News for hackers. Stuff that matters.

A comment on Cyanogenmod Updater vulnerable to MITM attack. Parent comment

Re:Cyanogenmod Updater vulnerable to MITM attack by gsnedders on Monday February 17, 2014 @08:07AM (#7251880)
You still need to securely fetch the signatures somehow initially. Similarly, http://download.cyanogenmod.org/ provides md5 hashes for downloads but because it's not done over HTTPS you've got no guarantee that you're getting the right hash to verify the insecure download.
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by ivanca on Monday February 17, 2014 @08:21AM (#7251930)
Actually if you just google the MD5 and it shows up in google should work as a guarantee

(Example: https://www.google.com/search?q=b13afc01102c84425ca995469f1a...)

[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by erichurkman on Monday February 17, 2014 @12:06PM (#7252988)
Unless the download page is hacked and Google picks up a spoofed checksum.

They need to sign their updates as well.

[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by ivanca on Tuesday February 18, 2014 @12:06AM (#7256493)
Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel.

The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.

[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by pferde on Monday February 17, 2014 @08:51AM (#7252047)
Unless the malware is spread by Google.
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by rst on Monday February 17, 2014 @09:30AM (#7252215)
... or, more likely, the MITM is capable of spoofing selected google searches as well.
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by ivanca on Monday February 17, 2014 @11:58AM (#7252941)
You know Google always uses ssl right?
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by rst on Monday February 17, 2014 @10:28PM (#7256178)
There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by nezza-_- on Monday February 17, 2014 @09:02AM (#7252085)
You just need to have the public-key on the device already and then verify a cryptographic signature (not just a hash) of the zip.
[ Parent | on HN ]
Re:Cyanogenmod Updater vulnerable to MITM attack by luizg on Tuesday February 18, 2014 @03:13PM (#7260722)
Looks like CM have a https version of the download page now.
[ Parent | on HN ]