Installed some software over a public insecure wireless network — should I consider myself compromised?

Question

A couple months earlier, I made the mistake of downloading some software over an insecure wireless network and running it without checking its integrity. I am now considering reinstalling my system, as I am worried it might be compromised.

Should I consider myself compromised?

EDIT: Just to clarify: no credentials were transmitted over the network, except by means of HTTPS connections. The attack I am worried about is that the binaries I installed may have been tampered with. How likely is this? Would you reinstall in this situation?

Answer 1

There are a few critical details missing.

1. What OS were you using?

Many platforms provide or require code signing, but you don't tell us what platform you're using.

OSX will by default only run signed binaries. Windows displays the CN of the signing certificate if present (or something like that--I can't remember the precise behavior). iOS will only ever run signed binaries from the App Store unless jailbroken. Android is similar, except you can disable this. Many Linux package managers (like apt) use PGP signing to enforce signed package installation.

So if you're using such a system, you're probably safe.

2. What transport did you use to download the software? You seem to imply HTTP, but this is a somewhat critical detail.

VPN'ing to some machine in a shared datacenter, as suggested in a prior answer, seems like a poor way to mitigate your exposure to an untrusted wifi network--how do you determine that you trust the (still unencrypted) connection between the datacenter machine and the software repository? The only way you can really establish trust in what you download is code signing or fully end-to-end transport layer encryption.

On the other hand, reinstalling is probably a waste of time. The odds of someone serving backdoored software on any given wifi hotspot are quite small. I wouldn't lose sleep over it.

Answer 2

The general rule of thumb is that if you think that you've been compromised then your trust in the system is no longer there and as a result the action you're taking is what you should consider.

With a wireless network it is difficult to tell who is listening in, but that is more likely than someone intercepting your traffic and modifying it. I'd be more concerned about someone catching authentication details being transmitted in plaintext than someone modifying a binary on the fly en route to my machine. Nonetheless, it is possible to have someone perform this action on you, but it can be noticeable even without having software installed.

Reinstalling your system after a system format is definitely one way to bring back a level of trust to your machine--this is the same logic that should be used after being compromised by malware even with remediation. In the future I'd suggest making use of a VPN or SSH tunnelling when dealing with unencrypted networks if you cannot avoid the use of it all together.

Answer 3

If your connection to the source was through https, you most likely didn't have the data being transferred tampered with. You would have to be the target of a fairly talented hacker that's been waiting for you specifically.

This assumes that the certificate you accepted on the unsecured wifi was valid however. Since you were on an unsecured wifi, you could have been subject to a man in the middle attack, but you always check the authenticity of certs, right? Who doesn't?! ;-)

If you only assumed the certificate was valid, I would also assume that your system was compromised. If your organization has heightened security requirements, I would disclose that you may have been compromised.