6 ms·

Wow, that's pretty stunning and I'm honestly quite shocked it's still the case in '19. Just downloaded Ubuntu server for some local instances here at home and

Wow, that's pretty stunning and I'm honestly quite shocked it's still the case in '19. Just downloaded Ubuntu server for some local instances here at home and realized that I hit this path without even knowning. [edit] Looks like ISO signatures are served over HTTP as well.

blub 8y ago
It's one of my pet peeves and I can say that a ton of organisations do this in 2019, including ones that should know better, like Ubuntu. The only secure way to install is to somehow get their key, already have gpg installed and then verify that way.
- whydoyoucare 8y ago
  As long as verification happens independently, and the keys are obtained from trusted sources, there is nothing wrong in downloading Ubuntu over http. It appears this to be the case, see "How to verify Ubuntu download" tutorial that provides detailed steps: https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#0 https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify... (If you plan to install an Operating System, then I believe some homework is in order -- you cannot expect the OS developers to spoon-feed you trivial security aspects that are expected to be a skill-set that you, the operating system installer, or System Administrator, do possess).
  - vvanders 8y ago
    > and the keys are obtained from trusted sources Isn't that a little hard if the verification keys(from that link) are served over HTTP[1][2]? [1] http://releases.ubuntu.com/18.04/SHA256SUMS.gpg http://releases.ubuntu.com/18.04/SHA256SUMS.gpg [2] http://releases.ubuntu.com/?_ga=2.21478331.1690774166.1548124147-631293260.1548124147 http://releases.ubuntu.com/?_ga=2.21478331.1690774166.154812...
    - whydoyoucare 8y ago
      The Ubuntu verification tutorial (see my previous post) points to keyserver.ubuntu.com.
      - bigiain 8y ago
        Hmmm, I just had a look there. keyserver.ubuntu.com is available over http as well as https, which means it's probably susceptible to a downgrade attack if you're mitming it - which would let you serve a bogus public key and therefore generate apparently valid signatures for the hash for a modified ISO. That's not good...
        cordonbleu 8y ago
        its happened in variant form already, this is why habits of complacency should be kept in check. remember this ? V https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_malwareinfected_isos_linked_from_official_site/ https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_m...
    - bigiain 8y ago
      Those are GPG signed SHA hashes. Sure anyone MITMing the http connection could change them, but for them too be valid signatures for the theoretically-modified ISO you've ended up with, they either need the correct GPG private key to generate that new signature, or they need to convince you to accept a bogus public key for ubuntu-archive-keyring.gpg
      - vvanders 8y ago
        Or they could serve all this over HTTPS where that process would happen automatically when you download. As another poster noted the keyserver in that link will work over http so you're still susceptible to a possible downgrade attack. Given how easy it is to get a LE cert these days it's making me question what other security decision Ubuntu is making that I'm not aware of or have the expertise to evaluate.
  - yjftsjthsd-h 8y ago
    > As long as verification happens independently, and the keys are obtained from trusted sources, there is nothing wrong in downloading Ubuntu over http. In the abstract, this is true. In practice, however, the checksums are always downloaded from the same page as the OS and usually over the same (unencrypted) connection from the same servers.
    - bigiain 8y ago
      Yeah, but the checksums are GPG signed, so you can't change the ISO and then create a valid signature for the new checksum without also having the GPG private key matching the public key you use to check the signature. Having said that, it seems keyserver.ubuntu.com is happy enough to allow connections via http instead of https, so there's a valid avenue to serve up a bogus public key... That's a much smaller window of opportunity since if you're already a Ubuntu user you'll have a pre-existing copy of ubuntu-archive-keyring.gpg already, rather than trying to download a possibly mitm-ed public key at the same time as you download the ISO. But I must admit I boggled a little bit when I saw that keyserver.ubuntu.com happily server their public key over http instead of just https...
  - stouset 8y ago
    > If you plan to install an Operating System, then I believe some homework is in order -- you cannot expect the OS developers to spoon-feed you trivial security aspects that are expected to be a skill-set that you, the operating system installer, or System Administrator, do possess If you plan to publish an operating system, you should take effort to reduce this homework as much as is humanly possible. For every step where a user is expected to—but not explicitly required to—perform extra work to ensure their own security, the overwhelming majority of users will not take these extra steps. Arguing that they "should" gets us nowhere.
    - SmellyGeekBoy 8y ago
      Indeed, and adding these extra verification steps just feeds the "Linux is too complicated for ordinary people" crowd.
bigiain 8y ago
> Looks like ISO signatures are served over HTTP as well. That's less of a problem than it sounds. Sure you can MITM and change the sig on the fly, but without the private key you cannot generate a valid sig for a modified IOS. (And if Ubuntu have had that private key stolen, there are much much deeper problems than the ISOs being served over http...) On the other hand, I suspect it's probably fewer than single digit percentages of people who download the ISOs who then jump through the GPG hoops to check the signature is valid. And as with all PGP/GPG keys, you've got the bootstrapping problem of how do you know that your copy of ubuntu-archive-keyring.gpg is real to start with... (I've been to key signing parties, but not in the last ~30 years...)
- cryptonector 8y ago
  But you need a trust path. If this is the first time you've heard of the Ubuntu signing keys and you have no trust path from them to a signer you trust, then you have a problem, so, yes, all of this should be served over HTTPS. The WebPKI is hardly great, but it's a lot better than nothing.
NicoJuicy 8y ago
It seems the last days some people are actively looking for http downloads. Videolan and apt/get now. Here is why videolan doesn't do it: https://www.beauzee.fr/2017/07/04/videolan-and-https/ https://www.beauzee.fr/2017/07/04/videolan-and-https/ TLDR; They can't force HTTPS to 3rd parties, which is why they can't do it. It's not as simple as running LE.
- jolmg 8y ago
  I imagine that every distribution system that relies on mirrors has a similar setup. It makes a lot of sense.

blub 8y ago

It's one of my pet peeves and I can say that a ton of organisations do this in 2019, including ones that should know better, like Ubuntu. The only secure way to install is to somehow get their key, already have gpg installed and then verify that way.

whydoyoucare 8y ago
As long as verification happens independently, and the keys are obtained from trusted sources, there is nothing wrong in downloading Ubuntu over http. It appears this to be the case, see "How to verify Ubuntu download" tutorial that provides detailed steps: https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#0 https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify... (If you plan to install an Operating System, then I believe some homework is in order -- you cannot expect the OS developers to spoon-feed you trivial security aspects that are expected to be a skill-set that you, the operating system installer, or System Administrator, do possess).
- vvanders 8y ago
  > and the keys are obtained from trusted sources Isn't that a little hard if the verification keys(from that link) are served over HTTP[1][2]? [1] http://releases.ubuntu.com/18.04/SHA256SUMS.gpg http://releases.ubuntu.com/18.04/SHA256SUMS.gpg [2] http://releases.ubuntu.com/?_ga=2.21478331.1690774166.1548124147-631293260.1548124147 http://releases.ubuntu.com/?_ga=2.21478331.1690774166.154812...
  - whydoyoucare 8y ago
    The Ubuntu verification tutorial (see my previous post) points to keyserver.ubuntu.com.
    - bigiain 8y ago
      Hmmm, I just had a look there. keyserver.ubuntu.com is available over http as well as https, which means it's probably susceptible to a downgrade attack if you're mitming it - which would let you serve a bogus public key and therefore generate apparently valid signatures for the hash for a modified ISO. That's not good...
      - cordonbleu 8y ago
        its happened in variant form already, this is why habits of complacency should be kept in check. remember this ? V https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_malwareinfected_isos_linked_from_official_site/ https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_m...
  - bigiain 8y ago
    Those are GPG signed SHA hashes. Sure anyone MITMing the http connection could change them, but for them too be valid signatures for the theoretically-modified ISO you've ended up with, they either need the correct GPG private key to generate that new signature, or they need to convince you to accept a bogus public key for ubuntu-archive-keyring.gpg
    - vvanders 8y ago
      Or they could serve all this over HTTPS where that process would happen automatically when you download. As another poster noted the keyserver in that link will work over http so you're still susceptible to a possible downgrade attack. Given how easy it is to get a LE cert these days it's making me question what other security decision Ubuntu is making that I'm not aware of or have the expertise to evaluate.
- yjftsjthsd-h 8y ago
  > As long as verification happens independently, and the keys are obtained from trusted sources, there is nothing wrong in downloading Ubuntu over http. In the abstract, this is true. In practice, however, the checksums are always downloaded from the same page as the OS and usually over the same (unencrypted) connection from the same servers.
  - bigiain 8y ago
    Yeah, but the checksums are GPG signed, so you can't change the ISO and then create a valid signature for the new checksum without also having the GPG private key matching the public key you use to check the signature. Having said that, it seems keyserver.ubuntu.com is happy enough to allow connections via http instead of https, so there's a valid avenue to serve up a bogus public key... That's a much smaller window of opportunity since if you're already a Ubuntu user you'll have a pre-existing copy of ubuntu-archive-keyring.gpg already, rather than trying to download a possibly mitm-ed public key at the same time as you download the ISO. But I must admit I boggled a little bit when I saw that keyserver.ubuntu.com happily server their public key over http instead of just https...
- stouset 8y ago
  > If you plan to install an Operating System, then I believe some homework is in order -- you cannot expect the OS developers to spoon-feed you trivial security aspects that are expected to be a skill-set that you, the operating system installer, or System Administrator, do possess If you plan to publish an operating system, you should take effort to reduce this homework as much as is humanly possible. For every step where a user is expected to—but not explicitly required to—perform extra work to ensure their own security, the overwhelming majority of users will not take these extra steps. Arguing that they "should" gets us nowhere.
  - SmellyGeekBoy 8y ago
    Indeed, and adding these extra verification steps just feeds the "Linux is too complicated for ordinary people" crowd.

bigiain 8y ago

> Looks like ISO signatures are served over HTTP as well. That's less of a problem than it sounds. Sure you can MITM and change the sig on the fly, but without the private key you cannot generate a valid sig for a modified IOS. (And if Ubuntu have had that private key stolen, there are much much deeper problems than the ISOs being served over http...) On the other hand, I suspect it's probably fewer than single digit percentages of people who download the ISOs who then jump through the GPG hoops to check the signature is valid. And as with all PGP/GPG keys, you've got the bootstrapping problem of how do you know that your copy of ubuntu-archive-keyring.gpg is real to start with... (I've been to key signing parties, but not in the last ~30 years...)

cryptonector 8y ago
But you need a trust path. If this is the first time you've heard of the Ubuntu signing keys and you have no trust path from them to a signer you trust, then you have a problem, so, yes, all of this should be served over HTTPS. The WebPKI is hardly great, but it's a lot better than nothing.

NicoJuicy 8y ago

It seems the last days some people are actively looking for http downloads. Videolan and apt/get now. Here is why videolan doesn't do it: https://www.beauzee.fr/2017/07/04/videolan-and-https/ https://www.beauzee.fr/2017/07/04/videolan-and-https/ TLDR; They can't force HTTPS to 3rd parties, which is why they can't do it. It's not as simple as running LE.

jolmg 8y ago
I imagine that every distribution system that relies on mirrors has a similar setup. It makes a lot of sense.