1

I have a custom Debian router installation which I'm trying to keep both secure and low-maintenance. I've therefore set some scripts which keep my Docker containers, blocklists, and OS (security updates only) actual by checking for updates and downloading the new files from the source (e.g. Github, Debian.org).

But whilst this may seem good on the surface, there have been attacks in the past which have hijacked the source packages (can't remember exactly, but I think there have been a few), essentially leaving those dependant on those files open to a supply chain attack.

Were such an attack to take place, this would mean the system would be compromised and because it's low maintenance I wouldn't necessarily find out straight away that such a supply chain attack had taken place.

Which would be the better thing to do? Use outdated packages and risk an RCE, or auto-update but risk a supply chain attack? I guess it's down to risk management really, but I'm not entirely sure.

2
  • 1
    There is no clear answer. As you propose yourself - this is down to risk management which is very individual to your specific use case. Commented Feb 26, 2023 at 12:22
  • This talk explores multiple aspects of this space, worth watching: vimeo.com/267445424
    – buherator
    Commented Feb 26, 2023 at 16:24

1 Answer 1

2

The risk of supply chain attacks is generally lower than that of outdated software. This is, because it's generally easier for trusted developers to publish mistakes, than it is for malicious developers to become trusted and disguise malicious code as an "honest mistake".

You should further note that "compromised packages" (e.g. deliberate supply chain attacks) tend to be found rather quickly and are subsequently patched. So the "window of exploitation" is usually rather small.

So in order to be compromised, your system would need to be attacked by someone knowing of the SCA during the exact window it is vulnerable. Possible, but very unlikely.

Compare this to the risk of using outdated software for a very long time. The vulnerabilities tend to become publicly known (e.g. assigned a CVE-ID), and after that, your system will remain vulnerable, as you never update.

In other words: Updating often while being on a "stable" OS branch is the best way to go (as to avoid breakage through updates)

4
  • 2
    "malicious developers to become trusted" - supply chain attack don't necessarily need malicious developers. NotPetya, the Solarwinds hack or the Kaseya VSA hack all were caused by hacking the suppliers (i.e. vendors or service providers), not by malicious developers being trusted. Commented Feb 26, 2023 at 17:33
  • What length of time would a small exploitation window cover? The auto-update procedure usually takes place once a day Commented Feb 26, 2023 at 19:12
  • @SyntheticAscension In that case, roughly a day.
    – Frittata
    Commented Feb 27, 2023 at 10:04
  • @SteffenUllrich True. It's still more likely that an old package has a vulnerability than for a debian repository to get hacked.
    – Frittata
    Commented Feb 27, 2023 at 10:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .