oss-sec mailing list archives
Re: CVE for Kali Linux
From: Daniel Micay <danielmicay () gmail com>
Date: Sun, 22 Mar 2015 15:05:18 -0400
On 22/03/15 01:55 PM, Kurt Seifried wrote:
So in the case of an ISO download that is GPG signed how do I verify the key is correct? If this is all done over HTTP it is pretty trivial for an attacker to run a Man in the Middle proxy that string replaces they key/signature as needed. HTTPS significantly raises this bar, it goes from "run off the shelf Squid/etc" to "convince a CA to give you a wonky certificate".
It's not this bad for a notable FOSS project if they're willing to put in some work. CryptoCat and the Tor project have their keys pinned here and they're probably in Firefox too (don't feel like checking): https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json If major Linux distributions wanted to put in this effort, they'd have it too. It does mean staying on top of managing certificates, as the pin needs to be dealt with a few months in advance of switching. This can't scale which is the main problem with it, but I doubt that Google or Mozilla would turn away a Linux distribution with a significant userspace if they wanted to do this. There's little doubt that they'd pin a key for Debian or Fedora... and it would allow a sane bootstrap for the distributions GPG keyring.
Attachment:
signature.asc
Description: OpenPGP digital signature
Current thread:
- Re: CVE for Kali Linux, (continued)
- Re: CVE for Kali Linux Michael Samuel (Mar 21)
- Re: CVE for Kali Linux Florian Weimer (Mar 22)
- Re: CVE for Kali Linux Kurt Seifried (Mar 22)
- Re: CVE for Kali Linux Jeremy Stanley (Mar 22)
- Re: CVE for Kali Linux Kurt Seifried (Mar 22)
- Re: CVE for Kali Linux David A. Wheeler (Mar 22)
- Re: CVE for Kali Linux Solar Designer (Mar 22)
- Re: CVE for Kali Linux Solar Designer (Mar 22)
- Re: CVE for Kali Linux Kurt Seifried (Mar 22)
- Re: CVE for Kali Linux Donald Stufft (Mar 22)
- Re: CVE for Kali Linux Daniel Micay (Mar 22)
- Re: CVE for Kali Linux Kristian Fiskerstrand (Mar 22)
- Re: CVE for Kali Linux Jeremy Stanley (Mar 22)
- Re: CVE for Kali Linux David A. Wheeler (Mar 22)
- Re: CVE for Kali Linux Daniel Micay (Mar 22)
- Re: CVE for Kali Linux Stephen Kitt (Mar 22)
- Re: CVE for Kali Linux Daniel Micay (Mar 22)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 22)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 22)
- Re: CVE for Kali Linux Russ Allbery (Mar 22)
- Re: CVE for Kali Linux Solar Designer (Mar 22)