Study: Attacks on package managers [LWN.net]

Study: Attacks on package managers

Posted Jul 14, 2008 19:37 UTC (Mon) by msmeissn (subscriber, #13641)
Parent article: Study: Attacks on package managers

For SUSE the whole repository is integrity protected by GPG signatures 
from top down.

So at most you can replay old repository states, but never smuggle in bad 
packages.

Also we use a central download redirector, which serves the meta data 
directly, but for the RPMs refers to the mirrors. So you get the latest 
repository state.

If you overtake its DNS record or be the man in the middle you can due to 
checking only replay old states.

So yes, their mirror was contacted, but the downloads were checked 
afterwards and would have been discarded if bad.

Also old repository states will not get old packages to be installed, 
since the conditions >= version still apply.


So they were able to get a mirror on the mirrorlist, but malicious 
attacks would not be possible.

(Log in to post comments)

Study: Attacks on package managers

Posted Jul 15, 2008 5:55 UTC (Tue) by afalko (subscriber, #37028) [Link]

All files downloaded from Gentoo have SHA1 and SHA256 sum associated with them. If a file does
not match the file the developer was using, the user will receive a digest error and the
package manger will not continue. Does any one see any loopholes with this scheme?

Study: Attacks on package managers

Posted Jul 15, 2008 11:17 UTC (Tue) by Zenith (subscriber, #24899) [Link]

Quoting rgmoore further up in the discussion:

Someone on Slashdot pointed out a much nastier potential attack. The process is simple: 1. Set up a mirror. 2. Wait for the distro you're mirroring to send out a security update for a package with a remotely exploitable hole. 3. Root the box of everybody who starts to download the updated package. The mirror can look completely legitimate, because it just passively harvests the IDs of vulnerable computers. You probably want to pass off the job of rooting vulnerable computers to a separate botnet to keep your mirror looking squeaky clean.

So yes, a sort of loophole, but not one you can do much about I would think, besides from the whole "trusted mirrors only" scheme mentioned here in the discussion.

Study: Attacks on package managers

Posted Jul 15, 2008 11:46 UTC (Tue) by job (subscriber, #670) [Link]

Are all the ebuilds cryptographically signed now? Last time I checked they were not. So the
reason you needn't worry about the attacks described in the article is that the verifications
aren't there in the first place.

Study: Attacks on package managers

Posted Jul 17, 2008 8:08 UTC (Thu) by hickinbottoms (subscriber, #14798) [Link]

No, they're not signed. This means the SHA1/MD5 checks only protect you from corruption during
the download (or subsequently on disk, before the package has been built).

You can prove this yourself - you can modify the downloaded package and regenerate those
hashes with a "ebuild ... digest" command, so there's no secret to it.

Portage is, I believe, quite vulnerable to compromised mirrors at present. I believe the
groundwork to GPG-signing (not sure if that covers the package only, or whether it includes
the metadata) has been done some time ago, but it's not progressed to the point where that's
utilised yet.