Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

Could you expand on why you consider this vulnerability to be such a major indicator of incompetence, versus all the other major vulnerabilities that regularly pop up in software? They all seem obvious in hindsight, but as they say, hindsight is 20/20.

View on HN

Sure...

1) Still no dnssec on archive.openwrt.org 2) Still no tls on archive.openwrt.org

Those together mean you can poison the dns for it and it will download packages from your fake site. And...

3) Problem was introduced Feb 2017, nobody checked tampered packages were still rejected until 2020.

With 3) it means anyone can put whatever they want in the fake packages and the OS will install them.

I don't need much from my router but I need it to be secure. So I got rid of openwrt the next week.

If archive.openwrt.org is like any other *nix package management software, it's likely that it doesn't need dnssec or tls. The signature of the packages get verified based on predefined public keys. If the packages aren't signed by openwrt's private keys, the software will reject it.

You'll notice many other package management software do the exact same thing.

In any case, this is based on what other package management software does. I don't know if this is indeed the case.

That is indeed the theory. But the point here is how openwrt broke that "last / only line of defence" package signature check and nobody noticed for three years and two major releases.

I am not aware of this. What happened?

As I linked above, introduced Feb 2017 found Jan 2020

https://openwrt.org/advisory/2020-01-31-1

A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts.

> moved to a fanless x86_64 running a minimal normal distro, which uses apt-get over HTTP by default

Fixed that for you.

Normal distros have package signatiure pki that works :-)

Ha! apt-get had 17 vulnerabilities in the last few years, two of them with very high severity score, easily exploitable [0]. For example:

CVE-2019-3462 Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine.

[0] https://www.cvedetails.com/vulnerability-list/vendor_id-23/p...

Edit: many of the CVEs for apt-get are in the "bad pki" class, all of them are "severe" as they allow malicious code execution:

CVE-2009-1358 apt-get does not check for the correct error code from gpgv

CVE-2011-1829 APT does not properly validate inline GPG signatures

CVE-2011-3634 APt accepts connections when the certificate host name fails validation

CVE-2014-0478 APT does not properly validate source packages, allow installation of Trojan horse packages by removing the Release signature.

etc etc.

Facts of life: all software contain an uncountable number of severe vulnerabilities. It is unfair to single-out openwrt IMHO.

Yes, it's true... for redhat the worst rpm cve I could see from a quick google was back in 2012.

The CVE you mention is about the transport part, it's not easy to get right and everything that goes on the network is at some risk of that. Still that seems a different kind of implication than nobody checked if packages could be tampered successfully for 3 years and afterwards nobody changed the infrastructure.

And so does openwrt, since you'll notice that that CVE was fixed.

Yes it was fixed when pointed out to them, after all openwrt users from 18.06+ had been exposed to this for three years. There's no known way to guard against bugs in the end, but... you can empirically test... they didn't check at all if their package signature check could detect tampering after patching it? For 3 years?

Then no infrastructure changes as a reaction to what happened? Like I said good for them, the PR mentions they will get some funding this is the kind of thing they can spend it on.

Reply on news.ycombinator.com