Are the latest versions of Skype, VMWare, and others listed there at risk of software-update hijacking, with no cryptographic verification of update payloads?
Firesheep only requires that you sniff unencrypted traffic but this requires that you make DNS requests resolve to an address of your choice. The latter is much harder to do. You either need to control the wireless router or break the DNS server some way.
True but not that much - it wouldn't be difficult to inject a reply on an unencrypted wireless network, you just have to sniff the trafic and then reply faster than the wireless network and then blast the reply out with a higher signal.
Since everything is cached locally for your, replying faster shouldn't be an issue, and you can sit closer to your intented victim than the wireless router, which should give you a better signal.
It says it supports Adium (Sparkle) updates, but Adium definitely uses digital signatures, see /Applications/Adium.app/Contents/Resources/dsa_pub.pem . So...is there something I'm missing? Has anybody tested this?
Public-key cryptography. The update server could send a signature along with the update package and the software would check the update contents to make sure the signature matches.
A secondary method for authenticating updates would also be wise. When Moxie Marlinspike's null-prefix SSL bug landed, people with vulnerable versions of Firefox were somewhat screwed: Firefox used only SSL to ensure the authenticity and integrity of updates, but SSL was broken, so the update fixing SSL security couldn't be authenticated!
