Security improvements in T EX Live Norbert Preining T EX Live Team Tug 2016, Toronto
T EX Live security – 2 Overview ▶ status up to (and including) 2015 ▶ possible attack vectors ▶ integrity and authenticity ▶ verification architecture ▶ (non-)distributing GnuGP (and alternatives) ▶ Problems ▶ user experience ▶ key management
T EX Live security – 3 Status up to 2015 name 12many ... containersize 2100 containermd5 ..... doccontainersize 375404 doccontainermd5 .... ... only used to restart an interrupted installation not for tlmgr update nor for normal installation! ▶ container checksum (md5) is available in the tlpdb ▶ but …
T EX Live security – 3 Status up to 2015 name 12many ... containersize 2100 containermd5 ..... doccontainersize 375404 doccontainermd5 .... ... not for tlmgr update nor for normal installation! ▶ container checksum (md5) is available in the tlpdb ▶ but … only used to restart an interrupted installation
T EX Live security – 3 Status up to 2015 name 12many ... containersize 2100 containermd5 ..... doccontainersize 375404 doccontainermd5 .... ... not for tlmgr update nor for normal installation! ▶ container checksum (md5) is available in the tlpdb ▶ but … only used to restart an interrupted installation
T EX Live security – 4 Do we need better security?
▶ exchange pdftex binary with one shipping a crypto-virus ▶ enjoy … T EX Live security – 5 Possible attack vector I Since no checks are done, this is easily possible! Verification of checksums (md5) In tlcritical for a few months before TL2016 was released, but not pushed out to 2015. ▶ compromise one ctan mirror
▶ enjoy … T EX Live security – 5 Possible attack vector I Since no checks are done, this is easily possible! Verification of checksums (md5) In tlcritical for a few months before TL2016 was released, but not pushed out to 2015. ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus
T EX Live security – 5 Possible attack vector I Since no checks are done, this is easily possible! Verification of checksums (md5) In tlcritical for a few months before TL2016 was released, but not pushed out to 2015. ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ enjoy …
T EX Live security – 5 Possible attack vector I Since no checks are done, this is easily possible! Verification of checksums (md5) In tlcritical for a few months before TL2016 was released, but not pushed out to 2015. ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ enjoy …
T EX Live security – 5 Possible attack vector I Since no checks are done, this is easily possible! Verification of checksums (md5) In tlcritical for a few months before TL2016 was released, but not pushed out to 2015. ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ enjoy …
▶ exchange pdftex binary with one shipping a crypto-virus ▶ adjust the container that the MD5 sum does not change ▶ enjoy … T EX Live security – 6 Possible attack vectors II (possible!) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror
▶ adjust the container that the MD5 sum does not change ▶ enjoy … T EX Live security – 6 Possible attack vectors II (possible!) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus
▶ enjoy … T EX Live security – 6 Possible attack vectors II (possible!) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ adjust the container that the MD5 sum does not change
T EX Live security – 6 Possible attack vectors II (possible!) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ adjust the container that the MD5 sum does not change ▶ enjoy …
T EX Live security – 6 Possible attack vectors II (possible!) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror ▶ exchange pdftex binary with one shipping a crypto-virus ▶ adjust the container that the MD5 sum does not change ▶ enjoy …
▶ exchange pdftex binary as before ▶ adjust the checksum in the tlpdb file ▶ enjoy … T EX Live security – 7 Possible attack vector III connections and many users) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror (or setup one yourself, get good
▶ adjust the checksum in the tlpdb file ▶ enjoy … T EX Live security – 7 Possible attack vector III connections and many users) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror (or setup one yourself, get good ▶ exchange pdftex binary as before
▶ enjoy … T EX Live security – 7 Possible attack vector III connections and many users) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror (or setup one yourself, get good ▶ exchange pdftex binary as before ▶ adjust the checksum in the tlpdb file
T EX Live security – 7 Possible attack vector III connections and many users) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror (or setup one yourself, get good ▶ exchange pdftex binary as before ▶ adjust the checksum in the tlpdb file ▶ enjoy …
T EX Live security – 7 Possible attack vector III connections and many users) No counter measures up to T EX Live 2015! ▶ compromise one ctan mirror (or setup one yourself, get good ▶ exchange pdftex binary as before ▶ adjust the checksum in the tlpdb file ▶ enjoy …
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 8 Integrity and authenticity Integrity Need to check the integrity of the downloaded packages – prevent tampering. md5 is not strong, can be tampered – switch to sha512 Authenticity Verify that the packages are actually the ones from us (T EX Live Team). Cryptographic signatures
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T EX Live security – 9 Verification architecture – overview tlmgr downloads remote texlive.tlpdb tlmgr verifies authenticity of the tlpdb tlmgr checks integrity of containers tlmgr installs package new partially new
T ... ... r2mB9xEnR4o2SRBDNI... iQEVAwUBVyAV9kzhh3... —–BEGIN PGP SIGNATURE—– texlive.tlpdb.sha512.asc <128 hex digits> texlive.tlpdb texlive.tlpdb.sha512 containerchecksum ... EX Live security – 10 name 2up ... containerchecksum ... name 12many ... name 00texlive.config texlive.tlpdb Verification of authenticity —–END PGP SIGNATURE—–
Recommend
More recommend
