Attacks against GPG signed APT repositories
blog.packagecloud.io
Attacks against GPG signed APT repositories
1–10 of 14 posts
Re: Attacks against GPG signed APT repositories
#2This is such a frustrating clickbait headline!
Most of the 'attack' s are:
1. Plain old bugs in apt. 2. Involve disabling the very security features (GPG and checksum verification) designed to prevent that attack!
Re: Attacks against GPG signed APT repositories
#3--force-yes is bad, but for reasons that have nothing to do with replay attacks.
This option effectively disables package authentication. This is because it forces "yes" answer to all questions, including the question about installing unauthenticated packages.
Re: Attacks against GPG signed APT repositories
#4For a moment I thought there's a new research paper about attacks on APT. Nope. The paper the article links to is from 2008.
Re: Attacks against GPG signed APT repositories
#5This is such a frustrating clickbait headline! Most of the 'attack' s are: 1. Plain old bugs in apt. 2. Involve disabling the very security features (GPG and checksum verification) designed to prevent that attack!
Additionally the article appears to intentionally conflate "issues" such as "if you turn security off" or "if the repository isn't signed" to make their list of possible issues look bigger. None of these are "Attacks against GPG signed APT repositories".
Re: Attacks against GPG signed APT repositories
#6The main recommendation is "always serve your apt repo over TLS", however, apt doesn't use TLS by design: https://whydoesaptnotusehttps.com/
Re: Attacks against GPG signed APT repositories
#7This is such a frustrating clickbait headline! Most of the 'attack' s are: 1. Plain old bugs in apt. 2. Involve disabling the very security features (GPG and checksum verification) designed to prevent that attack!
Additionally the article appears to intentionally conflate "issues" such as "if you turn security off" or "if the repository isn't signed" to make their list of possible issues look bigger. None of these are "Attacks against GPG signed APT repositories".
What about replay attack? Providing apt with old metadata and packages?
Re: Attacks against GPG signed APT repositories
#8Earlier quoted context omitted.
Additionally the article appears to intentionally conflate "issues" such as "if you turn security off" or "if the repository isn't signed" to make their list of possible issues look bigger. None of these are "Attacks against GPG signed APT repositories".
What about replay attack? Providing apt with old metadata and packages?
The release files have 'Valid-Until' fields, which will cause apt to reject it on replay.
Re: Attacks against GPG signed APT repositories
#9For a moment I thought there's a new research paper about attacks on APT. Nope. The paper the article links to is from 2008.
Yep, and the information is still relevant! The article explains how it applies to recent versions of APT in the current Ubuntu LTS releases.
Re: Attacks against GPG signed APT repositories
#10The main recommendation is "always serve your apt repo over TLS", however, apt doesn't use TLS by design: https://whydoesaptnotusehttps.com/
The website you linked to has several factual errors, as explained in the article.