4 ms·
A followup on package update delivery would be quite interesting. While the updates are (probably) universally signed to prevent tampering, delivering them in t
by kardos 10y ago
A followup on package update delivery would be quite interesting. While the updates are (probably) universally signed to prevent tampering, delivering them in the clear is still an infoleak -- attackers can monitor the update traffic to identify packages that a target has installed, including the exact version, revealing which packages are fully patched and which are still vulnerable.
- viraptor 10y agoIt's not a big information leak though. Once you know what the system is (which is usually trivial), how many versions do you usually have to choose from? 2-3? At that point you can just try to exploit for each version. Why do you think knowing the version beforehand helps?
- kardos 10y agoI agree it's only a modest infoleak. Depending on the nature of the exploit you may not have multiple attempts. Consider also that one can block updates by serving the client stale update lists/packages. The client sees "no updates available" and thus the attacker can extend a window of vulnerability. Using TLS on the update delivery mirrors raises the bar.