Tag Info

New answers tagged

0

Short answer Yes it is possible and aside from gpg-checking there are still several possible attacks! To tackle it, I would make sure that the automated update process does at least signature checking, use HTTPS for my repos, and possibly run a validating caching nameserver locally (DNSSEC) like Joe Sniderman suggests All this does still not ensure you ...


-1

It really depends on your threat model. If you are hosting some Wikileaks-grade document, that might be a very real threat. If it's just a casual server on the Internet, you'll just want to update as often as possible way before worrying about this kind of attack.


4

Yes it is possible to do a cache poisoning attack, and yes it is possible to protect yourself. In addition to the rather standard practice of signing the package files with GPG, some distros use DNSSEC to protect the domains that serve those files against DNS spoofing. Notice the 'ad' flag in the dns answer below: $ dig +dnssec security.debian.org. ; ...


2

To answer your question, it is possible to spoof the update servers DNS; then, your packet manager should not install unsigned packets, an attacker could send you bad data, but you wouldn't accept it. Most distributions use PGP to sign their updates. Fedora and Debian do for example. You just have to make sure that your automated option validates updates ...


-1

I installed Dnssec Trigger which includes Bind on my pc. There is a local key on your machine. I'd like to find a service which includes both DNS protocols since they are not exclusive. From their website. Dnssec trigger enables the end-host (laptop or desktop computer) to use DNSSEC protection for the DNS traffic. DNS translates names of computers into ...



Top 50 recent answers are included