3

How to install a software like Sublime Text on Ubuntu 14.04 LTS and mitigate against a MITM attack? There is a PPA available, but the PPA must be added manually.

I don't see any PGP keys or MD5 hashes for it on the download page.

So, is it possible to install a software like this and be safe from a MITM attack? For example, someone hack into their server, and add malware to the download file.

3

When you run add-apt-repository to add a PPA, this gives you a cryptographic guarantee that the content of the packages that you install are the ones from the PPA that Launchpad (the Ubuntu service that distributes PPAs) considers to be this PPA — in this case, add-apt-repository ppa:webupd8team/sublime-text-3 guarantees that, as long as Ubuntu's servers are secure, the packages that you download from that particular source were really from the Launchpad user webupd8team. So you are protected from a MITM attack.

The add-apt-repository downloads a public key associated with the PPA over HTTPS. The authors of the program don't need to provide a checksum because APT will check the signatures. The only piece of information that you need to retrieve securely is the name of the PPA (especially the name of the PPA user). A phishing attack could try to convince you to install from ppa:webupdateam/sublime-text-3 or ppa:webupd8teteam/sublime-text-3, for example, instead of the legitimate one.

Launchpad does the building, too, so if you trust Ubuntu's servers (and the authors and providers of the compilers and other build tools), you can also trust that the binary implements the source code uploaded by the PPA author.

This does not protect from an attack on Ubuntu's build servers: if they're breached, the attacker could inject a backdoor at build time. This doesn't protect from an attack on Sublime's own infrastructure that allowed the attacker to inject their source code, nor of course from a malicious developer who works for Sublime and could have included a backdoor in the genuine source code.

1

As can be seen on the webpage of the PPA (under technical details), the package you download from the PPA is signed by the operator of the PPA, this would protect you against a MITM attack when updating. However as you hinted at, this doesn't prevent the owner of the PPA from uploading a malicious package intentionally or unintentionally. You could always use the SSL download page on the sublime website

  • I was thinking that someone could access their web server or CDN and replace the download file with a tainted file. Does this qualify as a MITM attack? – B Seven Dec 28 '14 at 22:21
  • I don't think this is a MITM attack. MITM attacks usually involve someone impersonating one party in a conversation, not a party itself acting maliciously. It is possible that he gets MITMed while downloading the file over HTTP. – Jon Dec 28 '14 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.