Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is the deb installation process protected against Man In The Middle Attacks that would alter the install script?

It seems if not, then it would be possible for a Man In The Middle Attack to place code that fundamentally alters the system in the deb install script. Because all installations require root privileges, the invitation is wide open for exploits.

Would we be better off not using custom deb installing scripts as root? I know that links, shortcuts, and app directories need to be copied as root. This could be done by a script already residing on Ubuntu and shipping with Ubuntu. The deb should fit it's expected protocol. It would simply hand it places to move files from the package and appropriate shortcut creation locations, etc. It would have restrictions to never delete, rename, without explicit approval (for updating apps).

If the deb file never asked to be run as root, then an installation could never compromise fundamental parts of the system.

share|improve this question
up vote 3 down vote accepted

apt-get will warn you if you try to download an unsecured package. It is part of a security mechanism specifically in place to handle man-in-the-middle attacks.

share|improve this answer
On the other side, nothing prevents you from installing a deb directly with sudo dpkg -i file.deb – Lekensteyn Feb 23 '12 at 9:26
I don't think we should operate on a system of trust with deb packages and maintainers. Most apps do not fundamentally alter the system, but instead just need to be copied to an appropriate area. Because we allow root for things like gedit, we are taking unneccessary risks. The deb protocol needs to change. If you have to trust a person, who is more trust worthy, one who asks for only what they need or for more power than neccessary? We need a tier system for apps installs. – bambuntu Mar 21 '12 at 22:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.