up vote 11 down vote favorite
1

I think the title says everything, how secure is it to use apt-get in a network with an attacker who injects his own packets and blocks the original packets (man in the middle).

share|improve this question
up vote 10 down vote

All of packages within the Ubuntu and Debian apt repositories are signed using SecureApt. Asymmetric cryptography is very secure and its highly unlikely that you will be compromised in this way. 3rd party repositories are hit and miss, they may or may not be singed. If they aren't signed, apt should throw a warning informing you that you are installing an unsigned package. But if its from a 3rd party you could also just be installing a backdoor, so make sure you trust that source.

On a side note, people don't really "inject packets" to perform MITM. They are going to use something like DNS cache poisoning or ARP table poisoning so that you download the package from an HTTP server that they control. This isn't an injection attack.

share|improve this answer
    
It is possible to hijack a TCP session by predicting sequence numbers and injecting packets with that sequence numbers. – ceving Jan 2 '12 at 19:49
    
@ceving is that really injection? I mean you are building a arbitrary packets (often called forging) and calling a function to put them on the wire. By your logic wouldn't my HTTP request to secuirty.stackexchange.com be an injection? – rook Jan 2 '12 at 19:54
    
Example: Alice sends a request to Bob. Bob intends to send a reply. Eve knows the sequence number of the first packet Bob will send and injects packets to Alice while at the same time sending Bob a RST. By this Eve has taken over the session by injecting some packets after the session has been established. If you initiate a HTTP request and complete it correctly there is no kind of injection. – ceving Jan 2 '12 at 20:07
    
@ceving That is an injection attack. But that is something an evil isp is going to do to disrupt bittorrent, it is extremely unlikely that an attacker will be able to do this to hijack an APT repo. My point is that an attacker is not going to use injection to perform this specific attack or MITM in general. – rook Jan 2 '12 at 20:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.