34

I am wondering exactly how safe are the Arch, Ubuntu, Mint and Manjaro repositories. What testing is done to ensure that a trusted user does not place a virus in a package, and how often?

15
  • 2
    this is distro-related, so you should ask in the forum of each of them
    – user15194
    Jul 5, 2016 at 18:18
  • 6
    Linux mint ISO repository was powned this year: arstechnica.com/security/2016/02/… The attacker substituted a fake ISO so this is not exactly at depo side but maybe this information can interest you
    – Sibwara
    Jul 5, 2016 at 18:39
  • 8
    Don't most major distributions package systemd these days? Jul 5, 2016 at 20:36
  • 5
    You ask one question in the title, and then two other entirely different questions in the body. Don't do that. That's misleading. The title should match the body of your question. Also, we want you to ask only one question per question; this site doesn't work as well if you ask multiple questions. As it stands, this question is too broad ot be a good fit here. I suggest you edit your question to narrow it down to ask only one question. You can post the other questions elsewhere.
    – D.W.
    Jul 6, 2016 at 0:38
  • 1
    Somewhat related: there was an unsuccessful attempt to add a backdoor to the Linux kernel in 2003. Interesting read.
    – marcelm
    Jul 6, 2016 at 10:14

1 Answer 1

19

Linux Mint was compromised and a backdoored ISO was deployed, Ubuntu was compromised, the entire Linux Kernel was compromised before, as were others (Debian, FreeBSD, etc). Developers protect code through checks and balances in what code is accepted into the mainline source code repository, and checksums. The issues revolve around whether or not an attacker can modify checksums without detection. Most, if not all, developers are quick to detect changes and address them accordingly.

One of the issues surrounding "how did the hackers get in" revolved around an attacker targeting a developer, then using that developer's credentials to make changes. That was addressed using two factor authentication (2FA). Which makes it more difficult than a typical attack (exploits, social engineering, brute forcing).

Each distribution is likely to have their own checks and balances in place, but it usually boils down to audits, checksums, and anomaly detection.

5
  • 24
    Your links about Ubuntu and the Linux kernel are misleading - one was the Ubunu community servers, and it sounds like they became part of a botnet, and the Linux kernel.org was totally unrelated to the kernel source code. The only legitimate one in your list is is Mint, which was was done by redirecting the download link presented by the front-end, rather than by injecting malware into the legitimate source. Jul 5, 2016 at 21:47
  • @MarkHenderson I beg to differ (Kernel.org) and it all boils down to who you ask. (See notes on thread not that Reddit is a defacto must read reddit.com/r/archlinux/comments/k0oot/…). I didn't post about Debian (linuxinsider.com/story/32240.html), nor did I link RedHat which had code repos compromised (zdnet.com/article/…) I didn't feel like doing the obvious (Googling) and typed based on recollection
    – munkeyoto
    Jul 5, 2016 at 22:01
  • 6
    Doesn't this question ask about package repositories, not the core operating system?
    – Sam Weaver
    Jul 6, 2016 at 1:55
  • 2
    @SamWeaver Yeah, but if your OS is bonked then your repos don't matter.
    – wchargin
    Jul 6, 2016 at 5:01
  • this answer missed the point "a trusted user does not place a virus in a package". by "trusted user" he means package maintainers who use repository and probably also the heads of repository/distro who keep and use repo's private key, and also repo and build server admins. that 2-3 people can organise in a group and put a malware in package, and they are trusted people, trusted by distro users...
    – qdinar
    Sep 14, 2020 at 15:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .