package manager attacks

["Matthew Gillen" <user=50@nabble.blu.org>]

 Saw this on slashdot: 
http://www.cs.arizona.edu/people/justin/packagemanagersecurity/attacks-on-package-managers.html

They make some interesting points, but in the end it's a pretty weak attack, 
and wouldn't work in the real world. 

First, I don't think any package manger will "downgrade" without significant 
user intervention, so just providing access to old filelists (and the files 
themselves) is not sufficient to install broken software on a client. 

That leaves the DoS attack where you could simply prevent clients from 
upgrading.  The problem there is that yum, apt, etc, all use rotating 
mirrors, so a given client would have to somehow keep getting "bad guy" 
mirrors (just once getting to a "good guy" mirror and they get the critical 
updates).  You'd have to have a significant number of these "dummy" servers 
to keep clients from updating, and by that point you'd be detected (it would 
be trivial to identify "dummy" servers once you know that you need to look). 

Matt 

-- 
This message has been scanned for viruses and 
dangerous content by MailScanner, and is 
believed to be clean. 

_______________________________________________ 
Discuss mailing list 
[hidden email] 
http://lists.blu.org/mailman/listinfo/discuss