7

Please let me raise this question here hoping the we will also receive an official answer, even though this a mostly community driven site.

Since Dell now is the second manufacturer after Lenovo (Superfish) just this year to compromise Web security in OEM-Windows installations and both also offer Ubuntu Edition branded computers with OEM installs I think that users trusting the Ubuntu brand deserve an answer that is far better than:

Canonical can not provide those OEM images to the public.

Source: Launchpad, see also.

Which is contradictory to the benefits of free software operating systems: Knowing the verifiable and reproducible state of a system and who put the parts of it together.

Answers I'd like to see:

  • Is there evidence that the images that Canonical provides to OEMs don't contain modifications to the Ubuntu root certificate store? (Build system, scripts or package list used, hashes and so forth.)
  • Are there already established processes that impose and ensure that OEMs offering Ubuntu certified computers never tamper with the contents of the root certificate store? (Also not to pre-install customized browsers or offering packages from their repositories as a bypass or implementing tricky firmware features that tamper with the certificate store.)

Supplemental answers welcome:

  • One answer to compare the local root certificate store with corresponding packages from the repositories. (Probably better as a separate Q&A if it doesn't exist already.)
    • Optionally answers from users with Ubuntu certified computers – look at the link above – that checked their systems this way. (Please wait a few days until we find appropriate criteria or if this is a good idea at all. We probably organize it as a wiki-style answer for everyone to edit once criteria are set – no big-list answer-style please. Criteria that currently come to my mind: manufacturer, model, release shipped, release currently running.)

To be clear, the problem in both events was that official certificate authority infrastructure was bypassed with very poor security standards in mind which quickly led to abuse of these certificates by other parties.

Related posts on Information Security SE:

2

Ubuntu's open source nature does not make it immune from the same kind of issue, where an OEM may have added malware (accidentally or deliberately), whether that be additional CA certificates or otherwise, on the images it distributes pre-installed on computers.

If you install Ubuntu yourself there are a number of measures against malicious modification by third parties: If you obtain an image of Ubuntu from an official Ubuntu source you can verify its checksum, and if you keep Ubuntu updated using APT with the official repositories you benefit from its built-in digital signing, assuring you that the images have not been tampered with by third-parties.

However, as you may suspect if Ubuntu is pre-installed by an OEM they have almost certainly made modifications to it aside from just installing the official images, for quite legitimate reasons. If bought from a trusted source it would be very unlikely that the installation would include malware, possibly even more unlikely than the typical Windows installation, but there is nothing that would make it impossible, and you only need to look at the examples from Lenovo and Dell to see how that might happen.

As for whether you need to worry, you can judge for yourself. Wiping and reinstalling from an official Ubuntu installer might quell some fears, though you will lose any OEM-specific customisation or extra functionality.

I can't answer your question about whether Ubuntu/Canonical try to police any changes to root certificate stores on OEM's derived installations, but I can't see how that would be feasible to do comprehensively enough.

-1

There is a simple way to check https://dellrootcheck.detectify.com on your pre-installed Ubuntu system.

  • This tool only checks for the eDellRoot CA certificate which is relevant to that particular vulnerability with Dell computers only. It doesn't check if any given computer OEM has installed any additional CA certificates of their own. – thomasrutter Nov 25 '15 at 2:10
  • I made the base image for Dell and other OEM before. I never see there is any additional CA certificate. If you can provide the evidence for additional CA certificates in OEM image, I am glad to know. – FourDollars Nov 25 '15 at 3:00
  • If you can not provide any evidence for this, it is just a FUD en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt. – FourDollars Nov 25 '15 at 3:07
  • 2
    It is clearly not FUD, since it's actually happened twice recently, with both Lenovo and Dell computers. The OP's question, about whether this is possible with pre-installed Ubuntu offered by OEMs, is a legitimate one (and the answer is that it is possible, we just aren't aware of it ever happening). – thomasrutter Nov 25 '15 at 3:19
  • 1
    The OP's question wasn't about whether you have seen this happen before, but whether it could happen and what steps are taken to try and ensure it doesn't. Why are you demanding evidence from me? Evidence for what? That it has happened before? I never said it has. What about this question has caused you to have this defensive reaction? – thomasrutter Nov 25 '15 at 4:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.