update is genuine before installing it, rather than trusting its source alone. → if verify_signature(update): install(update)
if source == "trusted": install(update) # so it must be safe → Assuming an update is safe just because it comes from a trusted supplier. The supplier's system may have been compromised.
auto_update = True # no need to ever check updates → Believing automatic updates remove all risk. A compromised update installs automatically, giving malware a quick route onto many devices.

Key Term

compromised software update
A software update from a trusted supplier that criminals have secretly infected with malicious code, so users install it believing it is safe.

Fill in the Blanks

1. supplier = "trusted" autoUpdate = True
Hint: Type the Boolean value that switches automatic updates on.
2. if supplier == "trusted": install(update)
Hint: Type the operator that checks whether two values are equal.
3. infected = True if infected: alert("Do not install")
Hint: Type the variable that records whether the update has been secretly infected.
4. trusted = True infected = True safe = trusted and not infected
Hint: Type the keyword that requires both conditions to be true. Here the trusted update is also infected, so safe ends up False.
5. updates = ["v2.1", "v2.2"] for update in updates: verify(update)
Hint: Type the name of the list that holds the downloaded updates.

Spot the Error

Question 1
A update = download(supplier)
B if not is_signed(update):
C install(update)
D else:
E block(update)
Line B — The check is reversed. This would install updates that are NOT signed and block the signed ones. It should be 'if is_signed(update):' so only verified updates are installed.
Question 2
A supplier = 'TrustSoft'
B update = get_update(supplier)
C if supplier = 'TrustSoft':
D install(update)
Line C — A single = assigns a value, and it can't be used as a condition. To compare the supplier name you need the == operator.
Question 3
A auto_update = True
B while auto_update:
C update == check_server()
D verify(update)
Line C — The == operator compares values, so the update is never stored. Use a single = to assign the result of check_server() to update before verifying it.
Question 4
A update = download(supplier)
B hash = sha256(update)
C if hash == published_hash:
D block(update)
E else:
F alert_user()
Line D — When the hash matches the supplier's published hash, the update is the genuine file and should be installed. Blocking it is the wrong action. The line should be install(update).
Question 5
A def install_update(update)
B if update.is_signed:
C run(update)
D return 'done'
Line A — A function definition must end with a colon. The line should be 'def install_update(update):'.

Student with a class code? Join your class →