I saw VLC (Windows) gets updates from an unencrypted URL: HTTP, not HTTPS!

Do you think there's a risk for a man-in-the-middle attack?

  • 4
    It depends if the downloaded file is signed with it's metadata (version number). Using HTTP to distribute signed updates is common because it allows caching of the file by content distributors. So, the real question is: is the update signed? And is the associated metadata signed with it (to avoid rollback to a previous vulnerable version)? – A. Hersean Oct 9 at 11:58
  • "... it allows caching of the file by content distributors" thanks, now I know something new! – Seraphim's host Oct 9 at 12:24

According to online reports (bug tracker, reddit) and tweets from the authors it appears that:

  • The updates are signed by PGP (good)
  • The version is checked to avoid downgrade attacks (good)
  • The signature use an old 1024 bit DSA key, never renewed (bad)

We can conclude:

  • This mechanism is not at the sate of the art because of a deprecated signing algorithm, but the overall design is sound.
  • Since DSA 1024 has not yet been broken, it is still safe, but it might not be in 10 years. The lifespan of a VLC installation without update is far shorter than that, so an exploitation of this weakness is very extremely unlikely.

In summary: VLC updates are safe for now, but the update mechanism should be upgraded to a state of the art algorithm, which does not necessitate HTTPS.

| improve this answer | |
  • Well, I completely ignored the signature check process in my mind. They key is "...which does not necessitate HTTPS". That's enough for me! Ok thanks! – Seraphim's host Oct 9 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.