Wouldn’t software vendors signing their updates prevent this kind of attack? I would think that’s the norm for this kind of thing.
Yeah but it's wishful thinking to expect all software vendors to do this. What would be better is if operating systems had standard ways to install and update software that was actually well established, so vendors didn't need to roll their own. While Windows has the Microsoft store, not many vendors use it, for various reasons. Most Linux distros have package managers that handle things well enough, and, more importantly, support third party repos.
Even just using HTTPS instead of insecure HTTP would prevent this type of attack.
(I see no indication that the attackers obtained forged TLS certificates, and compromising a client-side ISP wouldn’t be enough to get one.)
Wow, somehow I missed the line about “insecure http update method”… crazy