6

When trying to install tmux I get an error that Untrusted packages could compromise your system's security, similar to the situation in this thread. I ran aptitude update and the package installed without issue, but I am concerned that the update may have been compromised. My concern in enhanced as I see that the update was done without SSL (http address):

 - neptune():~$ sudo aptitude update
Ign http://il.archive.ubuntu.com quantal InRelease
Ign http://il.archive.ubuntu.com quantal-updates InRelease
Ign http://il.archive.ubuntu.com quantal-backports InRelease
Get: 1 http://il.archive.ubuntu.com quantal Release.gpg [933 B]
Get: 2 http://il.archive.ubuntu.com quantal-updates Release.gpg [933 B]
Get: 3 http://il.archive.ubuntu.com quantal-backports Release.gpg [933 B]
Hit http://il.archive.ubuntu.com quantal Release
Get: 4 http://il.archive.ubuntu.com quantal-updates Release [49.6 kB]
Ign http://security.ubuntu.com quantal-security InRelease
Ign http://archive.canonical.com quantal InRelease
Ign http://extras.ubuntu.com quantal InRelease
Ign http://dl.google.com stable InRelease
Ign http://ppa.launchpad.net quantal InRelease
Ign http://deb.opera.com stable InRelease
Ign http://ppa.launchpad.net quantal InRelease

EDIT: I have now been made aware that the targeted attacking of Israeli websites on April 7 has already begun. Therefore, there is increased suspicion of a compromised server. I could find more information about the attack if necessary, though I don't see much mention of it in widespread English-language news websites.

Clarification: I'm asking how to ensure that what I've already downloaded and installed is not compromised. I am not asking how Canonical ensures the security of repos.

5
  • Have you considered tunnelling out over TOR? It might be a slow update but it'd be secure.
    – Gregology
    Apr 5, 2013 at 15:09
  • 1
    @Gregology Tunnelling won't make the package itself more secure if it was compromised, and is being pulled from the same server. One would need to use an actual different server that has not been compromised, and has the properly signed packages.
    – dobey
    Apr 5, 2013 at 15:20
  • 1
    Hi @dobey, I disagree. Tunnelling over TOR will make a man in the middle attack very unlikely and if the actual server has been compromised then packages could be falsely signed anyway. I would suggest using another server though. What are you thoughts @dobey?
    – Gregology
    Apr 5, 2013 at 15:28
  • @Gregology You're assuming it's a MitM attack. And I think this question is a duplicate. I'd suggest using a different mirror of course. :)
    – dobey
    Apr 5, 2013 at 15:48
  • Thanks, all. Had I been concerned before downloading, then this would be a dup (i.e., how do I know that the repo is safe). However, I'm now asking how to ensure that what I've already downloaded and installed is not compromised.
    – dotancohen
    Apr 5, 2013 at 15:53

2 Answers 2

3

I cannot tell you how you do it for all packages, but here is a possible procedure for single packages.

Warning: The site I suggest to use does (strangely) not support https yet - so you cannot be certain that you are really talking to the correct site, which makes the check much less useful than expected - as Eliah Kagan pointed out in a comment.

  1. visit packages.ubuntu.com
  2. select your distro
  3. select "all packages" (down at the bottom)
  4. look into /var/cache/apt/archives and choose suspicious packages (for instance those with a recent date)
  5. run a sha256sum against that package
  6. choose that package on the website, you get enter image description here
  7. click on the link beneath Architecture enter image description here
  8. compare the result from step 5 with the published value.
7
  • Interestingly, the site does not show a result when I search for tmux_1.6-2_amd64 or tmux_1.6-2_amd64.deb, but google takes me to the right page.
    – dotancohen
    Apr 5, 2013 at 20:00
  • 5
    Manually checking the hashes of your packages like this won't make you any more secure--they are already checked automatically by APT for any package automatically downloaded. And packages.ubuntu.com is not SSL-secured; if you don't trust the hashes that are GPG-signed, why trust hashes obtained naively from an HTTP site?? Apr 5, 2013 at 20:14
  • 1
    @EliahKagan the question was about the warning "Untrusted packages could compromise..."
    – guntbert
    Apr 5, 2013 at 20:16
  • 3
    @guntbert But this is still an insecure way to verify a package's integrity or authenticity. I've removed my comment on the question (I'm no longer so sure this is a duplicate). But this answer still has the severe shortcoming that it uses an untrusted channel to obtain the sha256 hash. Furthermore, by presenting your method as "the procedure," you're strongly suggesting that this is widely considered a secure method. Under some circumstances this may be better than nothing, but isn't there another way to check them? Launchpad? (Which is HTTPS-secured, and is where the packages originate.) Apr 5, 2013 at 20:17
  • @guntbert Thanks. Since there don't seem to be hashes listed on Launchpad, to really be sure (without using APT's built-in system that automatically retrieves the hashes, checks that they are properly GPG-signed, then checks .deb packages against the hashes), it would be necessary to download the package from Launchpad and compare. Really, I think the best option is to use APT to fix the "untrusted packages" problem and verify the packages. Once the proper keys are imported, reinstalling them should achieve this. Apr 7, 2013 at 18:43
2

Don't worry.

As Eliah explained in his comment, APT is secured using GnuPG. The public keys for the archives of Ubuntu are installed on your system and you should check those. After every download the file will be checked for integrity by the GPG/PGP signature and thus you can be sure nobody has tampered with. In case that fails, you'll see the exact warning you got in the first place.

A more thorough explanation, how to find and validate keys is described here: Ubuntu Community wiki: SecureApt

Using SSL won't make it more secure. The only thing you'll be hiding for all peers in between you and the archive server is what you're transferring/downloading and it won't protect anything more in respect to integrity.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .