3

My basic question is this:

When we are using the Linux / Debian apt-get or yum package system, we're placing a lot of faith in that the packages we're downloading and installing are secure. For that matter, even downloading Linux images from Ubuntu or Debian or Red Hat or whatever, we are assuming these servers are secure and the sources are trustworthy.

Given that there's a broad variety of distros, package managers, mirrors, and sites serving us this content, it seems worth questioning the security of this whole ecosystem.

How secure is this open-source software ecosystem from nation-state security department hackers?

As we know, our own "guv'mint" has already been responsible for compromising the servers and security standards of other open-source projects such as the SSL encryption standard, and implicated in hacking private corporate systems which we rely on (Google/Gmail), which gives me reason to consider how many possible attack vectors there could be in an ecosystem as complex as the open-source / unix / linux community is.

To give a concrete example:

If I use Ubuntu's apt-get package manager in the US (or another country), I am blindly downloading packages from servers hosted in that nation and assuming that the software I'm installing is safe. What is there to secure that the servers haven't been compromised, or had malicious code embedded in trusted software packages? It seems like a likely target for nations with Information security departments which have strong ambitions towards controlling cyberspace.

  • What do you mean with security? how secure program 'x' is out of the (apt-repo) box? or do you mean the security of the APT system to validate only the original maintainer is packaging the package you download? – LvB Apr 7 '16 at 9:30
  • From the tag wiki: "APT Stands for 'Advanced Persistent Threat'." Are you suggesting that a package manager or the repository that it accesses could harbor one? – Damian Yerrick Jan 8 '17 at 17:42
6

It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they need to do is compromise one build machine to gain near-universal control.

Attempting to protect against this is hard, and the only way to do it is to build on lots of machines and diff the outputs (which isn't always feasible due to the entropy involved in minute package version changes across build systems). This isn't cost or time effective for open source, so it isn't done.

Realistically, if your adversary is a nation state and they actually give a crap about getting at your stuff, you're likely not going to win that fight unless you're also a nation state with a capable security budget and a big helping of luck.

As James Mickens said in his brilliant paper "This World of Ours":

If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT.

The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn't us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them.

TL;DR - Including nation states in your threat model is essentially equivalent to including wizards in your threat model: nobody really understands what they're capable of, and nobody really has any reasonable capability of defending against them.

  • I think some people claim to know what wizards can do: rpg.stackexchange.com Overall though, exactly right - you can't protect against the unknown. – Matthew Apr 7 '16 at 9:36
  • 1
    @Matthew also some guys at scifi.stackexchange.com .The only case where including nation states in your threat model is justified is when you are in charge of protecting extremely sensitive assets (aerospace, telecom,...) AND you have a lot of resources. Other than that, there are too many unknown attack vectors ("things we do not know we don't know") and too many known attack vectors which you cannot prevent with a reasonable budget. – A. Darwin Apr 7 '16 at 9:40
  • @Polynomial - Assuming that the intent is to protect against most threats other that nation states, what is the most effective way of verifying packages across multiple distributions before and after installations? – Motivated Jan 27 at 19:17
  • @Motivated That's an entire question unto itself. Probably better to open a new one than ask for ideas in comments here. – Polynomial Feb 3 at 20:46
1

Debian and Ubuntu packages are signed with GPG keys, making it pretty hard to replace a software package in the repository with another one.

For the installation medium itself (the ISO) there are some hashes and GPG signatures available, but these are not automatically checked. This makes it possible to swap the installation ISO with another one, as happened with Linux Mint.

0

If you haven't already, please read the fantastic answer by Polynomial before reading this. IMO he's totally on the money!

I particularly couldn't help but laugh (because I'd rather not cry ATM) at this:

Including nation states in your threat model is essentially equivalent to including wizards in your threat model[!]

Having said that, Debian are making significant efforts to reduce the attack vectors.

Arguably the most important of these is the Reproducible Builds project. It's still doesn't have full coverage, but significant progress is being made. Whilst still not infallible, it certainly raises the bar.

There are also other efforts, e.g. Declarative Packaging, which should also improve the security of package installs (especially packages installed from third party repos).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.