For example, if I install Ubuntu in Dubai or in Saudi Arabia, I'll probably get a local mirror. Is there a way I can make sure that the ubuntu packages I get when I do apt-get update are the 'real' ones?

  • Make sure to use repositories accessed only through HTTPS (and not HTTP) to secure the transport and prevent hijacking there. It is only part of the solution but it is an important step. – Patrick Mevzek May 30 '18 at 23:10
  • Using HTTPS mirror improves privacy, but it is not necessary for package integrity. APT packages are cryptographically signed with GPG to prevent tampering by network MITM and compromised mirror. So using HTTP mirror is secure, with some caveats regarding privacy and update blocking. The main prerequisite is that you'll need to make sure your initial install was not tampered. – Lie Ryan May 30 '18 at 23:55

Take a look at man apt-secure, apt has done signature checks on release files for well over a decade. The release file contains a hash of all files in the package, and the release file gets signed by a trusted key that is included in the original installation media.

It looks like md5 is still widely used here, which is concerning but not necessarily a deal-breaker (collision attacks on md5 have been around for a long time, but preimage attacks aren't yet possible). It's not difficult to imagine a non-malicious file being included in a package that has the same md5 hash as a malicious file, in which case the malicious version could be distributed instead, but a collision attack like this would require the package maintainer's cooperation, so while not impossible it seems less likely (and you're trusting the package maintainer quite a bit already anyway).

  • 1
    Signature checking prevents giving you malware as long as you don't install any bogus keys, and neither does anyone else (including an evil maid or customs etc). An evil repo can: (1) deny having, and refuse/fail to give you, particular package version(s), which may make it difficult for you to fix a flaw; (2) record what package(s) you ask for and/or get (linked to your IP). – dave_thompson_085 May 31 '18 at 2:15
  • 1
    @dave_thompson_085 In theory, it could also exploit anything on the system up to the signature verification step, even without a valid signature. There have been a few RCE bugs in APT which could be exploited this way. – forest Jun 1 '18 at 0:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.