0

I can't seem to find too much on this, but I'm worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification.

I'm worried, especially since I don't trust the security of my family's router (though their modem seems to be fine, it's new and a recent Xfinity modem with maybe a custom password, maybe not on second thought, but still, at least it's recent) so I'm worried a remotely-accessing-the-router MITM attack could ruin my file.

And, after all that, I'm worried it'll infect my computer as it needs root permissions to write the .iso to a drive via Etcher. Etcher is Electron-based, so it might have some sandboxing, but I'm not sure. I'm not sure, but at the same time, it's just only copying and extracting the file and partition structure to a USB stick, not reading anything as far as I know, so I'm not sure.

Improve this question
6
  • Checking the hash of the downloaded ISO file and compare it with the one on their website should give you a fair indication if the ISO file has been tampered with. I doubt it is easy to tamper with an ISO image while in transfer. – Jeroen Feb 16 '19 at 8:01
  • I know that, hence the "after realizing I downloaded my Raspbian image from HTTP" part. Thanks for telling me about checksum verification, but my point was that I forgotten in the first place, oops, not that I haven't even known about verification. :P – RoundDuckMan Feb 16 '19 at 8:04
  • 2
    Yes, but you should still verify it in order to determine whether your image has been tampered with and need to re-install your Raspberry Pi or not. – Jeroen Feb 16 '19 at 8:08
  • Yeah, but I already wiped the USB stick with the unverified Raspbian copy, then downloaded and sum-checked a new Raspbian copy, then installed that into the USB stick. – RoundDuckMan Feb 16 '19 at 8:18
  • 1
    Problem solved. – Jeroen Feb 16 '19 at 10:01
2

That would require the disc writing software being vulnerable, and even if someone really tampered the image, the Raspberry Pi is a lot better target than trying to guess what software you use for burning the disc and how to efficiently take that in advantage.

For that, an attacker would have needed to know you were about to update your Raspberry Pi and that you are burning or downloading that image using a vulnerable software. That is highly unlikely. The effort is way too much compared to all the easier methods to get into your system. (Also, knowing all these prerequisites would mean he already has an access, making the effort unnecessary.)

Improve this answer
4
  • So what do you mean as "vulnerable?" Like the possibility to inject code, allow code execution (like Gnome Nautilus' thumbnail vulnerability) or a buffer overflow? The kind of stuff that, which, when dealing with an often updated piece of software like Electron (and thus, Etcher), is a bit more on the impossible side to infect? – RoundDuckMan Feb 16 '19 at 21:37
  • 1
    There would have to be something that allows handling pieces of the file in a way that executes code on the system. Even normal .iso images contain executables, but they are not treated as executables during burning the image to a disc. – Esa Jokinen Feb 17 '19 at 6:06
  • @Esa_Jokinen, yeah, that seems to make sense. I've been a bit too paranoid, lol. – RoundDuckMan Feb 18 '19 at 19:17
  • It's good to be paranoid, but not to the extent it gives you insomnia. :) – Esa Jokinen Feb 18 '19 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.