full-disclosure - secure downloading of patches (Re: Knocking Microsoft)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040228223338.GE2962@josefina.dcit.cz>
From: martin.macok at underground.cz (Martin Mačok)
Subject: secure downloading of patches (Re: Knocking Microsoft)

On Sat, Feb 28, 2004 at 10:04:13AM -0800, bryce wrote:

> Gentoo's emerge does md5 checksums checks before it unzips the tar
> || bzip2 ball. So a small piece of security added there.

This can only detect accidental errors during the transfer but does
not protect against malicious replacement. (Just for clarification)

On Sat, Feb 28, 2004 at 07:08:05PM +0100, Cedric Blancher wrote:

> > > % apt-get update && apt-get upgrade
> > > % apt-get install apache-ssl

> > Will it transfer the data in a secure way? (SSL?)

> What's the point securing publicly available data transfer with SSL ?
> The only thing that is important regarding to security for remote
> software installation and/or upgrade is archive authentication and
> integrity check after reception so one can avoid trojaned stuff.

Yes, that was my point. The main issue here is authentication and
integrity -- you can achieve both with proper use of either SSL or
PGP.

Regarding the use of encryption, you're not just making the data
secret (pointless in the case of public data). You are also securing
the communication channel so no third party sees exactly what patches
are you downloading and cannot trick you into downloading some junk
which could attack your patch management system (huge data,
decompression bombs or even exploits).

> > Will it verify the data after being downloaded? (PGP signature?)

> Can be configured to do so. BTW, sadly, by default, only MD5 is
> checked.

That should be fixed IMHO.

Martin Ma?ok