Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5760
| From | Elmar Stellnberger <estellnb@gmail.com> |
|---|---|
| Newsgroups | linux.debian.security |
| Subject | Re: debcheckroot v2.0 released |
| Date | 2020-03-04 21:00 +0100 |
| Message-ID | <zGIls-Eo-7@gated-at.bofh.it> (permalink) |
| References | (12 earlier) <z73mN-3UW-1@gated-at.bofh.it> <zpA0W-4rq-9@gated-at.bofh.it> <zpCcq-5F7-7@gated-at.bofh.it> <zGHIK-rn-5@gated-at.bofh.it> <zGIbL-B4-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Hint: You can use -v to get a more verbose output if atea fails which includes the sha256 hash of the certificate (-vv would also be possible). From version 0.5 on atea should also do it without the --sys-keyfile option. For me atea succeeds with domains like mail.dotplex.com, secure.dotplex.de or web4.dotplex.com. Pages like ssl-tools.net do already cause problems and my own domain www.elstel.org could sometimes be reached em ordem and sometimes not (see the two certificates in the https://www.elstel.org/DANE/ tar file which have the same start and ending date, one of them is a rogue certificate). The only domain where I have never succeeded is cdimage.debian.org. Is it permanently spoofed or did the Debian maintainers just enter a wrong hash in the TLSA record? Am 04.03.20 um 20:41 schrieb Elmar Stellnberger: > It would be a question if anyone has tried to download a SHA512SUMS file > from cdimage.debian.org with atea? As it turned out downloading this > file with tails/tor is NOT sufficient. I have verified a Debian Live > 10.1.0 DVD image against the Debian 10.1.0 Install BD-DL I have. > Debcheckroot reported several infected packages like mkinitramfs, ispell > and several pam-modules though mounting the squashfs may already have > triggered some malware. > > Yours Sincerely > Elmar Stellnberger > > > > Am 04.03.20 um 20:04 schrieb Elmar Stellnberger: >> Hi folks >> >> You can now download the indicated program at >> https://www.elstel.org/atea/ and read some documentation at >> https://www.elstel.org/DANE/. >> >> Kind Regards, >> Elmar >> >> Am 17.01.20 um 16:52 schrieb Elmar Stellnberger: >>> Hi Cindy Sue! Hi folks! >>> >>> I must confess there is little you can do about missing emails >>> with debcheckroot. You can spot rootkits with hindsight but >>> intelligence can also break in and go without leaving any trace. What >>> would to my mind be necessary for a more secure email communication >>> is a better penetration of DANE. Many CAs are known to issue rogue >>> certificates to secret services so the public key is the only thing >>> that may be trustworthy of a certificate. If that public key is >>> signed and bound to a domain with DNSSEC (this is then called DANE) >>> it shall be safe. I would guess that email dispatching was safe if >>> encrypted and saved by DANE all the way to its target. F.i. it seems >>> likely that intelligence just tries to halt email delivery if some >>> suspicious email is in the queue until they have assessed what they >>> wanna do about it. And it is questionable how those emails which seem >>> to be sent successfully but which do not reach their target get lost. >>> >>> Something I as an end user can do about the emailing problem is >>> to write and send my emails on a secure machine. If I am using >>> webmail or an emailing program this requires to preconfigure >>> certificates known to be safe and to only allow these. All CAs need >>> to be disabled since the average user will never know which CAs issue >>> rogue certificates. According to my knowledge any simple web page >>> invocation immediately results in a cracked system if it is using a >>> spoofed certificate which can not be excluded for any simple web >>> search. Luckily my hoster provides DANE for the machines used for >>> email delivery, webmailing and my website configuration panel. And I >>> am still using a Debian 8 read only stick to boot such a secure system. >>> >>> Why the hell Debian 8? Isn`t that insecure? I believe it isn`t as >>> long as I only visit these two web pages of my hoster. Unfortunately >>> newer versions of Firefox have a special implementation for so called >>> HSTS (http strict transport security) certificates. You can not add a >>> security exception for such a certificate but you need to configure >>> all dependent certification authorities for such a certificate. >>> However with the first CA you acknowledge you compromise your >>> system`s security. Older versions of Firefox did not have this bug: >>> https://bugzilla.mozilla.org/show_bug.cgi?id=1606802 >>> >>> I am currently looking forward to test which versions of Debian 9 >>> would work. Firefox from Debian 10 does no more work. If you have >>> good luck your webmailing server supports DANE but does not use HSTS. >>> Then you can use a current Debian. With Debian 8 you simply need to >>> delete libnssckbi.so from libnss3 to disable all default CAs. You can >>> not delete them by hand. If you do you need to mark every singleton >>> CA but that does not prevent all deleted CAs to reappear a second >>> after you have deleted them. That is why you needed to delete the >>> .so. With newer versions of Firefox deleting libnssckbi.so does not >>> stay without side effects: You can then not acknowledge security >>> exceptions by hand any more. I have written a script to do that >>> automatically though and I am likely to publish it at >>> https://www.elstel.org/DANE/ in the future if sufficient interest is >>> given in the issue. Once I know the last good Firefox version I could >>> also approach to resolve the bug from above for newer Firefox >>> versions. Unfortunately Dana Keeler has given this bug a resolved >>> invalid so that it is unsure whether they would accept the bugfix >>> upstreams. According to Dana`s comments the bug should in deed be >>> marked as WONTFIX. That would be correct. If you like vote or comment >>> for/on this bug. >>> >>> Elmar >>> >>> >>> Am 17.01.20 um 14:29 schrieb Cindy Sue Causey: >>>> On 11/27/19, Elmar Stellnberger <estellnb@gmail.com> wrote: >>>>> Am 25.11.19 um 12:35 schrieb Patrick Schleizer: >>>>>> Yes, forget about NSA and alike. Let's not assume quasi-omnipotent >>>>>> attackers. That leads to defeatist mindset which isn't productive. >>>>> I would not let myself be defeated easily. Who has thought about >>>>> emails in your inbox which are deleted before you can see them? Easily >>>>> doable. They would just need to know your password. Or about outgoing >>>>> emails which do not reach their target. As far as I have learnt to >>>>> know >>>>> it you can see them in the sent folder but they never appear on the >>>>> other side, not even in the spam-box. The worse thing is however if >>>>> someone wants to contact you and you do not even know about it, the >>>>> other one just thinking you did not reply. >>>> >>>> There have been two situations that, no, I can't name just this >>>> second, so this is anecdotal material *until I stumble back upon* the >>>> very real cases, BUT... >>>> >>>> Twice in the last maybe six months, there has been chatter about the >>>> receiving end's server(s) stopping the flow of incoming emails for >>>> unknown reasons. The occurrences were purely "glitches", NOT on >>>> purpose. It was either machine failure or accidentally >>>> Human-instigated mis-code or something that provoked the situations. >>>> >>>> End users found out when a sudden flood of sometimes OLD email >>>> suddenly hit their email inboxes. The last one was just in last few >>>> weeks. If and when I re-encounter that information, I'll post for >>>> posterity. :) >>>> >>>> As for the once formerly viewed and then now missing emails, been >>>> there, done there. Things being what they are in my own #Life, I've >>>> most definitely... "wondered" how the emails "disappeared" when they >>>> are NOT something I would have EVER deleted. It affects very few, less >>>> than a handful of correspondences. >>>> >>>> Sanity is found in realizing I have a VERY LARGE inbox.. and I'm >>>> surely just not using the right words for my queries. I've convinced >>>> myself that I'm using words that convey the same thoughts as the >>>> original messages but are not a search string-friendly match for the >>>> specific words that were originally written. :) >>>> >>>> Cindy :)
Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-13 09:40 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Paul Wise <pabs@debian.org> - 2019-08-14 07:10 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-14 17:40 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-15 23:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Davide Prina <davide.prina@gmail.com> - 2019-08-16 10:40 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? CMH <chouck@binghamton.edu> - 2019-08-16 14:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Andrei Grosu <andrei_grosu@fastmail.net> - 2019-08-16 19:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:10 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 19:30 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-16 21:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-17 11:50 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-17 13:20 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-23 09:30 +0200
Re: Have I caught a firmware attack in the act? Or am I just paranoid? Elmar Stellnberger <estellnb@gmail.com> - 2019-08-23 21:00 +0200
debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-15 17:20 +0100
Verified Boot, Secure Boot, dm-verity, debcheckroot Patrick Schleizer <adrelanos@riseup.net> - 2019-11-16 14:00 +0100
Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:30 +0100
Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Sylvain Beucler <beuc@beuc.net> - 2019-11-16 15:40 +0100
Re: Verified Boot, Secure Boot, dm-verity, debcheckroot Elmar Stellnberger <estellnb@gmail.com> - 2019-11-16 15:40 +0100
Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-19 13:40 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-20 12:30 +0100
Re: debcheckroot v2.0 released Patrick Schleizer <adrelanos@riseup.net> - 2019-11-25 12:40 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-25 18:00 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-12-10 17:40 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2019-11-27 12:10 +0100
Re: debcheckroot v2.0 released Cindy Sue Causey <butterflybytes@gmail.com> - 2020-01-17 14:40 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:00 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-01-17 17:20 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:20 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 20:50 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-04 21:00 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-23 17:10 +0100
Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 04:40 +0100
Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-24 11:20 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-24 15:50 +0100
Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-03-25 03:00 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-25 11:30 +0100
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-03-26 11:10 +0100
Re: debcheckroot v2.0 released "vince@vheuser.com" <vince@vheuser.com> - 2020-04-01 20:10 +0200
Re: debcheckroot v2.0 released Paul Wise <pabs@debian.org> - 2020-04-02 02:00 +0200
Re: debcheckroot v2.0 released Lewis Yarema <lewisyarema91@gmail.com> - 2020-04-02 11:20 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 17:00 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:40 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 16:50 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:50 +0200
Re: debcheckroot v2.0 released William Gagnebé <william.gagnebe@gmail.com> - 2020-04-05 12:20 +0200
Re: debcheckroot v2.0 released l0f4r0@tuta.io - 2020-04-05 12:30 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-07 17:50 +0200
Re: debcheckroot v2.0 released "Niall O'Reilly" <Niall.oReilly+lists@no8.be> - 2020-04-02 18:30 +0200
Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-02 21:00 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-02 21:40 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-03 13:50 +0200
Re: debcheckroot v2.0 released Lee <ler762@gmail.com> - 2020-04-04 00:50 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@elstel.org> - 2020-04-04 09:40 +0200
Re: debcheckroot v2.0 released Bjørn Mork <bjorn@mork.no> - 2020-04-14 09:30 +0200
arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:40 +0200
Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-04-25 15:50 +0200
Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:00 +0200
Re: arbitrary code execution on unformatted usb stick Elmar Stellnberger <estellnb@elstel.org> - 2020-05-02 17:10 +0200
Fwd: Re: arbitrary code execution on unformatted usb stick estellnb@elstel.org - 2020-05-02 20:50 +0200
Re: debcheckroot v2.0 released Elmar Stellnberger <estellnb@gmail.com> - 2020-03-21 17:40 +0100
Probably a false alarm Re: Have I caught a firmware attack in the act? Or am I just paranoid? "Rebecca N. Palmer" <rebecca_palmer@zoho.com> - 2019-08-24 18:50 +0200
csiph-web