Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apt security update

lists.debian.org

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Apt security update

#11

Post by hadoukenio »

TimWolla wrote: post #10
hadoukenio wrote: post #9

Earlier quoted context omitted.

What about it? That's the URL for the Debian mailing list and not where packages are downloaded from. In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too! The MITM for APT is the elephant in the room here.

Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.

No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install packages, they too are being installed via HTTP.

Re: Apt security update

#12

Post by TimWolla »

hadoukenio wrote: post #11
TimWolla wrote: post #10

Earlier quoted context omitted.

Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.

No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install pack…

apt checks the package signatures using GPG.

Re: Apt security update

#13

Post by vWil »

hadoukenio wrote: post #11
TimWolla wrote: post #10

Earlier quoted context omitted.

Luckily it only affected fetching the source and not the pre built binaries. Otherwise this would be a total nightmare.

No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install pack…

See https://wiki.debian.org/SecureApt and https://www.debian.org/CD/verify

Re: Apt security update

#14

Post by stevekemp »

Alupis wrote: post #5

This seems like a relatively low impact security problem. I can't recall the last time I used a package manager to get a package's source. (Usually when I want the source it's because I'm compiling a package from source, and I get the tarball from the project's website)

I audit software, so frequently I'll pick targets on my Debian system(s) and run:

    apt-get source $foo
That gives me all the source to read, and is something I do at least once a week.

Re: Apt security update

#15

Post by hadoukenio »

TimWolla wrote: post #12
hadoukenio wrote: post #11

Earlier quoted context omitted.

No, the nightmare is still there. Most Debian mirrors only serve HTTP and you most likely installed Debian from an ISO that you downloaded over HTTP. And when you did an md5 of the downloaded ISO you probably compared it to a fingerprint hosted on a website served via HTTP (at the same time forgetting that md5sum could have been compromised itself since you downloaded it via HTTP). Then when using APT to install pack…

apt checks the package signatures using GPG.

It checks and verifies using the tools you downloaded via HTTP which could have been compromised via MITM?

Re: Apt security update

#16

Post by pflanze »

Alupis wrote: post #5

This seems like a relatively low impact security problem. I can't recall the last time I used a package manager to get a package's source. (Usually when I want the source it's because I'm compiling a package from source, and I get the tarball from the project's website)

I often recompile packages from testing or unstable on stable, to get newer versions, or because I need to patch something. This is usually more productive than installing from upstream source. (Exceptions are packages with a big tree of dependencies, where chances are high that something won't build.)

More often than not, I'm checking the source package signautures (gpg) myself, though, because in the past doing it automatically wouldn't work or so. I wonder whether those signatures are concerned in this bug. I've tried to get at the source repo, but no luck (stable has a bzr repo that redirects to a 404, another url nearby does not contain recent changes; sid is in Git, but doesn't appear to have changes related to the bug). In the end I diffed the source of the apt package against its former version, I've put the diff here:

http://christianjaeger.ch/scratch/apt-0.9.7.9+deb7u1_apt-0.9...

I haven't studied it enough to get the answer (yet).

Edit: it seems this really concerns repository signatures only, not package signatures; assuming that you're verifying that the package signature (the one in the *.dsc file) is correct and the hash sums match the package files, the only possible attack will be to refuse access to the correct/latest version of the package.

Edit 2: but as the bug report points out, the .dsc signature check can't be relied on automatically (even if the check fails, apt returns success, you have to read the stdout/stderr instead). https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=749795

So the only way to have been safe was to check every apt-source'd package individually, with manual eyeing or running of gpg.

And, this bit (from the bug report) may be most worrysome: "(..) all debian build systems which probably rely on secure APT." (i.e. the binary packages may have been built automatically based on source that was fetched without protection).

Re: Apt security update

#17

Post by nisa »

hadoukenio wrote: post #9
TheHippo wrote: post #8

Earlier quoted context omitted.

Looks fine: https://www.ssllabs.com/ssltest/analyze.html?d=lists.debian....

What about it? That's the URL for the Debian mailing list and not where packages are downloaded from. In fact, you download packages from Debian mirrors and most of these are over HTTP and not HTTPS. How do you know you're not downloading a compromised APT? Checksums you say? Don't forget you downloaded the package footprints via HTTP too! The MITM for APT is the elephant in the room here.

Packages are signed using GPG keys from the package maintainers. The private keys are in an ideal world never even near the machine that serves the package to you.
Post reply on HN