1

I have installed Google Chrome from the .deb file provided here, but after I installed it I realised that I had not checked the MD5 of the .deb file to make sure that it was not corrupt or tampered with (as some of the other software that I was downloading at that time had the wrong MD5 and I had to re-download) before I installed Google Chrome and then deleted the .deb file.

I have two, linked questions:

  1. Is there any way in which now I can verify the integrity of my current Google Chrome installation? Perhaps during the installation an application would have logged the MD5? Or perhaps with the key that it would have been signed with I can still test without a reinstall of Google Chrome?

  2. Where can I find the official MD5 for Google Chrome? I have been unable to find this on their website.

  • The only way to 100% avoid attack is to use a DNSSEC download server. – Peter Krauss Dec 1 '18 at 22:04
  • Example: 0. Google.com contain many erros. 1. UBUNTU.ORG contais many warnings so apt is exposed. 2. DEBIAN.ORG use DNSSEC but contains an address warning , "Nameserver dns4.easydns.info has an IP address (2620:49:4::10) without PTR configured". – Peter Krauss Dec 1 '18 at 22:05
2

Well, the easiest method of verifying a deb is via apt

See How secure is the apt-get install command against man in the middle attacks and the Securing Debian Manual for details.

This does not help you, however, if you did not install the package via apt.

It then depends on how the .deb was packaged. If it was "properly" packaged it should include md5sums of the files

Look in /var/lib/dpkg/info/google-chrome.md5sums I am not sure of the exact file name here.

You can also use the -V or dpkg --verify options

dpkg --verify google-chrome

-V, --verify [package-name...]
          Verifies  the  integrity  of  package-name  or  all  packages if
          omitted, by comparing information from the installed paths  with
          the database metadata.

          The output format is selectable with the --verify-format option,
          which by default uses the rpm format, but that might  change  in
          the  future,  and  as  such programs parsing this command output
          should be explicit about the format they expect.

Man page

If you installed a compromised package and the person was good, or the person who packaged the .deb did not follow standard protocols, you really can not verify the package as the md5sums will be good (in the first case) or missing (in the second case).

This is an example of why you should not install packages outside of the ubuntu repositories (use Chromium) and why I advise people who package follow the packaging guidelines. Although the guidelines are a hassle, they are important.

  • The repros are quite limited... Isn't that a little overkill? – Tim Apr 25 '15 at 15:53
  • I ran the command dpkg --verify google-chrome-stable with sudo as it did not very well before, and the the command seems to have been executed usefully, although there was no output, does this mean that the files match the MD5sums of those in the file? – user364819 Apr 25 '15 at 15:59
  • @Tim - overkill? – Panther Apr 25 '15 at 16:02
  • Not installing outside repros. Isn't that going a little far to be safe? – Tim Apr 25 '15 at 16:04
  • @Tim - depends on your position on security. Just because something, a script or a binary or a lib is packaged as a .deb in no way ensures the package is safe or secure. I can package a modified version of sudo into a .deb and even included a valid package such as google-chrome . As people use more and more ppa and install things outside of the official repos I anticipate more problems with social engineering. – Panther Apr 25 '15 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy