35 ms·

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothe

by zymhan 11y ago

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. On the other hand, the Windows and OS X App Stores are awful. Linux package managers are looking like one of the only straightforward ways to distribute applications securely.

rcthompson 11y ago
Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the checksum given on the page.
- CiPHPerCoder 11y ago
  This doesn't solve the problem. At all. A checksum is NOT a substitute for a digital signature. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
  - deleted 11y ago
    [deleted]
  - Hydraulix989 11y ago
    Right. All I have to do is distribute the correct hash for my binary as a malicious software distributor because there's no authenticity verification at all, only that the bits in my binary blob match a certain pattern.
    - rhizome 11y ago
      Is that supposed to be sarcasm? Hard to tell.
      - CiPHPerCoder 11y ago
        I suspect not.
  - __david__ 11y ago
    It is given the following attack scenario: attacker is man-in-the-middling, and the SHA (but not the actual binary) is delivered via https. In the case where the attacked has direct control over the website then you're right, it doesn't help at all.
    - CiPHPerCoder 11y ago
      > In the case where the attacked has direct control over the website then you're right, it doesn't help at all. I was pretty sure that's the threat model we were discussing: Software authenticity. The only way to automatically know if a piece of software is legitimate is to have a trusted public key that can verify a signature. Also, HTTPS is implied these days. If you're not using HTTPS, you are either malicious, negligent, incompetent, or working for someone who is some or all of the above.
      - __david__ 11y ago
        > If you're not using HTTPS, you are either malicious, negligent, incompetent… Or poor. Hosting large amounts of binaries over https isn't cheap. I just priced Amazon S3 and cloudfront and for the amount of data that I serve it would cost $300 per month. That's a lot to commit for a GPL-ed binary that brings in practically zero revenue. Maybe there's a cut rate VPS out there that can handle 150GB of data and 3TB of bandwidth per month on the cheap, but I haven't found it yet.
        kruczek 11y ago
        How much is it for the same volume of non-HTTPS traffic?
        deleted 11y ago
        [deleted]
- saganus 11y ago
  That would be a useful extension/plugin for browsers actually. Maybe like pointed out in another reply, not for checksums but for signatures. So you just copy/paste the signature after selecting a file, and then it can verify it's validity. Is there no such extension yet? it seems like there should be one already.
  - ikeboy 11y ago
    Tried to search, found https://tails.boum.org/blueprint/bootstrapping/extension/ https://tails.boum.org/blueprint/bootstrapping/extension/, and links to https://chrome.google.com/webstore/detail/satori/oncomejlklhkbffpdhpmhldlfambmjlf https://chrome.google.com/webstore/detail/satori/oncomejlklh..., with code at https://github.com/glamrock/satori https://github.com/glamrock/satori
  - TickleSteve 11y ago
    yeah, maybe they should call it something like.... https??
  - toyg 11y ago
    Maybe something like: - have a database of common downloads and all their crypto info, which developers can update once they are validated - have browser extensions that will check packages on download and alert if suspicious You could pay for it with some sort of sponsorship from apps themselves, who have an interest in not getting compromised like this (it's terrible publicity).
jpalomaki 11y ago
If the website is compromised, the checksum could be changed as well. With digital signatures the problem is that I don't often know who is the official author of the app.
mhurron 11y ago
> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.
- r0muald 11y ago
  No, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.
  - regularfry 11y ago
    That's... optimistic.
    - cyphar 11y ago
      That's how OpenSUSE works. Debian too AFAIK.
      - regularfry 11y ago
        It's the aspirational ideal behind how these projects work.
  - owaislone 11y ago
    Actually, most have scripts that pull the upstream source and build new binaries without any manual intervention. It is the responsibility of the package maintainer to review every change in code.
- finnn 11y ago
  Generally, Linux package maintainers grab the upstream source, while most of these compromises seem to be of the binaries. And, of course, the maintainers generally review the changes before publishing them
resoluteteeth 11y ago
> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware into the download and not have the ability to make the checksum match. Posting checksums is actually pretty useless, and was something that used to be used to deal with the possibility of malicious mirrors, but doesn't provide any security against mitm attacks (unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway), the site getting hacked, etc. Digital signatures are a little bit better if the key is kept safe, since hacking the site and replacing the binary won't allow a random person to produce a valid signature, although ability to modify the source code would still allow someone to introduce backdoors into the next version, but there's still a huge problem where you need some way to determine what key was supposed to be used to sign the binary in the first place, so just posting a signature on a website is also basically useless. Digital signatures can work if there's some sort of centralized distribution method, or for safely updating software that's already installed.
- ikeboy 11y ago
  >unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.
  - ianlevesque 11y ago
    This is a persistent myth https://istlsfastyet.com https://istlsfastyet.com
    - ikeboy 11y ago
      I've seen whonix say this https://www.whonix.org/wiki/Download_Security https://www.whonix.org/wiki/Download_Security >Practically it is difficult to provide SSL protected downloads at all. Many important software projects can only be downloaded in the clear, such as Ubuntu, Debian, Tails, Qubes OS, etc. This is because someone has to pay the bill and SSL (encryption) makes it more expensive. At the moment we don't have any mirror supporting SSL. We're looking for SSL supported mirrors to share the load. Is it not true that mirrors supporting SSL are more expensive?
crazysim 11y ago
The Linux Mint hijacker changed the checksum too.
zepto 11y ago
How is the OSX App Store 'awful' compared to a Linux package manager?
- gcb0 11y ago
  app store: anyone gets a id. sign whatever. just have to get past the automated detection. Debian: have to also fool several people involved in the packaging of said package upstream and everyone using it and building from source
  - zepto 11y ago
    Fair point. How is a compromised package revoked in the Debian case?
coldtea 11y ago
>Though I think most people can't be bothered to verify the checksum on a file every time they download it. This wouldn't help anyway. If the malicious party had access to alter the downloads (as they did here) they could just as well change the checksum shown on the page to. >On the other hand, the Windows and OS X App Stores are awful. Haven't used the Windows one, but what's "awful" about the OS X one? Quick, one click, installations, isolated, signed, easy updates. Might be bad for the application developers somehow, but I don't see anything much bad about it from a user perspective -- except maybe the lack of trials. Then again I've been able to get a refund any time I bought an app that was subpar and written to Apple (that was 2 times).
- azernik 11y ago
  In the original thread, the initial reporters specifically pointed out that the files they had downloaded did not match the checksums on the Transmission page. My guess would be that the attackers compromised a mirror, but not the web server serving up the user-visible page with the checksum.
danieldk 11y ago
Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Unless you are a small independent app developer. Virtually no distribution wants to take proprietary software. And you have to package for a wide variety of different distributions. On the other hand, the Windows and OS X App Stores are awful. The Mac App store works pretty much effortless for me. It's sometimes a bit slow, but other than that it's pretty trivial to use.
- JetSpiegel 11y ago
  You can run your own repo. It's basically a folder with some metadata. DEB and RPM variants should get you 80% of the way.
  - theinternetman 11y ago
    How is that any more secure than just providing a download?
    - samuellb 11y ago
      It's not at the time of installation, but prior to updates the package management system will check signatures of the packages. (And it will only accept packages signed with your key, so the attack used against Transmission wouldn't work)
- cyphar 11y ago
  The question is whether we should trust proprietary software even if it is downloaded securely. I consider "hard to get proprietary software into the official repos" as a feature. Unfortunately it's not as hard as you make it sound in most distributions.
rhizome 11y ago
Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. I'm game, but I need a little help. What are your favorite techniques for verifying downloaded programs?
- samuellb 11y ago
  There's no completely secure way, except for getting the public key directly from the developer over a trusted channel (or in person). And even that won't protect you in case the developer's keys gets compromised. But there are a number of things that can be done: - always verify the checksum (if available), in case the download mirror (but not the web site itself) got compromised. - check for strange strings in the binary (use "strings" and "grep"). E.g. URLs - scan the downloaded file on Jotti or VirusTotal. - unpack the binary manually with 7-zip or similar if it's a self-extracting file. - check installation scripts, build files, etc. (if applicable). - if downloading source code, check a couple of files at random. Will most likely not protect you, but if everyone does it, it helps detecting embedded malware (or bugs) early. - run "strace" (Linux/Unix) or "FileMon" (Windows) or similar software and log what the software does when you install and run it for the first time. - and check Hacker New regularly ;)
Mandatum 11y ago
The app made it onto the OSX App Store and the author's certs were revoked. This isn't a case of verify source, verify application. This is a case of anything can be infected and it's damn near impossible to check everything.
- jads 11y ago
  Transmission wasn't on the Mac App Store, though the app was signed. Apple offers developers the ability to sign their apps distributed outside the Mac App Store to certify them as an Apple-identified developer https://developer.apple.com/library/ios/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html https://developer.apple.com/library/ios/documentation/IDEs/C... As such, checking the source is still very much relevant here since this wasn't a compromised app in the Mac App Store, it's an app distributed outside it.
- ascorbic 11y ago
  It was signed, but wasn't in the Mac App Store.
Angostura 11y ago
In what respect is the OS X AppStore awful?
- TheCoreh 11y ago
  - The APIs exposed to Mac App Store apps are more limited (because the OS X sandbox is not completely comprehensive in what it provides). This limits the types of apps that can be sold on the store. - There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat. - The store interface and navigation are also much slower than the iOS counterpart. - Recently some certificate issues rendered users unable to open their apps. - Not 100% sure on this one: You can't download older app versions if your OS is no longer supported.
  - Aloisius 11y ago
    - There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat. Apple and other do this by simply numbering the names of apps. They don't allow you to specify special "upgrade" pricing, but the effect of this was that developers no longer really have full retail pricing and everything is just set to the upgrade price. Logic Pro 8 for instance used to retail at $499. The upgrade price was $199. Now Logic Pro X on the Mac App Store is just $199 regardless of whether you are first time user or someone who had the previous version. - The store interface and navigation are also much slower than the iOS counterpart. I haven't really found that the Mac Store is any slower. I've found that they are both slow. - Not 100% sure on this one: You can't download older app versions if your OS is no longer supported. I don't believe it will even show you newer versions of the apps as long as the developer properly specifies the minimum OS version.
- andreamazz 11y ago
  The guys at Bohemian coding discussed (even if not too in detail) it here: http://blog.sketchapp.com/post/134322691555/leaving-the-mac-app-store http://blog.sketchapp.com/post/134322691555/leaving-the-mac-...
thrillgore 11y ago
What amazes me is that this process can be totally automated and made invisible to the user. Alas, nobody wants to invest the day or so in actually writing the methods to do it.
capripot 11y ago
Why there isn't a default protocol for sending a the SHA key and verifying the downloaded file automatically?

by zymhan 11y ago

rcthompson 11y ago

Most people download software from websites using GUI browsers, while performing a checksum generally requires opening a terminal, changing directories to where the file was downloaded, and running the checksum program there. Maybe the web browser should provide a UI for doing checksums directly in the download manager. For example, each download entry could have a blank "checksum" text box where you can paste in the checksum given on the page.

CiPHPerCoder 11y ago
This doesn't solve the problem. At all. A checksum is NOT a substitute for a digital signature. https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-pass...
- deleted 11y ago
  [deleted]
- Hydraulix989 11y ago
  Right. All I have to do is distribute the correct hash for my binary as a malicious software distributor because there's no authenticity verification at all, only that the bits in my binary blob match a certain pattern.
  - rhizome 11y ago
    Is that supposed to be sarcasm? Hard to tell.
    - CiPHPerCoder 11y ago
      I suspect not.
- __david__ 11y ago
  It is given the following attack scenario: attacker is man-in-the-middling, and the SHA (but not the actual binary) is delivered via https. In the case where the attacked has direct control over the website then you're right, it doesn't help at all.
  - CiPHPerCoder 11y ago
    > In the case where the attacked has direct control over the website then you're right, it doesn't help at all. I was pretty sure that's the threat model we were discussing: Software authenticity. The only way to automatically know if a piece of software is legitimate is to have a trusted public key that can verify a signature. Also, HTTPS is implied these days. If you're not using HTTPS, you are either malicious, negligent, incompetent, or working for someone who is some or all of the above.
    - __david__ 11y ago
      > If you're not using HTTPS, you are either malicious, negligent, incompetent… Or poor. Hosting large amounts of binaries over https isn't cheap. I just priced Amazon S3 and cloudfront and for the amount of data that I serve it would cost $300 per month. That's a lot to commit for a GPL-ed binary that brings in practically zero revenue. Maybe there's a cut rate VPS out there that can handle 150GB of data and 3TB of bandwidth per month on the cheap, but I haven't found it yet.
      - kruczek 11y ago
        How much is it for the same volume of non-HTTPS traffic?
        deleted 11y ago
        [deleted]
saganus 11y ago
That would be a useful extension/plugin for browsers actually. Maybe like pointed out in another reply, not for checksums but for signatures. So you just copy/paste the signature after selecting a file, and then it can verify it's validity. Is there no such extension yet? it seems like there should be one already.
- ikeboy 11y ago
  Tried to search, found https://tails.boum.org/blueprint/bootstrapping/extension/ https://tails.boum.org/blueprint/bootstrapping/extension/, and links to https://chrome.google.com/webstore/detail/satori/oncomejlklhkbffpdhpmhldlfambmjlf https://chrome.google.com/webstore/detail/satori/oncomejlklh..., with code at https://github.com/glamrock/satori https://github.com/glamrock/satori
- TickleSteve 11y ago
  yeah, maybe they should call it something like.... https??
- toyg 11y ago
  Maybe something like: - have a database of common downloads and all their crypto info, which developers can update once they are validated - have browser extensions that will check packages on download and alert if suspicious You could pay for it with some sort of sponsorship from apps themselves, who have an interest in not getting compromised like this (it's terrible publicity).

jpalomaki 11y ago

If the website is compromised, the checksum could be changed as well. With digital signatures the problem is that I don't often know who is the official author of the app.

mhurron 11y ago

> Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Linux distributions package what is released upstream. If upstream is compromised, so is the Linux package.

r0muald 11y ago
No, Linux distributions offer packages and operating systems that are the result of painstaking work in which all upstream code is reviewed, patched for any inconsistency, and often blocked from going into public archives until known bugs are fixed.
- regularfry 11y ago
  That's... optimistic.
  - cyphar 11y ago
    That's how OpenSUSE works. Debian too AFAIK.
    - regularfry 11y ago
      It's the aspirational ideal behind how these projects work.
- owaislone 11y ago
  Actually, most have scripts that pull the upstream source and build new binaries without any manual intervention. It is the responsibility of the package maintainer to review every change in code.
finnn 11y ago
Generally, Linux package maintainers grab the upstream source, while most of these compromises seem to be of the binaries. And, of course, the maintainers generally review the changes before publishing them

resoluteteeth 11y ago

> Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. Though I think most people can't be bothered to verify the checksum on a file every time they download it. Barring a situation where a CDN hosting the download is compromised but the main site is not hosted on the CDN, it's extremely unlikely that someone would have the ability to inject malware into the download and not have the ability to make the checksum match. Posting checksums is actually pretty useless, and was something that used to be used to deal with the possibility of malicious mirrors, but doesn't provide any security against mitm attacks (unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway), the site getting hacked, etc. Digital signatures are a little bit better if the key is kept safe, since hacking the site and replacing the binary won't allow a random person to produce a valid signature, although ability to modify the source code would still allow someone to introduce backdoors into the next version, but there's still a huge problem where you need some way to determine what key was supposed to be used to sign the binary in the first place, so just posting a signature on a website is also basically useless. Digital signatures can work if there's some sort of centralized distribution method, or for safely updating software that's already installed.

ikeboy 11y ago
>unless the main site is secure but the downloads aren't which is idiotic by 2016 standards anyway https adds a performance hit. The security of "checksum over https and actual file over http", if the checksum is checked, is the same as "actual file over https", barring preimage attacks.
- ianlevesque 11y ago
  This is a persistent myth https://istlsfastyet.com https://istlsfastyet.com
  - ikeboy 11y ago
    I've seen whonix say this https://www.whonix.org/wiki/Download_Security https://www.whonix.org/wiki/Download_Security >Practically it is difficult to provide SSL protected downloads at all. Many important software projects can only be downloaded in the clear, such as Ubuntu, Debian, Tails, Qubes OS, etc. This is because someone has to pay the bill and SSL (encryption) makes it more expensive. At the moment we don't have any mirror supporting SSL. We're looking for SSL supported mirrors to share the load. Is it not true that mirrors supporting SSL are more expensive?

crazysim 11y ago

The Linux Mint hijacker changed the checksum too.

zepto 11y ago

How is the OSX App Store 'awful' compared to a Linux package manager?

gcb0 11y ago
app store: anyone gets a id. sign whatever. just have to get past the automated detection. Debian: have to also fool several people involved in the packaging of said package upstream and everyone using it and building from source
- zepto 11y ago
  Fair point. How is a compromised package revoked in the Debian case?

coldtea 11y ago

>Though I think most people can't be bothered to verify the checksum on a file every time they download it. This wouldn't help anyway. If the malicious party had access to alter the downloads (as they did here) they could just as well change the checksum shown on the page to. >On the other hand, the Windows and OS X App Stores are awful. Haven't used the Windows one, but what's "awful" about the OS X one? Quick, one click, installations, isolated, signed, easy updates. Might be bad for the application developers somehow, but I don't see anything much bad about it from a user perspective -- except maybe the lack of trials. Then again I've been able to get a refund any time I bought an app that was subpar and written to Apple (that was 2 times).

azernik 11y ago
In the original thread, the initial reporters specifically pointed out that the files they had downloaded did not match the checksums on the Transmission page. My guess would be that the attackers compromised a mirror, but not the web server serving up the user-visible page with the checksum.

danieldk 11y ago

Linux package managers are looking like one of the only straightforward ways to distribute applications securely. Unless you are a small independent app developer. Virtually no distribution wants to take proprietary software. And you have to package for a wide variety of different distributions. On the other hand, the Windows and OS X App Stores are awful. The Mac App store works pretty much effortless for me. It's sometimes a bit slow, but other than that it's pretty trivial to use.

JetSpiegel 11y ago
You can run your own repo. It's basically a folder with some metadata. DEB and RPM variants should get you 80% of the way.
- theinternetman 11y ago
  How is that any more secure than just providing a download?
  - samuellb 11y ago
    It's not at the time of installation, but prior to updates the package management system will check signatures of the packages. (And it will only accept packages signed with your key, so the attack used against Transmission wouldn't work)
cyphar 11y ago
The question is whether we should trust proprietary software even if it is downloaded securely. I consider "hard to get proprietary software into the official repos" as a feature. Unfortunately it's not as hard as you make it sound in most distributions.

rhizome 11y ago

Along with the recent Linux Mint hijack, this really illustrates the need for people to verify programs they download. I'm game, but I need a little help. What are your favorite techniques for verifying downloaded programs?

samuellb 11y ago
There's no completely secure way, except for getting the public key directly from the developer over a trusted channel (or in person). And even that won't protect you in case the developer's keys gets compromised. But there are a number of things that can be done: - always verify the checksum (if available), in case the download mirror (but not the web site itself) got compromised. - check for strange strings in the binary (use "strings" and "grep"). E.g. URLs - scan the downloaded file on Jotti or VirusTotal. - unpack the binary manually with 7-zip or similar if it's a self-extracting file. - check installation scripts, build files, etc. (if applicable). - if downloading source code, check a couple of files at random. Will most likely not protect you, but if everyone does it, it helps detecting embedded malware (or bugs) early. - run "strace" (Linux/Unix) or "FileMon" (Windows) or similar software and log what the software does when you install and run it for the first time. - and check Hacker New regularly ;)

Mandatum 11y ago

The app made it onto the OSX App Store and the author's certs were revoked. This isn't a case of verify source, verify application. This is a case of anything can be infected and it's damn near impossible to check everything.

jads 11y ago
Transmission wasn't on the Mac App Store, though the app was signed. Apple offers developers the ability to sign their apps distributed outside the Mac App Store to certify them as an Apple-identified developer https://developer.apple.com/library/ios/documentation/IDEs/Conceptual/AppDistributionGuide/DistributingApplicationsOutside/DistributingApplicationsOutside.html https://developer.apple.com/library/ios/documentation/IDEs/C... As such, checking the source is still very much relevant here since this wasn't a compromised app in the Mac App Store, it's an app distributed outside it.
ascorbic 11y ago
It was signed, but wasn't in the Mac App Store.

Angostura 11y ago

In what respect is the OS X AppStore awful?

TheCoreh 11y ago
- The APIs exposed to Mac App Store apps are more limited (because the OS X sandbox is not completely comprehensive in what it provides). This limits the types of apps that can be sold on the store. - There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat. - The store interface and navigation are also much slower than the iOS counterpart. - Recently some certificate issues rendered users unable to open their apps. - Not 100% sure on this one: You can't download older app versions if your OS is no longer supported.
- Aloisius 11y ago
  - There's no means of providing paid upgrades. E.g. for a major version bump, which a lot of developers rely on to keep their business afloat. Apple and other do this by simply numbering the names of apps. They don't allow you to specify special "upgrade" pricing, but the effect of this was that developers no longer really have full retail pricing and everything is just set to the upgrade price. Logic Pro 8 for instance used to retail at $499. The upgrade price was $199. Now Logic Pro X on the Mac App Store is just $199 regardless of whether you are first time user or someone who had the previous version. - The store interface and navigation are also much slower than the iOS counterpart. I haven't really found that the Mac Store is any slower. I've found that they are both slow. - Not 100% sure on this one: You can't download older app versions if your OS is no longer supported. I don't believe it will even show you newer versions of the apps as long as the developer properly specifies the minimum OS version.
andreamazz 11y ago
The guys at Bohemian coding discussed (even if not too in detail) it here: http://blog.sketchapp.com/post/134322691555/leaving-the-mac-app-store http://blog.sketchapp.com/post/134322691555/leaving-the-mac-...

thrillgore 11y ago

What amazes me is that this process can be totally automated and made invisible to the user. Alas, nobody wants to invest the day or so in actually writing the methods to do it.

capripot 11y ago

Why there isn't a default protocol for sending a the SHA key and verifying the downloaded file automatically?