I found this! I posted a semi-click-bait-ey tweet about it here [0], I think it’s important for people know how easy these bugs are to find now. It’s becoming borderline irresponsible not to audit your internet-facing code with modern AI tools.
How would an attacker inject a redirect into an apt package download?
mikepurvis 1 hours ago [-]
MITM on the network, I guess like DNS takeover or the like.
So you pass through the upstream headers but then simulate a failure/resume and supply different contents for the resumed download.
SoftTalker 55 minutes ago [-]
So apt doesn't verify signatures on what is actually downloaded?
dinosaurdynasty 46 minutes ago [-]
> Improper file handling when resuming an HTTP download
allows a man-in-the-middle attacker to replace a package after
verification
from the OP
APT can use HTTPS, but often doesn't, making a MITM attack easier (also the idea for a long time has been signatures are enough, and/or TLS certs used to be a lot harder to get, but at this point you should really be using both).
SoftTalker 24 minutes ago [-]
Still doesn't make sense to me. So package A is downloaded, signature verified, then package B is downloaded, but somehow the package A file is replaced? Is it something like that?
jxie2004 60 minutes ago [-]
[flagged]
1 hours ago [-]
8organicbits 2 hours ago [-]
I feel like they should release manual update instructions since the update mechanism is vulnerable. Although I see my systems already updated via unattended upgrades.
[0] https://x.com/just1cz/status/2118009777922228361
So you pass through the upstream headers but then simulate a failure/resume and supply different contents for the resumed download.
from the OP
APT can use HTTPS, but often doesn't, making a MITM attack easier (also the idea for a long time has been signatures are enough, and/or TLS certs used to be a lot harder to get, but at this point you should really be using both).
edit: On lobste.rs I see a recommendation for `apt download`: https://lobste.rs/s/h7bvma/man_middle_arbitrary_code_executi...