Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5723

Re: debcheckroot v2.0 released

Show all headers | View raw

Am 25.11.19 um 12:35 schrieb Patrick Schleizer:
> How often did you see initrd being infected?

recently only once. So the attackers may change their vector; they have 
already done so multiple times.

> Not using apt/dpkg comes at the expense of not being able to fully
> verify the whole system. What if there are outdated packages on the
> system which aren't available from anymore from repository? Using
> snapshot.debian.org?

I have just extended debcheckroot to also support file repos. Now it can 
check 100% of the packages I have installed. That was necessary because 
f.i. the printer driver is vendor specific and can not be fetched from 
an online repo. I will publish that as debcheckroot v2.2 soon. Outdated 
packages are a problem though; I have supposed that Debian would 
maintain sha256sums for packages not available online any more. However 
I do not see any good possibility to resolve this without support from 
the distributors. However I am not sure whether outdated updates would 
still be available on snapshot.debian.org; I would not believe so, 
though perhaps anyone else reading this list could help us. If it is not 
about updates but about singleton packages one could download specific 
packages from snapshot by hand if you really come across having 
installed such a package.

>
> Also, for quickly repeatable verification it would be best to prepare as
> much as possible in background / during upgrade. Other tasks can be done
> at the same time. Then booting from read-only to debcheckroot purposes
> could safe a lot time. The less time it needs, the more it gets within
> reach to automate the process without sacrificing much boot time.
>
> Also by not using apt/dpkg, any packages downloaded would have to be gpg
> verified manually.
>
> I also don't see debcheckroot make use of gpg signature verification of
> downloaded files?
>
> Reinventing apt is difficult. See these attack on package managers:
>
> https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html
>
> Package metadata could be outdated. Downloaded package contents could be
> malicious or altered to pass verification.

Yes, tor is no ultimate remedy to this. As long as there are little 
downloads anonymity may be compromised. The best way to shield against 
such attacks may be to first generate sha256sum lists in a singleton 
boot and then later on use them in another boot so that no malware from 
unpacking packages can persist in memory. However that is no remedy to 
altered package content. The only way I know to avoid this is to only 
install from blue ray media without using online updates.

> That article https://www.elstel.org/software/GnuPG-usage.html.en starts
> with "How to use GnuPG securely". That isn't the best way to communicate
> "Key signatures are not trustworthy in general" which is a pretty broad
> claim.
>
> If "Key signatures are not trustworthy in general" then all apt package
> downloads could be considered compromised since APT relies on gnupg for
> verification. With that was true, and with mindset, and that being
> unfixable, we could as well as give up.

Yes, that is what I presume. apt can install compromised updates. I know 
this is at least an attack vector for Windows. To repeat it I would at 
least doubt if not presume about any key which is stored online that it 
is compromised. Most times people connect with ssh to such machines and 
have a local certificate on the computer from which they connect. The 
certificate can be copied and the password will be keylogged. Only a 
very few people employ security strategies like switching keyboard and 
monitor to a computer where you do not web-browse or email. I have 
devices for that but most people don´t and as long as the distributors 
do not advertise it I presume that they do not follow such a strategy. 
Finally it would still be possible to get the key by physical access to 
that computer. I would also believe that for a distro like Debian this 
would pay of for intelligence services.

To me personally I don´t have a defeatist mindset even not if the 
NSA/CIA or similar services are attacking me. They have once deleted the 
partition table on a computer used only offline to analyse some rootkit. 
Those who hack me also have physical access to my computers. There is no 
way for a defeatist mindset though as I can not let my human rights 
including that to live be violated.

>
>>> To a rootkit hunter which laymen can use it's a long way to go. Some
>> debcheckroot is targeted at technically experienced users.
>
> That's sad. Understood.

No it isn´t. People who care about security need to acquaint themselves 
with some basic facts on how the system they use is working. As it is 
Linux all the information should be available for the interested user. - 
and people do not only need to do so for use of debcheckroot.

>> No way to
>> hunt rootkits authored by the NSA otherwise.
>
> Yes, forget about NSA and alike. Let's not assume quasi-omnipotent
> attackers. That leads to defeatist mindset which isn't productive.

I have already commented on this.

> Why couldn't it be fully automated without manual interpretation needed?

That is not so easy to answer but an unsuspecting novice user simply 
will not be safe. There are just too many pitfalls. You do not need to 
know much but you need to understand some crucial facts to my believe. 
The thing why you can not automate this is that there is a hack for any 
automation how it can be bypassed. Whenever I have found something it 
was due to some unexpected action taken by me and not because the tools 
were so super. The NSA has a billion budget (correct me if someone knows 
the exact amount) and you won´t be smarter in programming than they are.

> Usability and popularity. Both hard. Software is only step 1.
>
> Full disk encryption is proven effective. If one travels and a bag gets
> stolen by a criminal, no data can be accessed.
>
> Keyloggers are really bad but unrelated from that.

My attack scenarios always include key loggers. They are a too valuable 
tool for intelligence to miss this possibility. On the other hand my 
equipment hasn´t been stolen yet. Nonetheless anyone needs to know his 
enemies and what kind of attacks to shield against.

> Yes, Android has security features which are working fine, reliable,
> would be replicable on Linux desktops in principle, but aren't yet.
> That's the point of that writeup.
>
> https://www.whonix.org/wiki/Kicksecure#iPhone_and_Android_Level_Security_for_Linux_Desktop_Distributions
>
> debcheckroot could help getting something like verified boot for Debian.

Well it is GPLv3. Anyone who would like to extend or develop it into 
some other direction is free to do so if he has enough energy and 
resources to do so.

I hope I have sufficiently answered you questions and your points of 
discussion. If not simply re-ask.

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-13 09:40 +0200
  Re: Have I caught a firmware attack in the act? Or am I just paranoid? Paul Wise <pabs@debian.org> - 2019-08-14 07:10 +0200
  Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-14 17:40 +0200
    Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-15 23:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Davide Prina <davide.prina@gmail.com> - 2019-08-16 10:40 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? CMH <chouck@binghamton.edu> - 2019-08-16 14:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just paranoid? Andrei Grosu <andrei_grosu@fastmail.net> - 2019-08-16 19:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:20 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:10 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:30 +0200
      Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 21:20 +0200
        Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-17 11:50 +0200
          Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-17 13:20 +0200
            Re: Have I caught a firmware attack in the act? Or am I just  paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-23 09:30 +0200
              Re: Have I caught a firmware attack in the act? Or am I just  paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-23 21:00 +0200
                debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-15 17:20 +0100
                Verified Boot, Secure Boot, dm-verity, debcheckroot Patrick Schleizer <adrelanos@riseup.net> - 2019-11-16 14:00 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:30 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Sylvain Beucler <beuc@beuc.net> - 2019-11-16 15:40 +0100
                Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:40 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-19 13:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-20 12:30 +0100
                Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-25 12:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-25 18:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-12-10 17:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-27 12:10 +0100
                Re: debcheckroot v2.0 released Cindy Sue Causey <butterflybytes@gmail.com> - 2020-01-17 14:40 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:50 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-23 17:10 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 04:40 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 11:20 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-24 15:50 +0100
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-25 03:00 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-25 11:30 +0100
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-26 11:10 +0100
                Re: debcheckroot v2.0 released "vince@vheuser.com" <vince@vheuser.com> - 2020-04-01 20:10 +0200
                Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-04-02 02:00 +0200
                Re: debcheckroot v2.0 released Lewis Yarema <lewisyarema91@gmail.com> - 2020-04-02 11:20 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 17:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 16:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:50 +0200
                Re: debcheckroot v2.0 released William Gagnebé <william.gagnebe@gmail.com> - 2020-04-05 12:20 +0200
                Re: debcheckroot v2.0 released l0f4r0@tuta.io - 2020-04-05 12:30 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-07 17:50 +0200
                Re: debcheckroot v2.0 released "Niall O'Reilly" <Niall.oReilly+lists@no8.be> - 2020-04-02 18:30 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-02 21:00 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 21:40 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:50 +0200
                Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-04 00:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:40 +0200
                Re: debcheckroot v2.0 released Bjørn Mork <bjorn@mork.no> - 2020-04-14 09:30 +0200
                arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:40 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:50 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:00 +0200
                Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:10 +0200
                Fwd: Re: arbitrary code execution on unformatted usb stick estellnb@elstel.org - 2020-05-02 20:50 +0200
                Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-21 17:40 +0100
      Probably a false alarm Re: Have I caught a firmware attack in the  act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-24 18:50 +0200

csiph-web