Man-in-the-middle arbitrary code execution in Debian’s apt
48 points by gnyeki
48 points by gnyeki
It's quite ironic that we'll use the vulnerable version of apt to update apt.
To make sure that the package you're installing is authentic, you can use apt download to download packages, and compare their hashes against the package hashes found in the Release file for the given architecture.
It's quite ironic that we'll use the vulnerable version of apt to update apt.
It's a very common problem of updater design that if you discover a bug, you have to patch this bug using the bugged updaters in the field. I've written a lot of updaters and thought a lot about this problem, but you can never make it fully go away, you can just reduce the attack surface.
It's also amusing that Ubuntu begrudgingly advises that you switch to https apt urls to upgrade apt itself, then sorta suggests switching them back to cleartext.
Does anyone know why the debian people have been historically so against SSL for apt repos? Is it just a cost of hosting thing? Worry that transit protection will make us lazy and erode the norms around signature verification?
HTTPS prevents the mirror system from working, because the DNS entry points at a variety of hosts, but there's no TLS certificate distributed to all of them. whydoesaptnotusehttps.com used to be a site that explained this, but it was taken down a while back, I guess because the arguments were outdated.
Today https://deb.debian.org/ is backed by a CDN provider and so it has TLS while still being geographically available. Ubuntu enabled HTTPS on their primary repository server in ~December 2024. IMO no reason to not use TLS with APT today.
(n.b. I previously researched all of this for SecureDrop).
IMO no reason to not use TLS with APT today.
It can be easier to manage a local caching proxy (e.g. apt-cacher-ng) if you use cleartext repositories.
I think anyone who is technically capable of setting up a caching proxy can also edit their sources.list to point directly at that proxy (so TLS doesn't get in the way).
I think it's because they'd like transparent proxying to work. So that your datacenter company or university IT can serve you its APT cache and save upstream some bytes.