0

I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS!

Do you think there's a risk for a man-in-the-middle attack?

Improve this question
2
  • 4
    It depends if the downloaded file is signed with it's metadata (version number). Using HTTP to distribute signed updates is common because it allows caching of the file by content distributors. So, the real question is: is the update signed? And is the associated metadata signed with it (to avoid rollback to a previous vulnerable version)?
    – A. Hersean
    Commented Oct 9, 2020 at 11:58
  • "... it allows caching of the file by content distributors" thanks, now I know something new!
    – Seraphim's host
    Commented Oct 9, 2020 at 12:24

1 Answer 1

Reset to default
3

According to online reports (bug tracker, reddit) and tweets from the authors it appears that:

  • The updates are signed by PGP (good)
  • The version is checked to avoid downgrade attacks (good)
  • The signature use an old 1024 bit DSA key, never renewed (bad)

We can conclude:

  • This mechanism is not at the sate of the art because of a deprecated signing algorithm, but the overall design is sound.
  • Since DSA 1024 has not yet been broken, it is still safe, but it might not be in 10 years. The lifespan of a VLC installation without update is far shorter than that, so an exploitation of this weakness is very extremely unlikely.

In summary: VLC updates are safe for now, but the update mechanism should be upgraded to a state of the art algorithm, which does not necessitate HTTPS.

Improve this answer
1
  • Well, I completely ignored the signature check process in my mind. They key is "...which does not necessitate HTTPS". That's enough for me! Ok thanks!
    – Seraphim's host
    Commented Oct 9, 2020 at 12:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .