News for hackers. Stuff that matters.

A comment on Debian apt security update: man-in-the-middle arbitrary code execution. Parent comment

Re:Debian apt security update: man-in-the-middle arbitrary c... by teddyh on Wednesday November 04, 2026 @09:20AM (#50365911)
HTTPS will not protect you from a bad/compromised mirror.
[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by Avamander on Wednesday November 04, 2026 @09:22AM (#50365933)
A bad mirror is much less likely than someone MiTMing, at least for most machines.
[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by TacticalCoder on Wednesday November 04, 2026 @11:52AM (#50368313)
Wait: Debian packages are signed.

A compromised mirror cannot serve packages that aren't properly signed.

This attack used an HTTP redirect to serve a backdoored package after the signature has been verified. I'm not sure that HTTP redirect attack would work with an HTTPS repository!?

[ Parent | on HN ]
Re:Debian apt security update: man-in-the-middle arbitrary c... by leni536 on Wednesday November 04, 2026 @12:13PM (#50368576)
Why wouldn't it work on a compromised mirror? HTTPS servers can still do redirects.
[ Parent | on HN ]