Yet another Hacker News

Debian apt security update (man-in-the-middle)

74 points SG- 2 hours ago 14 comments

8organicbits 2 hours ago | parent

I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.

edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...

thewisenerd 2 hours ago | parent

dupe (2h ago): https://news.ycombinator.com/item?id=50364814

justicz 1 hour ago | parent

I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.

[0] https://x.com/just1cz/status/2118009777922228361

justicz 58 minutes ago | parent

Speaking of which… if any of y’all work on security at OpenAI I have some questions for you about Daybreak! Please email me

sczi 40 minutes ago | parent

Nice work! A similar vulnerability in 2019 also found by you included the recommendation to update with:

  apt -o Acquire::http::AllowRedirect=false update
  apt -o Acquire::http::AllowRedirect=false upgrade

Since this also involves redirects, would that protect users while updating apt for this one also?

SoftTalker 53 minutes ago | parent

How would an attacker inject a redirect into an apt package download?

mikepurvis 46 minutes ago | parent

MITM on the network, I guess like DNS takeover or the like.

So you pass through the upstream headers but then simulate a failure/resume and supply different contents for the resumed download.

SoftTalker 41 minutes ago | parent

So apt doesn't verify signatures on what is actually downloaded?

dinosaurdynasty 31 minutes ago | parent

> Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification

from the OP

APT can use HTTPS, but often doesn't, making a MITM attack easier (also the idea for a long time has been signatures are enough, and/or TLS certs used to be a lot harder to get, but at this point you should really be using both).

SoftTalker 9 minutes ago | parent

Still doesn't make sense to me. So package A is downloaded, signature verified, then package B is downloaded, but somehow the package A file is replaced? Is it something like that?

hollow-moe 23 minutes ago | parent

But how do I update apt if apt is untrustable until fixed ? Good ol' .deb scp'd in dpkg'd.

ChrisArchitect 22 minutes ago | parent

Discussion here: https://news.ycombinator.com/item?id=50364814