just received the final documents (contracts) for my new project. gonna work at a IT security company in Holland for my graduation project. yey! :) Apparently the background check (one month!) on me turned out good. I had to hand in the whole 10-year of history of my life with info like employments, education, interviews with me and my previous employers, etc.
@gertvdijk if you're looking for help with patching rails apps for that vuln, my rates are $18/hour, or if it's entirely open source, i just require a recommendation at the end of it.
so yes, rails had a problem. they fixed it, a few stupid people are updating it the wrong way, it's in metasploit now (ew), so any script kiddy can point it to things with a reverse shell payload.
and i've still got a list of open source projects to update that's a mile long. and growing.
I was re-tagging a question about developing applications when I noticed there was a dev tag. To me, both dev and development cover exactly the same thing.
Can we merge the tags or make dev a synonym of development?
It turns out that Bugs Bunny was impersonating someone when he ate the carrot.
Was he also impersonating a contemporary actor when he asked "What's up doc?" or is that a Bugs Bunny original?
SU is 'officially' the home/beginner computer networking site, but people tend to post their networking basics on AU/UL/etc. SF is for professional setting only.
It's the first time this happened. On regular terminal my login works great, even as root. My user name is always the same (Júnior) and login in never was a problem. I even tried setting the root passwd but nothing helps.
Any help?
Ubuntu 12.04.1 64bit
mainline is a bit confusing in its name. It just means that this branch is where Linus pulls into (typically from -next). Once .0 is released, it's up to the stable team to maintain it and Linus moves on to preparing the next RC from -next. (as far as I understand it from the last couple of years working with Linux)
oh good grief. Answered a question to an Unregistered user by accident (promised myself not to do this anymore)... chances of looking at it are probably minimal...
what do you guys think about the use of footnotes in my answers? (if you've seen them) never seen anyone else doing that.
Use Lintian. That's the tool checking.
$ lintian -i packagename.deb
W: packagename: package-name-doesnt-match-sonames packagename
N:
N: The package name of a library package should usually reflect the soname
N: of the included library. The package name can determined from the
N: librar...
@iSeth yup. answer is ok, right? my gut feeling says that he's not coming back. look at the OP's "homepage". It's a commercial software development company...
I don't see how people get these packages built in the first place. They must be hurting themselves putting the files together, rather than using debhelper scripts...
Okay, I'm relatively new to packaging, but it's very hard to screw up in a way that you do get a .deb yet SC will refuse to install.
I have decided to stop spamming and trolling on this site. I would like to offer my sincerest apologies to anybody who was inconvenienced by my ridiculous troll outbreaks, I regret them. It was extremely immature of me to do such childish actions and I have preyed and hope for forgiveness from th...
https://dl.dropbox.com/u/95818612/Screenshot%20from%202013-01-12%2002%3A44%3A06.png
following error is there in .txt file :
Major Version 7
Minor Version 0
Build Number 0002
Build Date Dec 13 2012
Build Time 17:54:43
OS Type 3
OS Major Version 3
OS Minor Version 2
OS Build Version 0
OS Patch Ver...
Inclusion of URI scheme
The basics of @GerogeEdison's idea from comment:
...create a URI scheme for launching the troubleshooter - allowing us
to give a "link" to the OP that runs a diagnostic test on their
machine.
Now, I propose we edit in the security requirements needed to impleme...
I have decided to stop spamming and trolling on this site. I would like to offer my sincerest apologies to anybody who was inconvenienced by my ridiculous troll outbreaks, I regret them. It was extremely immature of me to do such childish actions and I have preyed and hope for forgiveness from th...
I'd like some advice on using the site, but I just want to get a general sense of what people think; I might not have to post on meta for this. This question has answers that argue that MD5 is OK as a general purpose hashing algorithm because generating a file with the same hash as an arbitrary file whose contents you don't control is at least prohibitively difficult.
I wish to present a reason why MD5 actually is unacceptably insecure for signing software. I can give an example scenario featuring deb packages and Ubuntu. Is it OK for me to post this as an answer rather than a comment?
@MichaelHampton The mistaken assumption that informs into the conclusion that MD5 is acceptable for verifying the authenticity of software is the assumption that the attacker has no control over the real package. It's potentially considerably easier to create a specially crafted package that doesn't appear to contain malicious code because it does not contain malicious code than it is to push malicious code into an official package (though that is also possible).
2
If the attacker has substantial control over the official file (but cannot prevent people from inspecting it and discovering any malicious code), they can create the official package and the fake package at the same time, then distribute the fake package as the real one.
It seems to me that this attack would be an acceptable risk of all hashing algorithms were weak against it. But of all the hashes we currently use, only MD5 is weak against it.
@jrg Yes, most of the reasons we use hashes for verification have nothing to do with preventing malicious alterations. MD5 is still an important tool, for many purposes.
@jrg Yes, I am not saying we have a problem with the way officially packages are verified in Ubuntu. If I were to answer this it would be in part to explain why it is beneficial that Ubuntu's official archives are signed the way they are.
@jrg Maybe what I should actually do is find somewhere this attack has already been discussed (perhaps more rigorously than I am doing), and just comment on the question with a link to that related source.
@jrg I'll see what I can find. This should also give me the opportunity to correct myself if somehow I am mistaken and no such attack is (for some reason I cannot think of now) possible.
@EliahKagan these hashes are just for integrity checking. APT uses the lists with the hashes and tests them against the package cache in /var/cache/apt/ somewhere
so, you'll end up needing root access for this to hack. and having root access in the first place makes it quite unnecessary.
what I'm more worried about is that debsums (the tool) checks only via MD5 for quite a lot of packages. catching changed binaries on your system (after it has been hacked) could be hash-collision vulnerable.
@gertvdijk They're not just for safeguarding against unintended corruption though. When you download updates over a network, on most systems (at least systems that are not production servers) you will sometimes do so under conditions where a man-in-the-middle attack is not difficult to perpetrate.
As I said, I am not objecting to current practices in the way official Ubuntu packages are signed. (If I was, I'd be on Launchpad now, filing a bug.) But for packages that are signed and verified just with MD5, this should be exploitable without any access to the target machine.
@gertvdijk Sorry. If an MD5 hash is the only way that the authenticity of a package is verified, then it's exploitable. This is not technically a signature, but it serves the same purpose.
@JorgeCastro Hmm...I should probably try to find a source (unconnected to me) to back it up first, though, since this is apparently controversial...
@RobieBasak "I don't believe that the apt repository format is properly specified or documented anywhere." Obviously this is not true. You just have to look for it. Debian Wiki: RepositoryFormat — gertvdijk13 mins ago
GPG = authenticity check (is this from the person I think it is? side effect is integrity check due to the cryptographic nature). MD5 = integrity (has it changed or not?)
@EliahKagan not sure about APT repositories in specific, but I think the list of the archive is signed and that this list holds the hashes for each package.
@gertvdijk In that case, in effect it is the hashes that are signed, and they are used to verify the authenticity of the packages (as well as their integrity). So (if the hashes are just provided in MD5, which is not the case for Ubuntu's official packages), the problem I've outlined should be exploitable, right?
To put it another way: Your criticism does not appear to apply differently to the situation I've described and an alternative hypothetical situation where anyone can trivially craft a file to have the correct hash. Are you saying that verifying authenticity would be unaffected in this hypothetical scenario too?
Btw I think it was the right call for me to ask about this here instead of meta (because crypto discussion would have been OT there to, and then it either wouldn't have happened or would have happened and gotten in the way of meta working right).
@gertvdijk Yeah, I was thinking the same thing. I should read up on exactly what hashes like MD5 are and are not used for here, to be sure.
@Mechanicalsnail Yes, I agree that if the hash is secure, then it is not a problem. I am certainly not against the general practice of hashing files and signing the hashes to facilitate determining if the file you have is the same as the file you're supposed to have.
@gertvdijk Yes, besides that, the standard lets you have any of the supported hashes. You don't have to have any others. And the standard explicitly recommends that MD5 be one of them. I don't see an explicit recommendation that there be any other hash.
(Btw I meant to write "if all hashing algorithms" here, that has created a bit of confusion.)
@gertvdijk In the discussion there, the possibility of someone creating a fake package that has the same MD5 sum as a pre-existing real package is raised. I'm not sure if that's possible. The exploit I've been suggesting is the idea that even if you cannot do that, MD5's weakness can be exploited to cause people to run malicious code (if MD5 is the hash that gets used -- fortunately, in Ubuntu and recent Debian it is not, for official packages).
@gertvdijk As for SecureApt itself, (though I don't think your disputing this) the security improvements it documents are completely orthogonal to the scenario I've described. SecureApt is about making sure you have the right hashes. It doesn't address any problems of the right hashes being inadequate to ensure you have the right packages.
@gertvdijk Yeah, I don't think it's an issue for PPA's, but third party repositories. Also potentially for official repositories for unofficial Debian and Ubuntu derivatives if they have packages with just MD5 hashes.
The only change I'd recommend in APT is to warn the user when there's just an MD5 hash. (This could then be turned off by the user in APT's configuration, if they wanted.)
@gertvdijk Yeah, it seems like it must have. I won't post anything like an answer on AU before researching for other discussion of this. (OTOH if you happen to find previous discussion of this please let me know.)
@JorgeCastro before marking a Q dupe I've answered, could you please ping me first? I tend to do a search first if I have the feeling this might have been asked first. askubuntu.com/questions/240043/…
@JorgeCastro ok. well I think the title of the Q could be improved and it should be two different questions. one is like "I try to install this and get this error, what to do about it?" and the other is like "I'm packaging my software and I can't get the quality up"
I was re-tagging a question about developing applications when I noticed there was a dev tag. To me, both dev and development cover exactly the same thing.
Can we merge the tags or make dev a synonym of development?
It turns out that Bugs Bunny was impersonating someone when he ate the carrot.
Was he also impersonating a contemporary actor when he asked "What's up doc?" or is that a Bugs Bunny original?
It's the first time this happened. On regular terminal my login works great, even as root. My user name is always the same (Júnior) and login in never was a problem. I even tried setting the root passwd but nothing helps.
Any help?
Ubuntu 12.04.1 64bit
Use Lintian. That's the tool checking.
$ lintian -i packagename.deb
W: packagename: package-name-doesnt-match-sonames packagename
N:
N: The package name of a library package should usually reflect the soname
N: of the included library. The package name can determined from the
N: librar...
Inclusion of URI scheme
The basics of @GerogeEdison's idea from comment:
...create a URI scheme for launching the troubleshooter - allowing us
to give a "link" to the OP that runs a diagnostic test on their
machine.
Now, I propose we edit in the security requirements needed to impleme...
