0

Scenario : I recently came across this issue using lubuntu. When I tried upgrading using terminal "apt upgrade", I got an error like you are using http which is not secure, so the default action was done to skip the upgrade. Without taking it seriously or reading it properly, I upgraded it using the app "Software upgrade", which does it all with click of button. It upgraded successfully, but that was the last goodbye session. It had corrupted everything on the os, not sure if it was malware or something else.

Question : While installing a fresh linux, we get sha or md5 hashes to verify the authenticity of the iso's downloaded. But most of the upgrades are done through HTTP and how to verify those packages are same as the source, or is there any other way to prevent MITM from sending me a corrupt package?

Improve this question
3
  • Please describe the problem in detail. Such as screenshots of how far it gets in the boot process. Or which commands are broken. "Corrupted everything on the OS" doesn't say much. – John Mahowald Nov 17 '19 at 11:21
  • Boot stopped at decrypting luks and failed there. I tried opening just the luks partition on another linux system, but it kept mentioning it needs to cleaned before use. So tried with fsck and other tools but none seemed to fix it. I had backup so I have formatted it now. – Ajay Singh Nov 23 '19 at 4:12
  • My question was to be sure that the packages received are secure, no matter what problems they may cause. I'm having lot of MITM going at my place recently, right now its mostly adware. Thanks for your answers. – Ajay Singh Nov 23 '19 at 4:13
3

You have made the assumption that your system was malware infected without evidence or describing the problem. While this is possible, be more certain by doing forensics and looking into root cause.

A trustworthy apt repo will include secure apt gpg signatures on its metadata. You can review the signatures to be sure they match what is published for lubuntu. apt has leaned on gpg to maintain integrity more than https, but you can use both.

Run debsums_init then debsums --changed to identify installed packages with changed checksums.

The debsums manual acknowledges this has limited use in a security context, so also look into file modification detection or malware signature software.

If the host remains unrecoverable, reinstall from clean media, and restore data from backup.

Improve this answer
1
  • Thanks for the answer. I'll be looking for those pointers in future. I didn't debug it as the whole luks partition got corrupted, right after that upgrade. That was only my test systems, and I am not an expert at data rescue so had to go with formatting. – Ajay Singh Nov 23 '19 at 4:01
1

One way to ensure that the package is the right one and you are not being attacked is to add its key with apt key. For more information Also you can try to avoid mitm attacks, which is kind of complex because of the great variety of ways that can be done. For example for arp spoofing one of the most common techniques you can create static lines in your arp tables.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.