4 ms·
It depends on the threat model, here TM1 and TM2: TM1: attacker does not posses zerodays to installed software TM2: attacker possesses speccific (perhaps OS,
by DoctorOetker 8y ago
It depends on the threat model, here TM1 and TM2:
TM1: attacker does not posses zerodays to installed software
TM2: attacker possesses speccific (perhaps OS, perhaps library, perhaps userland) zerodays, usage of which (including unsuccesful attempts) should be minimized to avoid detection
in TM1: it's ok to use HTTP in the clear, as long as signatures are verified
in TM2: everything should be fetched over encrypted HTTPS, since HTTP would leak information about available attack surface
EDIT: not only would this increase security by not revealing what a user installs (perhaps download some noise as well such that it becomes harder to detect what a user is installing?), it could also improve security by turning the APT servers into honeypots, so that monitoring these can reveal zerodays...
- AstralStorm 8y agoTM3: attacker has a 0-day against a complex https server and they replace packages on some mirrors. TM4: attacker can impersonate a server using Lets Encrypt certificate and bypass their automated verification, creating a fake mirror or a bunch. (HTTP has same vector.) They can also make DNS fail or reroute. TM5: attacker has a 0-day against the more complex https client (e.g. curl). TM6: Attacker fingerprints network connections to given servers by size and os or os + tls fingerprinting data
- DoctorOetker 8y agoTM3 and TM5 are specific subcases for TM2, and turn the APT server / client into a honeypot TM6: we should have an overlay onion router, and I agree that the current complexity is worrying, I'd love to see a minimalist version of TOR (with minimal I don't necessarily mean the code size should be small, but minimal assumptions, and that the safety of the system can be verified from the assumptions) TM4: I don't understand, Lets Encrypt does not calculate private keys for public keys...