1

Theoretically, the answer could be yes since you increase the attack surface. However, I was wondering if in practice it really makes a difference. I am mostly worried about exploits for web facing applications like browsers, irc software, web servers ...

As long as the software that gets installed does not interact with those applications directly or indirectly e.g by parsing downloaded files I don't see how it would lead to more relevant vulnerabilities. But it could maybe make things easier for an attacker after he/she exploited the vulnerability.

  • 1
    Yes, it does make a difference in practice. But what really matters is your threat model. Simply adding software does nothing (unless it's setuid), whereas actually running them increases attack surface. – forest Apr 2 '18 at 9:07
2

One can not fully trust any program one has installed because it might have unintentional bugs which can be exploited, intentional backdoors, features one is not aware of etc. It is practically impossible to determine what the program really does just be reading the description of the program - the real functionality will probably overlap with the claimed functionality but they might not be equal. Programs might also unintentionally replace libraries used by other programs and thus cause instabilities or even security issues in the other programs. Many programs also phone home to get updates and often the updates are delivered in an insecure way and can be hijacked for malicious reasons. Or the update server of the software author got hacked in malware is delivered to the system instead of updates.

And the more programs one has accumulated on your system the larger the risk is, especially if these programs are complex, no longer maintained or of questionable origin (like downloaded somewhere from the internet).

1

It is generally a useful rule of thumb that the more moving parts your system has, the higher is the risk that something moves in an unexpected ways, and the higher the risk of unexpected happenings, the higher the potential for exploitation.

There's an obvious and well-understood risk of exposure from installing network services, but even presence of non-networked software packages in a system may present security concerns. For example, console video access on Linux systems used to need high-level privileges. Because of this, a number of early video games designed for or ported to GNU/Linux systems include suid-root executables so that ordinary users could be able to play these games. One might hope that the programmers did good work and the games handle their great power responsibly; however, a security analyst knowing that hope is not a strategy might be able to find exploitable vulnerabilities in such games. This might be even easier than finding vulnerabilities in more modern software packages, because many of these games were written years ago, before certain modern techniques of exploitation and protection against it were discovered, and they may also not be actively maintained any more.

On another note, software systems are often designed in extensible manner, and it is common for installed software packages to hook into such extension mechanisms. For example, consider a workstation that has a web browser installed. What might be expected to happen if you install a package for processing some sort of exotic file format? Quite possibly, the package will helpfully tell the browser that it knows how to handle this exotic file format, and the browser may then be inclined to hand over files in such a format when encountering them, rather than treat them as mere opaque octet streams as it would do if the package was not installed. If, now, the exotic package has vulnerabilities, this convenience may expose these vulnerabilities to the wide web, and increase the whole system's risk of exploitation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.