Slashdot Mirror

← Back to Stories (view on slashdot.org)

Package Managers As Achilles Heel

Posted by timothy on from the dip-your-computer-in-the-styx dept.

An anonymous reader writes "Researchers from the University of Arizona have released a study that takes a look at the security of ten popular package managers. They were able to show all ten were vulnerable to attacks from a mirror or man-in-the-middle that allow an attacker to (along with other things) crash the system or obtain root access. Furthermore, the researchers created a fictitious administrator and company name and were able to lease a server and get it listed as an official mirror for all the distributions they tried (Ubuntu, Debian, Fedora, CentOS, and OpenSUSE). This raised the question: What keeps you up at night, the thought of attacks on your package manager or previously discussed and patched vulnerability in DNS?" justin samuel (one of the Arizona researchers) also points out a synopsis on CERT's blog.

9 of 263 comments (clear)

  1. Answer by Anonymous Coward · · Score: 5, Funny

    What keeps you up at night, the thought of attacks on your package?

    Yes.

    1. Re:Answer by adminstring · · Score: 5, Funny

      You must have kittens...

      --
      My truck is like a series of tubes.
    2. Re:Answer by jd · · Score: 5, Funny

      The correct modern spelling is kitteh, and you apparently solve that problem by supplying them with elebenty cheezburgers.

      --
      It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
  2. I better update now by Krneki · · Score: 5, Funny

    ... oh wait!

    --
    Love many, trust a few, do harm to none.
  3. Re:Compile from source yourself! by 77Punker · · Score: 5, Funny

    You've got him all wrong. He's a twelve year old with a PhD that reads and understand every line of code before he allows it to execute on his own hardware.

  4. Comment removed by account_deleted · · Score: 5, Funny

    Comment removed based on user account deletion

  5. Slackware by FPCat · · Score: 5, Funny

    Good thing I'm running Slackware!

  6. Re:Compile from source yourself! by Anonymous Coward · · Score: 5, Funny

    Noob, he doesn't need source. I'm a 13 year old PhD and I assure you even I can read binaries.

  7. Re:Compile from source yourself! by shadwstalkr · · Score: 5, Funny

    Also, you have to trust your compiler, which you *had* to get from someone else.

    Nah, I wrote my own compiler directly in machine code. I didn't trust my keyboard manufacturer either, so I tapped out Morse code on a homemade key. I made the BIOS out of coconuts, but that was just because that douchebag Gilligan said it couldn't be done.

    -Roy Hinkley