4 ms·

I'd say it's still pretty risky to leave this source enabled. The behaviour shown at http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg http://wiki.debi

I'd say it's still pretty risky to leave this source enabled. The behaviour shown at http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg http://wiki.debian.org/SecureApt#How_apt_uses_Release.gpg is what a user would see if the entire repository (including the Release.gpg file) were swapped out. Unfortunately a decent percentage of the people using debian-multimedia.org likely never imported the signing keys for the original repository at all, and wouldn't notice that the key ID had changed. Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common and likely to be ignored by a good portion of the user base. In the past even very savvy folks (Defcon attendees) have fallen afoul of accepting dodgy package updates: http://seclists.org/fulldisclosure/2011/Aug/76 http://seclists.org/fulldisclosure/2011/Aug/76 Edit: I recalled hearing that they'd Mitm'd Debian / Ubuntu updates but now I can't find that specific factoid again, so perhaps take the Defcon thing with a grain of salt.

ars 13y ago
He has a package deb-multimedia-keyring, and I actually think most users install it because if you don't apt-get complains.
dfc 13y ago
I have never seen such rampant speculation before. I think you should change your addendum to read "take this entire comment with a grain of salt." This gem really takes the cake: Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common You see so many "rogue repositories" that you think they are common? I have never had one.
- mfincham 13y ago
  You're right, I didn't word that well at all. I meant it's fairly common to see apt complaining about not having the key available to verify a package. I see this a lot in my work where sysadmins lacking clue enable a third party repository and don't bother / don't understand the need for adding the key with apt-key.
mike-cardwell 13y ago
I would say that the user should be forced to install the correct GPG key, however in this case I imagine the attacker would just put up their own key on a "fake" website on the compromised domain and people would then install that. Or just ignore the warning.

ars 13y ago

He has a package deb-multimedia-keyring, and I actually think most users install it because if you don't apt-get complains.

dfc 13y ago

I have never seen such rampant speculation before. I think you should change your addendum to read "take this entire comment with a grain of salt." This gem really takes the cake: Even if they had previously installed the key, all they would get is that warning during package installation if a rogue repository was established, something which is fairly common You see so many "rogue repositories" that you think they are common? I have never had one.

mfincham 13y ago
You're right, I didn't word that well at all. I meant it's fairly common to see apt complaining about not having the key available to verify a package. I see this a lot in my work where sysadmins lacking clue enable a third party repository and don't bother / don't understand the need for adding the key with apt-key.

mike-cardwell 13y ago

I would say that the user should be forced to install the correct GPG key, however in this case I imagine the attacker would just put up their own key on a "fake" website on the compromised domain and people would then install that. Or just ignore the warning.