Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is the deb installation process protected against Man In The Middle Attacks that would alter the install script?

It seems if not, then it would be possible for a Man In The Middle Attack to place code that fundamentally alters the system in the deb install script. Because all installations require root privileges, the invitation is wide open for exploits.

Would we be better off not using custom deb installing scripts as root? I know that links, shortcuts, and app directories need to be copied as root. This could be done by a script already residing on Ubuntu and shipping with Ubuntu. The deb should fit it's expected protocol. It would simply hand it places to move files from the package and appropriate shortcut creation locations, etc. It would have restrictions to never delete, rename, without explicit approval (for updating apps).

If the deb file never asked to be run as root, then an installation could never compromise fundamental parts of the system.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

apt-get will warn you if you try to download an unsecured package. It is part of a security mechanism specifically in place to handle man-in-the-middle attacks.

share|improve this answer
    
On the other side, nothing prevents you from installing a deb directly with sudo dpkg -i file.deb –  Lekensteyn Feb 23 '12 at 9:26
    
I don't think we should operate on a system of trust with deb packages and maintainers. Most apps do not fundamentally alter the system, but instead just need to be copied to an appropriate area. Because we allow root for things like gedit, we are taking unneccessary risks. The deb protocol needs to change. If you have to trust a person, who is more trust worthy, one who asks for only what they need or for more power than neccessary? We need a tier system for apps installs. –  bambuntu Mar 21 '12 at 22:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.