2

Yesterday I updated my debian server using:

apt-get update && apt-get upgrade

I received message that some of the packages cannot be authenticated being in a rush I hit yes to install anyway. Now thinking back was a bad decision, what if someone was doing MITM and installed a backdoor on my server?, after all debian does not use SSL for it's repository.

How can I view witch packages were installed unauthenticated ? I can't remember. Also what you recommend in this case

5

You can check it at /var/log/apt/history.log . There you'll find info about what packages were installed by users in the system. I think there is no info about the repository from they were installed. Anyway you can get that info with dates. I guess you know when exactly this happened.

Hope it helps.

1

While at it, you better educate yourself about what SSL/TLS really does.

If Debian used SSL for its repositories, it would have not helped you one single bit, unless you had actually manually configured APT to only trust a specific server certificate signature. And even then, it would have not protected you should that mirror be compromised.

Besides, the Debian mirror network uses rsync to propagate changes. It really, really depends on the data-at-rest crypto (the apt signatures) to ensure packages are not modified. HTTPS is utterly useless in that scenario.

  • 2
    A few of the Debian repositories offer access over HTTPS, and using HTTPS can protect against certain types of breach of confidentiality. For example, it makes it more difficult (note here that I very specifically avoid saying not possible) for a third party to determine which software packages you install on your system. – a CVn Jan 15 '17 at 20:36
0

In the future, one easy way to avoid this is to execute two separate commands:

# apt-get update
# apt-get upgrade

At the prompt warning that 'packages cannot be authenticated' hitting Enter or n would have returned you to a safe place where updating again(possibly with an improved network connection or signal) will usually fix the error.

As for trying to figure out what you may have installed and if it was malicious, you'd be better off just chalking this up to a learning experience and starting over from square one.

You need to fully appreciate the irreparable damage that can be done if careless when logged in as super user.

0

Depending on how paranoid you are, this can be tricky.

You can use debsums to checksum the packages matches expected metadata. However, if your system is compromised, the malicious package could also have modified your package manager to install a fake debsums that tells you everything is all right. The malware could have also altered all sorts of system executables to hide itself, sha1sum, ls, cat, bash, etc could all have been altered to lie about the existence of the malware. They could lie about the existence of the file, or alter the file content on the fly to hide all traces of the malware. It could also have installed a rootkit that modifies the kernel and bootloader to lie about file contents.

The only sure way to detect here is to disconnect your hard-disk and do your forensics from a trusted machine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.