A look in the mirror: Attacks on package managers

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2008, Pages 565-574

  Cappos, Justin ^a   Samuel, Justin ^a   Baker, Scott ^a   Hartman, John H ^a  

^a University of Arizona   (United States)

Author keywords

Mirrors; Package managenient; Replay attack

Indexed keywords

PACKAGE MANAGENIENT; REPLAY ATTACK; SECURITY MECHANISM; SECURITY PRACTICE; WORK STUDY;

MANAGERS; METADATA; MIRRORS;

SECURITY OF DATA;

EID: 70349278544     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1455770.1455841     Document Type: Conference Paper

References (32)

1. Debian APT tool ported to Red Hat Linux. http://www.apt-get.org/.
2. APT-RPM. http://apt-rpm.org/.
3. Arch Linux (Don't Panic) Installation Guide. http://www.axchlinux.org/ static/docs/arch-install-guide.txt.
4. J. Byers, M. Luby, and M. Mitzenmacher. Accessing multiple mirror sites in parallel: using Tornado codes tospeed up downloads. INFOCOM'99. Eighteenth Annual Joint Conference of the IEEE Computer and Communications Societies. IEEE, 1, 1999.
5. J. Cappos, J. Samuel, S. Baker, and J. Hartman. A Look In the Mirror: Attacks on Package Managers. Technical Report TR-08-06, Department of Computer Science, University of Arizona, Jul 2008.
6. Introduction to Code Signing, http: //msdn2.microsoft.com/en-us/library/ ms53736i.aspx.
7. A. Crooks. The netbsd update system. In ATEC '04: Proceedings of the USENIX Annual Technical Conference, pages 17-17, Berkeley, CA, USA, 2004. USENIX Association.
8. debsigs - What is debsigs. http://linux.about.com/cs/limixlOl/g/debsigs. htm.
9. DistroWatch.com: Editorial: How Popular is a Distribution? http://distrowatch.com/weekly.php?issue=20070827#feature.
10. M. Domsch. Re: YUM security issues...https://www.redhat.com/archives/ fedora-infrastructure-list/2008-July/msg00114.html.
11. man dpkg-sig. http://pwet.fr/man/linux/commandes/dpkg-sig.
12. R. Giobbi. Vulnerability Analysis Blog: Safely Using Package Managers, http://www.cert.org/blogs/vuls/2008/07/using-package-managers.html.
13. J. Hughes. HughesJR.com - Attacks on Package Managers - ummm...http://www.hughesjr.eom/content/view/22/l/.
14. R. H. Johnson, [gentoo] Index of/users/robbat2/tree-signing-gleps.http:// viewevs.gentoo.org/viewevs.py/gentoo/users/robbat2/tree-signing-gleps/.
15. The KPackage Handbook, http://docs.kde.org/development/en/kdeadmin/ kpackage/.
16. D. Mazières, M. Kaminsky, M. F. Kaashoek, and E. Witchel. Separating key management from file system security. In Proc. 17th SOSP, pages 124-139, Kiawah Island Resort, SC, Dec 1999.
17. D. Mazières and D. Shasha. Building secure file systems out of Byzantine storage. In PODC '02: Proceedings of the twenty-first annual symposium on Principles of distributed computing, pages 108-117, New York, NY, USA, 2002. ACM.
18. milwOrm - exploits : vulnerabilities : videos : papers shellcode. http: //www. milwOrm. com.
19. Netcraft: Strong growth for Debian. http://news.netcraft.com/archives/ 2005/12/05/strong-growth-for-debian.html.
20. K. Oppenheim and P. McCormick. Deployme: Tellme's Package Management and Deployment System. In Proc. 14th Systems Administration Conference (LISA '00), pages 187-196, New Orleans, LA, Dec 2000.
21. Gentoo-Portage. http: //gentoo-portage.com/.
22. Installing Applications: Packages and Ports. http://www.freebsd.org/doc/ en-US.IS08859-1/books/handbook/ports.html.
23. RPM Package Manager, http://www.rpm.org/.
24. P. Sharma, P. Shah, and S. Bhattacharya. Mirror hopping approach for selective denial of service prevention. Object-Oriented Real-Time Dependable Systems, 2003. (WORDS 2003). Proceedings of the Eighth International Workshop on, pages 200-208, 2003.
25. Slackware Package Management, http://www.slacksite.com/slackware/ packages.html.
26. Stork, http://www.cs.arizona.edu/stork.
27. Synaptic Package Manager - Home. http://www.nongnu.org/synaptic/.
28. URPMI. http://www.urpmi.org/.
29. dkpg-sig support wanted? http://nixforums.org/aboutl01637-asc-15.html.
30. G. Wurster and P. van Oorschot. Self-Signed Executables: Restricting Replacement of Program Binaries by Malware. In 2nd USENIX Workshop on Hot Topics in Security, Boston, MA, Aug 2007.
31. YaST - openSuSE. http://en.opensuse.org/YaST.
32. Yum: Yellow Dog Updater Modified.http://linux,duke.edu/proj ects/yum/.