30

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?

  • 2
    this is distro-related, so you should ask in the forum of each of them – eez0 Jul 5 '16 at 18:18
  • 6
    Linux mint ISO repository was powned this year: arstechnica.com/security/2016/02/… The attacker substituted a fake ISO so this is not exactly at depo side but maybe this information can interest you – Sibwara Jul 5 '16 at 18:39
  • 8
    Don't most major distributions package systemd these days? – R.. Jul 5 '16 at 20:36
  • 5
    You ask one question in the title, and then two other entirely different questions in the body. Don't do that. That's misleading. The title should match the body of your question. Also, we want you to ask only one question per question; this site doesn't work as well if you ask multiple questions. As it stands, this question is too broad ot be a good fit here. I suggest you edit your question to narrow it down to ask only one question. You can post the other questions elsewhere. – D.W. Jul 6 '16 at 0:38
  • 1
    Somewhat related: there was an unsuccessful attempt to add a backdoor to the Linux kernel in 2003. Interesting read. – marcelm Jul 6 '16 at 10:14
18

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code through checks and balances in what code is accepted into the mainline source code repository, and checksums. The issues revolve around whether or not an attacker can modify checksums without detection. Most, if not all, developers are quick to detect changes and address them accordingly.

One of the issues surrounding "how did the hackers get in" revolved around an attacker targeting a developer, then using that developer's credentials to make changes. That was addressed using two factor authentication (2FA). Which makes it more difficult than a typical attack (exploits, social engineering, brute forcing).

Each distribution is likely to have their own checks and balances in place, but it usually boils down to audits, checksums, and anomaly detection.

  • 22
    Your links about Ubuntu and the Linux kernel are misleading - one was the Ubunu community servers, and it sounds like they became part of a botnet, and the Linux kernel.org was totally unrelated to the kernel source code. The only legitimate one in your list is is Mint, which was was done by redirecting the download link presented by the front-end, rather than by injecting malware into the legitimate source. – Mark Henderson Jul 5 '16 at 21:47
  • @MarkHenderson I beg to differ (Kernel.org) and it all boils down to who you ask. (See notes on thread not that Reddit is a defacto must read reddit.com/r/archlinux/comments/k0oot/…). I didn't post about Debian (linuxinsider.com/story/32240.html), nor did I link RedHat which had code repos compromised (zdnet.com/article/…) I didn't feel like doing the obvious (Googling) and typed based on recollection – munkeyoto Jul 5 '16 at 22:01
  • 6
    Doesn't this question ask about package repositories, not the core operating system? – Sam Weaver Jul 6 '16 at 1:55
  • 2
    @SamWeaver Yeah, but if your OS is bonked then your repos don't matter. – wchargin Jul 6 '16 at 5:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.