3 ms·

FLAVOR: Ubuntu Desktop HEADLINE: Better security processes DESCRIPTION: I've been quite disappointed that there wasn't really any public reaction from Ubuntu

by hannob 10y ago

FLAVOR: Ubuntu Desktop HEADLINE: Better security processes DESCRIPTION: I've been quite disappointed that there wasn't really any public reaction from Ubuntu to a variety of security issues affecting the Linux Desktop in general and Ubuntu in particular. E.g.: https://scarybeastsecurity.blogspot.dk/2016/11/0day-exploit-compromising-linux-desktop.html https://scarybeastsecurity.blogspot.dk/2016/11/0day-exploit-... https://scarybeastsecurity.blogspot.dk/2016/11/0day-poc-risky-design-decisions-in.html https://scarybeastsecurity.blogspot.dk/2016/11/0day-poc-risk... https://donncha.is/2016/12/compromising-ubuntu-desktop/ https://donncha.is/2016/12/compromising-ubuntu-desktop/ https://www.phoronix.com/scan.php?page=news_item&px=Ubuntu-Eject-Vulnerability https://www.phoronix.com/scan.php?page=news_item&px=Ubuntu-E... Seriously, right now an Ubuntu Desktop isn't a secure choice for users, especially if they have to expect targeted attacks. Some things I'd propose: * Dangerous automation features need to be either disabled by default or heavily audited. That includes things like tracker and apport. * In general I wonder how much auditing happens before something enters Ubuntu. Some basic auditing that could also be automated like testing packages with asan should be a default inclusion criterion for adding packages. * Currently there are no bug bounties at all in the Linux distribution world. I get that this is a financial challenge, but at least in severe cases where the fault clearly lies within the distribution and not within an external project I'd consider bug bounties appropriate. (Just read Donncha's blog post linked above. He could've gotten $10.000 from a shady exploit dealer and he got nothing, because he did the right thing.) ROLE: I'm running the Fuzzing Project and I write for IT tech media about security issues.

simosx 10y ago
The first two examples relate to codecs that are not installed by default. Most probably they should not be available for installation at all, but then it's the way that packages are available in the "universe" repository. The third example is a valid issue, and got fixed. Apport is important to receive feedback from crashes. It is not enabled by default if you use the final versions of the installation ISOs. It is enabled only in the dev versions of Ubuntu. Bug bounties would be interesting. Should they be monetary or should be something else (nice t-shirt). The issue with monetary bug bounties is that they make sense to money-making software and services.
- jbicha 10y ago
  > not installed by default They are installed if you click the box during install to "Install third-party software for graphics and Wi-Fi hardware, MP3 and other media"
  - jandrese 10y ago
    "Other media" sadly does not include DVDs. As far as I know there is no officially blessed way to play a DVD on Ubuntu, and probably never will be.
tyhicks 10y ago
Hi Hanno - Ubuntu Security Team member here. Thanks for the feedback! I wanted to point out that we did have a public response to the four issues that you mentioned. We quickly fixed them! If I'm remembering correctly, we had updates available within 24 hours of the first two issues you mentioned. The second two were privately disclosed to us and we had updates available at the same time the issues became public (thanks again to Donncha O'Cearbhaill and Ilja Van Sprundel for those vulnerability reports!). https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.10.23-7.2ubuntu1.2 https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.1... https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.10.23-7.2ubuntu1.3 https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.1... https://www.ubuntu.com/usn/usn-3157-1/ https://www.ubuntu.com/usn/usn-3157-1/ https://www.ubuntu.com/usn/usn-3246-1/ https://www.ubuntu.com/usn/usn-3246-1/ Note that the first two issues were in packages that don't receive official security support so we didn't publish Ubuntu Security Notices for them. I think we did a good job of reactively fixing those issues. You seem to be asking for more of a proactive approach (audits, sandboxing, etc.) and that's a valid suggestion. We are making progress there but not specifically due to the issues you listed. The security team does proactively review the code of packages, which have an attack surface, just before they move into the "officially supported" state. Sometimes that involves fuzzing depending on what the piece of software does. It is a technique that we're trying to use more often. We're also heavily employing sandboxes by default in the world of snaps. As more debs turn into snaps, those packages will get the added benefit of strong isolation.

by hannob 10y ago

simosx 10y ago

The first two examples relate to codecs that are not installed by default. Most probably they should not be available for installation at all, but then it's the way that packages are available in the "universe" repository. The third example is a valid issue, and got fixed. Apport is important to receive feedback from crashes. It is not enabled by default if you use the final versions of the installation ISOs. It is enabled only in the dev versions of Ubuntu. Bug bounties would be interesting. Should they be monetary or should be something else (nice t-shirt). The issue with monetary bug bounties is that they make sense to money-making software and services.

jbicha 10y ago
> not installed by default They are installed if you click the box during install to "Install third-party software for graphics and Wi-Fi hardware, MP3 and other media"
- jandrese 10y ago
  "Other media" sadly does not include DVDs. As far as I know there is no officially blessed way to play a DVD on Ubuntu, and probably never will be.

tyhicks 10y ago

Hi Hanno - Ubuntu Security Team member here. Thanks for the feedback! I wanted to point out that we did have a public response to the four issues that you mentioned. We quickly fixed them! If I'm remembering correctly, we had updates available within 24 hours of the first two issues you mentioned. The second two were privately disclosed to us and we had updates available at the same time the issues became public (thanks again to Donncha O'Cearbhaill and Ilja Van Sprundel for those vulnerability reports!). https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.10.23-7.2ubuntu1.2 https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.1... https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.10.23-7.2ubuntu1.3 https://launchpad.net/ubuntu/+source/gst-plugins-bad0.10/0.1... https://www.ubuntu.com/usn/usn-3157-1/ https://www.ubuntu.com/usn/usn-3157-1/ https://www.ubuntu.com/usn/usn-3246-1/ https://www.ubuntu.com/usn/usn-3246-1/ Note that the first two issues were in packages that don't receive official security support so we didn't publish Ubuntu Security Notices for them. I think we did a good job of reactively fixing those issues. You seem to be asking for more of a proactive approach (audits, sandboxing, etc.) and that's a valid suggestion. We are making progress there but not specifically due to the issues you listed. The security team does proactively review the code of packages, which have an attack surface, just before they move into the "officially supported" state. Sometimes that involves fuzzing depending on what the piece of software does. It is a technique that we're trying to use more often. We're also heavily employing sandboxes by default in the world of snaps. As more debs turn into snaps, those packages will get the added benefit of strong isolation.