Hacker News Reader

Comment by 0xcde4c3db | Hacker News Reader

> Backdoor in Linux Mint (February 2016)

> Stop using MD5. If you still use SHA1, then add also the SHA256 or SHA512 hashes.

How did hash strength have anything to do with this? Unless my sources are completely out of whack, the MD5 of the backdoored ISO didn't match the official ISO. My understanding is that there is a vulnerability along these lines, but it requires the official build process to be compromised, whereas this was an edit on the Mint website to point to a malicious file on an attacker-controlled server.

View on HN

Interesting that the site uses TLS, but most of the servers containing the download use plain old HTTP, which as we know, can be easily subjected to a MITM attack.

https://linuxmint.com/edition.php?id=225

Only a few of the ISOs are delivered with TLS/HTTPS, like this one:

https://mirrors.c0urier.net/linux/linuxmint/iso/stable/18.1/...

Properly signed images shouldn't need to be delivered over a secure connection. As long as you can receive a signed hash, and the signing key itself over a secure connection, you can obtain the image itself from anywhere.

True, although sometimes it's good to deliver signed updates over a secure connection for defense-in-depth - for example, to mitigate vulnerabilities like the recent CVE-2016-1252.

+1 "but some software has it's own crypto"¹ is kinda bad excuse for actively avoiding additional security - like Debian has on their mirrors (I think there even is (was?) an FAQ entry why there are no HTTPS mirrors, stating that APT packages are securely signed and that's all you'd need).

¹ I'm aware that APT actually uses GPG, but it does (did) so fishy manipulations both before and after invoking GPG on the signed files, that, if this would've happened in a corporate setting, I'd have rather peculiar questions for the employee who wrote that code.

That recent CVE, and also issues in software that I co-maintain, plus all the other CVEs that are delivered to my inbox changed my mind on open source quite a lot. Open source is completely worthless if no one actually bothers to read the code; I doubt anyone actually read those portions of the APT code, because anyone with a secure coding or crypto coding background should be alerted already by the function names (look them up). Instead we all always assume "ah well people use it and someone probably checked that anyway... should be good to go!". NO. It's not good to go. Read [the] code.

> ¹ I'm aware that APT actually uses GPG, but it does (did) so fishy manipulations both before and after invoking GPG on the signed files, that, if this would've happened in a corporate setting, I'd have rather peculiar questions for the employee who wrote that code.

From the openSUSE, I brought up my concerns about us not using HTTPS and it boils down to the fact that few mirrors want to host stuff over SSL. And if not many mirrors will do it, the benefit to users is diminished (you can't force the usage of SSL on the client).

On the plus side, openSUSE does serve a copy of the GPG signing key for the ISO over HTTPS (from the main site). I just wish that there were less steps required to be sure that the ISO is official.

and the signed hash is actually checked against the image. Of course, this is the step that is missing because it's a non-mandatory manual process.

Serving the images directly over HTTPS would provide more security for every end user that is not manually checking signing hashes.

Hashing strength has nothing to do with it. The real lesson is that they should have signed the hash they put on their website and actively encourage users to check it.

I would also argue that it's important not to conflate issues with the Linux kernel with any particular Linux distribution specific issue. The incident with Linux Mint is not reflective of the broader security of Linux in general, although it is good to point out that how one distributes anything can have security ramifications.

I feel the same way about the discussion of Mirai - the only thing broken embedded/IoT systems have in common with any given Linux distro, is the kernel, and maybe a few basic userspace bits (sometimes).

The site does have some interesting discussion about Core Infrastructure (again technically separate from Linux, although fundamental) and other Kernel issues and hardening though.

The edit to the site was due to the whole thing being Wordpress. I know that Wordpress is decently flexible, "good enough" or even comfortable for many users, even technical ones, my thought is why not have the site be statically hosted instead? Or at least the primary informational pages.

Reply on news.ycombinator.com