How to verify integrity of software when the download provider doesn't publish hashes?

Question

I noticed that certain software does not provide hash anymore nowadays.

E.g.

1. Zoom

https://zoom.us/download

wolf@linux:~$ ls -lh zoom_amd64.deb 
-rw-rw-r-- 1 wolf wolf 44M Jan   1 00:00 zoom_amd64.deb
wolf@linux:~$ 

I've googled both md5 and sha256 hashes but couldn't find it.

wolf@linux:~$ md5sum zoom_amd64.deb 
5f452b11d86d41e108a32f6a7d86c6dc  zoom_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ sha256sum zoom_amd64.deb 
b06bc30a53ac5d3feb624e536c86394ccb9ac5fc8da9bd239ef48724138e9fc1  zoom_amd64.deb
wolf@linux:~$ 

2. Vivaldi Browser

https://vivaldi.com/download/

wolf@linux:~$ ls -lh vivaldi-stable_3.5.2115.81-1_amd64.deb 
-rw-rw-r-- 1 wolf wolf 74M Jan   2 11:08 vivaldi-stable_3.5.2115.81-1_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ md5sum vivaldi-stable_3.5.2115.81-1_amd64.deb 
f6dce2ca099e9e910ca6dc1c361aa5b5  vivaldi-stable_3.5.2115.81-1_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ sha256sum vivaldi-stable_3.5.2115.81-1_amd64.deb 
38a18fe2624994cbc9782d7805ec058774e54e99e0ade6ad5e85da45055c9e5c  vivaldi-stable_3.5.2115.81-1_amd64.deb
wolf@linux:~$ 

3. Microsoft Teams

https://www.microsoft.com/en-my/microsoft-teams/download-app#desktopAppDownloadregion

wolf@linux:~$ ls -lh teams_1.3.00.30857_amd64.deb 
-rw-rw-r-- 1 wolf wolf 73M Jan  20 09:07 teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ md5sum teams_1.3.00.30857_amd64.deb 
3d738e013804b96f401bd274db4069d1  teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ sha256sum teams_1.3.00.30857_amd64.deb 
5058b1fe8bf9fffc57d94148a7ec55119c5cd9b21aa267cb13518bec0244241b  teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 

How do we verify software like this to make sure nobody has ever tampered with it?

Answer 1

You are download via HTTPS, so the entire download is protected by TLS.

Publishing the hashes to protect against anti-tamper is a moot point here, because if any attacker have access to vivaldi.com and can alter the downloadable binary, he can alter the website and change the published hash too. A hash is good if the download is not hosted on the same server as the download page. But if both are on the same server, they cannot protect anything.

The installation package usually is digitally signed. You can check Windows executables and .deb packages for the signature, and see if they match.

Answer 2

On Linux, you have to trust the owners of the software repository that you're using, or contact the developers yourself. Using hashes as signatures on files is going out of favor because, for most cases where the download link is right next to the MD5/SHA hash, then if someone has compromised the download location, they have also compromised the website, and those hashes are useless.

In other words, plain hashes to verify that an attacker hasn't replaced your file has been nothing but security theater for a very long time.

Some package management systems allow developers to sign their package. If you feel as if the software may have been tampered with by an intermediary, you should inspect the signature and the certificate that it references.

Answer 3

If the checksum hash and the downloadable file are hosted at the same site, then there is little or no security benefit, as pointed out in the other answers.

However, many sites rely on untrusted sites to host downloadable files, such as mirror sites or CDN's. This is common for sites that provide various Linux distributions, such as Tails. In this case, it is critical that the site publishes a checksum hash of the downloadable file, to mitigate the threat of the file being compromised while hosted on the untrusted server. Users that download the file from the untrusted site should use the hash published at the trusted site to verify the integrity of the file after downloading the file. If the actual hash of the downloaded file does not match the expected hash of the file publshed at the trusted site, then it's possible that the file may have been compromised while hosted on the untrusted site.

Tails has even gone as far as building an automated tool for this purpose. See https://tails.boum.org/contribute/design/download_verification/ and https://tails.boum.org/news/verification_extension_deprecation/index.de.html.

Also for more information, see: https://blog.acolyer.org/2018/11/28/towards-usable-checksums-automating-the-integrity-verification-of-web-downloads-for-the-masses/