What if... nod32.com will be hijacked?

What will happen when nod32.com domain will be hijacked?

I talk about this theoretically but it is quite important.

For example someone successfully hijacked nod32.com domain (it is possible - read about recent hijacked google.de and ebay.de). Attacker make fake update.ver pointing to his fake update files. Users will download fake updates and AV will be screaming with tons of false positives or worse new AV code will be executed in kernel context...

Any comments?

 

What if the sky fell tomorrow?
What if it rained acid tomorrow?
What if the earth blew up?

What if the same thing happened to microsoft's website and you thought you were downloading a patch. I'm sure that they would take all precautions, but it can happen.

 

Update files are digitally signed, NOD wouldn't update at all in such case.

 

I guess that's a better response than mine.

 

Thank you for answer.

I think that ESET should also sign update.ver file. It contains sensitive information which could cause Denial of Service. After changing version, URL of update files and size of these files to something really big - AV could use all network resources to download these files and at the end of downloading there will be sign mismatch and the process will start over.

 

Very nice to know, thank you Marcos

Cheers

 

LOL, I did like yours though

Cheers