full-disclosure - [FD] Skype Debian package: allows complete machine takeover for Microsoft

Open Source and information security mailing list archives

Message-ID: <347044b7-20d2-7ca9-b177-5e1fbff6606e@metux.net>
Date: Tue, 25 Sep 2018 19:04:18 +0200
From: "Enrico Weigelt, metux IT consult" <info@...ux.net>
To: Fulldisclosure@...lists.org
Subject: [FD] Skype Debian package: allows complete machine takeover for
	Microsoft

Level: Critical

Description:

  The Skype debian packege for Skype (even when not installed via their
  offical repo) automatically installs apt configuration that adds
  Microsoft's apt repo to the system's package sources.

  That way, Microsoft (or anybody holding their repo's private key)
  can easily inject malicious packages via regular update and replace
  distro packages w/ their own manipulated ones.

Suggested vendor solution:

  Remove all apt configuration stuff from the .deb.

Operator's workaround:

  a) remove Skype's apt config (sources.list entry as well as the
     Microsoft apt key) immediately after installation
  b) unpack and repackage it manually (w/o that apt config) before
     installation on production machines
  c) use apt pinning to restrict the Microsoft repo to only the
     package 'skypeforlinux'
  c) only install it in a strictly confined container

--mtx

-- 
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@...ux.net -- +49-151-27565287

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives