12 ms·

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other rando

Just a security reminder from the last time this got posted[1] This tool downloads random files from the internet, and check their checksum against other random files from the internet. [2] This is not the best security practice. (The right security practice would be to have the gpg keys of the distro developers committed in the repository, and checking all files against these keys) This is not downplaying the effort which was put in this project to find the correct flags to pass to QEMU to boot all of these. [1] https://news.ycombinator.com/item?id=28797129 https://news.ycombinator.com/item?id=28797129 [2] https://github.com/quickemu-project/quickemu/blob/0c8e1a5205c5706f63b2921e50d4c8fa9f60c774/quickget#L2113-L2116 https://github.com/quickemu-project/quickemu/blob/0c8e1a5205...

colejohnson66 3y ago
Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.
- repelsteeltje 3y ago
  Absolutely true, but one additional factor (or vector) is that this adds a level of indirection. That is, you're trusting the Quickemu people to take the same diligence you yourself would do when downloading an ISO from, say ubuntu.com for each and every target I can conveniently install with Quickemu. It's a subtle difference, but the trust-chain could indeed be (mildly) improved by re-distributing the upstream gpg keys.
  - Joker_vD 3y ago
    Eh, you can fetch the GPG keys from some GPG keyserver, it's not like those keys are just random files from the Internet. They're cross-signed, after all!
    - IshKebab 3y ago
      How do you know which keys to get? Let me guess... you read their website.
- st3fan 3y ago
  Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.
  - hn_throwaway_99 3y ago
    > HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting the content from whom you think you're getting it from."
    - electroly 3y ago
      > HTTPS says, importantly, "You're getting the content from whom you think you're getting it from." You need certificate pinning to know this for sure, due to the existence of MITM HTTPS spoofing in things like corporate firewalls. HTTPS alone isn't enough; you have to confirm the certificate is the one you expected. (You can pin the CA cert rather than the leaf certificate if you want, if you trust the CA; that still prevents MITM spoofing.)
      - brirec 3y ago
        I’m not aware of any HTTPS MITM that can function properly without adding its own certificate to the trusted roots on your system (or dismissing a big red warning for every site), so I don’t think certificate pinning is necessary in such an environment (if the concern is MITM by a corporate firewall). An attacker would still need to either have attacked the domain in question, or be able to forge arbitrary trusted certificates.
      - yjftsjthsd-h 3y ago
        If an attack requires compromising my operating system certificate store, I'm reasonably comfortable excluding it from most of my threat models.
- JeremyNT 3y ago
  IMO you're exactly right. I just looked at the shell script and it's not "random" at all, it's getting both the checksum and the ISO from the official source over TLS. The only way this technique is going to fail is if the distro site is compromised, their DNS lapses, or if there's a MITM attack combined with an incorrectly issued certificate. GPG would be more robust but it's hardly like what this tool is doing is some unforgivable failure either. It's not that the OP is wrong but I think they give a really dire view of what's happening here.
- EasyMark 3y ago
  Trust is an input into any security equation. Do you trust all sources of these files? I don't think anyone was challenging gpg
- npteljes 3y ago
  Getting the signature and the file from the same place is questionable practice in itself. If the place is hacked, then all the hacker needs to do is to just hash his own file, which has happened in at least one high profile case [0]. And this practice doesn't even offer any extra protection if the resource was accessed with HTTPS in the first place. [0] https://www.zdnet.com/article/hacker-hundreds-were-tricked-into-installing-linux-mint-backdoor/ https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...
- funcDropShadow 3y ago
  > It then goes beyond what most people do and validates that the hashes matche. It might go above and beyond what most people are doing, but not what most tools are doing. Old school package managers are still a step ahead in this area, because they use GPG to check the authenticity of the data files, independent of the transportation channel. A website to download files and checksums is one such channel. This enables supporting multiple transportation channels, then it was a mirror of ftp mirrors. Today, it might be bittorent or ipfs or a CDN. And GPG supports revoking the trust. Checksums that are hardcoded into a tool cannot be revoked. As soon as we start to codify practices into tools, they become easier to game and attack. Therefore tools should be held to higher security standards than humans.
- fsflover 3y ago
  https://www.qubes-os.org/security/verifying-signatures/#what-digital-signatures-can-and-cannot-prove https://www.qubes-os.org/security/verifying-signatures/#what...
- Zuiii 3y ago
  I wouldn't be sure about most. I and everyone I worked with took gpg verification seriously. I always verify isos. Always. People who are responding to you with "you are absolutely right" might not represent the silent majority (within our field, not talking about normal users).
prmoustache 3y ago
Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.
- wolf89618 3y ago
  [dead]
- bobim 3y ago
  You mean that the sound of each key is unique and sufficiently different from the others? Or it has to do with how a person is typing?
  - overengineer 3y ago
    This is an actual attack surface: https://www.researchgate.net/publication/284949922_Keyboard_acoustic_side_channel_attacks_exploring_realistic_and_security-sensitive_scenarios https://www.researchgate.net/publication/284949922_Keyboard_...
    - bobim 3y ago
      I’ll be yodeling while typing from now on. Happy open-spacing everyone.
  - wolf89618 3y ago
    [dead]
  - malux85 3y ago
    It doesn’t need to be unique, it just needs to leak enough information to decrease the search space enough to where brute force (or other methods) can kick in.
  - coppsilgold 3y ago
    Each key will produce a different sound even if it's just a touch screen surface keyboard due to being in different positions on the surface and having a relative position to the microphone - it may be more difficult and require a higher quality microphone. Once you isolate and cluster all the key sounds you end up with a simple substitution cipher that you can crack in seconds.
dncornholio 3y ago
My red flag was that there is no explanation of what an "optimised" image is.
vdaea 3y ago
It doesn't download "random files from the internet", it seems to be using original sources only.
- TylerE 3y ago
  If you don't control then source, you can't guarantee that what it points to today is what it points to tomorrow.
jvanderbot 3y ago
How much of this is outdated practice? Shouldn't TCP/TLS be doing checksum and origin signing already? In the days of FTP, checksum and gpg were vital. With http/TCP, you need more GPG due to TCP handling retries checksum etc, but still both due to MitM. But with https, how does it still matter? It's doing both verifications and signature checks for you.
- acatton 3y ago
  TLS prevents a different kind of attack, the MitM one which you describe. GPG signing covers this threat model but much more, the threats include: * The server runs vulnerable software and is compromised by script-kiddies. They, then, upload arbitrary packages on the server * The cloud provider is compromised and attackers take over the server from the admin cloud provider account. * Attacker use a vulnerability (from SSH, HTTPd, ...) to upload arbitrary software packages to the server GPG doesn't protect against the developer machine getting compromised, but it guarantees that what you're downloading has been issued from the developer's machine.
  - jvanderbot 3y ago
    I agree, but I think that model of GPG is not how it's used any more. I think nowadays people upload a one-shot CI key, which is used to sign builds. So you're basically saying "The usual machine built this". Which is good information, don't get me wrong, but it's much less secure than "John was logged into his laptop and entered the password for the key that signed this" So, you're right, that GPG verifies source, whereas TLS verifies distribution. I suppose those can be very different things. Perhaps counter example: https://launchpad.net/~lubuntu-ci/+archive/ubuntu/stable-backports-ci https://launchpad.net/~lubuntu-ci/+archive/ubuntu/stable-bac... > The packages here are from the latest upstream release with WORK IN PROGRESS packaging, built from our repositories on Phabricator. These are going to be manually uploaded to the Backports PPA once they are considered stable. And presumably "manually" means "signed and uploaded"
    - spookie 3y ago
      No established GNU/Linux distribution is going to half ass GPG signing as you've implied.
password4321 3y ago
FWIW: - Signatures are checked for macOS now - No signatures are available for Windows Maybe this year attention from Hacker News will encourage someone to step up and implement signature checking for Linux!
jampekka 3y ago
Still magnitudes better security practice than using any proprietary software or service.

colejohnson66 3y ago

Can someone explain how this is a security problem? While GPG key verification would be the best way to ensure authenticity, it's doing nothing different from what almost everyone does: download the ISO from the distro's own HTTPS site. It then goes beyond what most people do and validates that the hashes matche.

repelsteeltje 3y ago
Absolutely true, but one additional factor (or vector) is that this adds a level of indirection. That is, you're trusting the Quickemu people to take the same diligence you yourself would do when downloading an ISO from, say ubuntu.com for each and every target I can conveniently install with Quickemu. It's a subtle difference, but the trust-chain could indeed be (mildly) improved by re-distributing the upstream gpg keys.
- Joker_vD 3y ago
  Eh, you can fetch the GPG keys from some GPG keyserver, it's not like those keys are just random files from the Internet. They're cross-signed, after all!
  - IshKebab 3y ago
    How do you know which keys to get? Let me guess... you read their website.
st3fan 3y ago
Because you wrote HTTPS in italic .. HTTPS doesn't mean anything. Both the good and bad actors can have perfectly valid HTTPS configured. It is not a good indicator of trustworthiness of the actual thing you download.
- hn_throwaway_99 3y ago
  > HTTPS doesn't mean anything. That's not accurate at all. HTTPS should mean "we've validated that the content you're receiving comes from the registered domain that you've hit". Yes, it's possible that the domain host itself was compromised, or that the domain owner himself is malicious, but at the end of the day you have to trust the entity you're getting the content from. HTTPS says, importantly, "You're getting the content from whom you think you're getting it from."
  - electroly 3y ago
    > HTTPS says, importantly, "You're getting the content from whom you think you're getting it from." You need certificate pinning to know this for sure, due to the existence of MITM HTTPS spoofing in things like corporate firewalls. HTTPS alone isn't enough; you have to confirm the certificate is the one you expected. (You can pin the CA cert rather than the leaf certificate if you want, if you trust the CA; that still prevents MITM spoofing.)
    - brirec 3y ago
      I’m not aware of any HTTPS MITM that can function properly without adding its own certificate to the trusted roots on your system (or dismissing a big red warning for every site), so I don’t think certificate pinning is necessary in such an environment (if the concern is MITM by a corporate firewall). An attacker would still need to either have attacked the domain in question, or be able to forge arbitrary trusted certificates.
    - yjftsjthsd-h 3y ago
      If an attack requires compromising my operating system certificate store, I'm reasonably comfortable excluding it from most of my threat models.
JeremyNT 3y ago
IMO you're exactly right. I just looked at the shell script and it's not "random" at all, it's getting both the checksum and the ISO from the official source over TLS. The only way this technique is going to fail is if the distro site is compromised, their DNS lapses, or if there's a MITM attack combined with an incorrectly issued certificate. GPG would be more robust but it's hardly like what this tool is doing is some unforgivable failure either. It's not that the OP is wrong but I think they give a really dire view of what's happening here.
EasyMark 3y ago
Trust is an input into any security equation. Do you trust all sources of these files? I don't think anyone was challenging gpg
npteljes 3y ago
Getting the signature and the file from the same place is questionable practice in itself. If the place is hacked, then all the hacker needs to do is to just hash his own file, which has happened in at least one high profile case [0]. And this practice doesn't even offer any extra protection if the resource was accessed with HTTPS in the first place. [0] https://www.zdnet.com/article/hacker-hundreds-were-tricked-into-installing-linux-mint-backdoor/ https://www.zdnet.com/article/hacker-hundreds-were-tricked-i...
funcDropShadow 3y ago
> It then goes beyond what most people do and validates that the hashes matche. It might go above and beyond what most people are doing, but not what most tools are doing. Old school package managers are still a step ahead in this area, because they use GPG to check the authenticity of the data files, independent of the transportation channel. A website to download files and checksums is one such channel. This enables supporting multiple transportation channels, then it was a mirror of ftp mirrors. Today, it might be bittorent or ipfs or a CDN. And GPG supports revoking the trust. Checksums that are hardcoded into a tool cannot be revoked. As soon as we start to codify practices into tools, they become easier to game and attack. Therefore tools should be held to higher security standards than humans.
fsflover 3y ago
https://www.qubes-os.org/security/verifying-signatures/#what-digital-signatures-can-and-cannot-prove https://www.qubes-os.org/security/verifying-signatures/#what...
Zuiii 3y ago
I wouldn't be sure about most. I and everyone I worked with took gpg verification seriously. I always verify isos. Always. People who are responding to you with "you are absolutely right" might not represent the silent majority (within our field, not talking about normal users).

prmoustache 3y ago

Also, author is typing his user password during live streaming with a mechanical keyboard while microphone is on.

wolf89618 3y ago
[dead]
bobim 3y ago
You mean that the sound of each key is unique and sufficiently different from the others? Or it has to do with how a person is typing?
- overengineer 3y ago
  This is an actual attack surface: https://www.researchgate.net/publication/284949922_Keyboard_acoustic_side_channel_attacks_exploring_realistic_and_security-sensitive_scenarios https://www.researchgate.net/publication/284949922_Keyboard_...
  - bobim 3y ago
    I’ll be yodeling while typing from now on. Happy open-spacing everyone.
- wolf89618 3y ago
  [dead]
- malux85 3y ago
  It doesn’t need to be unique, it just needs to leak enough information to decrease the search space enough to where brute force (or other methods) can kick in.
- coppsilgold 3y ago
  Each key will produce a different sound even if it's just a touch screen surface keyboard due to being in different positions on the surface and having a relative position to the microphone - it may be more difficult and require a higher quality microphone. Once you isolate and cluster all the key sounds you end up with a simple substitution cipher that you can crack in seconds.

dncornholio 3y ago

My red flag was that there is no explanation of what an "optimised" image is.

vdaea 3y ago

It doesn't download "random files from the internet", it seems to be using original sources only.

TylerE 3y ago
If you don't control then source, you can't guarantee that what it points to today is what it points to tomorrow.

jvanderbot 3y ago

How much of this is outdated practice? Shouldn't TCP/TLS be doing checksum and origin signing already? In the days of FTP, checksum and gpg were vital. With http/TCP, you need more GPG due to TCP handling retries checksum etc, but still both due to MitM. But with https, how does it still matter? It's doing both verifications and signature checks for you.

acatton 3y ago
TLS prevents a different kind of attack, the MitM one which you describe. GPG signing covers this threat model but much more, the threats include: * The server runs vulnerable software and is compromised by script-kiddies. They, then, upload arbitrary packages on the server * The cloud provider is compromised and attackers take over the server from the admin cloud provider account. * Attacker use a vulnerability (from SSH, HTTPd, ...) to upload arbitrary software packages to the server GPG doesn't protect against the developer machine getting compromised, but it guarantees that what you're downloading has been issued from the developer's machine.
- jvanderbot 3y ago
  I agree, but I think that model of GPG is not how it's used any more. I think nowadays people upload a one-shot CI key, which is used to sign builds. So you're basically saying "The usual machine built this". Which is good information, don't get me wrong, but it's much less secure than "John was logged into his laptop and entered the password for the key that signed this" So, you're right, that GPG verifies source, whereas TLS verifies distribution. I suppose those can be very different things. Perhaps counter example: https://launchpad.net/~lubuntu-ci/+archive/ubuntu/stable-backports-ci https://launchpad.net/~lubuntu-ci/+archive/ubuntu/stable-bac... > The packages here are from the latest upstream release with WORK IN PROGRESS packaging, built from our repositories on Phabricator. These are going to be manually uploaded to the Backports PPA once they are considered stable. And presumably "manually" means "signed and uploaded"
  - spookie 3y ago
    No established GNU/Linux distribution is going to half ass GPG signing as you've implied.

password4321 3y ago

FWIW: - Signatures are checked for macOS now - No signatures are available for Windows Maybe this year attention from Hacker News will encourage someone to step up and implement signature checking for Linux!

jampekka 3y ago

Still magnitudes better security practice than using any proprietary software or service.