I'm writing an auto-updater tool that is run with admin permissions. It's job is to download and install files from a tat archive.
The problem is solved to the point where I can verify identity of the file with ecdsa signature. However there is nothing that prevents file from being modified after signature is verified but before it is read.
One solution is to read file into memory and then verify signature of that data. However update files may be several hundreds MB and I would like to avoid eating that much RAM.
Another solution I can think of is to change permissions (at least write) to be only accessible by admin. I'm not sure if it opens any other vector of attack though.
Yet one more solution is to detect if file was modified after signature was verified but before data was read completely. I don't know if OS provide reliable and trusted method to do this.
My updater will work on Windows and OSX.
Apparently, changing owner or file permission won't help if attacker already opened file.
UPDATE 2 I come up with the following solution:
- For each archived file also store its ecdsa signature of sha256 digest
- Along with archive store its ecdsa signature of its sha256 digest
- Open archive, verify its signature
- Without closing it, begin unarchiving
- Create temporary directory with rwx access by root / administrator only. Forbid all other users
- Extract file into that dir, verify its signature, install it into target location. Repeat for each file
- Delete temporary directory