Achieving Consistency of Software Updates against Strong Attackers
Please always quote using this URN: urn:nbn:de:bvb:29-opus4-115166
- Update systems that regularly distribute updates for installed
software systems to end users are an essential part of modern
security. Problems arise when the update system is misused and
malicious updates are sent to a small set of end users
only. Such situations can occur if the software supplier has been
successfully attacked or is coerced by government agencies to
distribute hand-crafted updates to a set of "suspects" containing
promiscuous functionality like back-doors. In this paper, we define a
set of general security requirements for update systems that
encompass protection against malicious updates. We then introduce
the design of an update system thatUpdate systems that regularly distribute updates for installed
software systems to end users are an essential part of modern
security. Problems arise when the update system is misused and
malicious updates are sent to a small set of end users
only. Such situations can occur if the software supplier has been
successfully attacked or is coerced by government agencies to
distribute hand-crafted updates to a set of "suspects" containing
promiscuous functionality like back-doors. In this paper, we define a
set of general security requirements for update systems that
encompass protection against malicious updates. We then introduce
the design of an update system that satisfies all requirements and
present an implementation as an extension to the advanced
package tool (APT) for the Debian operating system. We
evaluate the strengths and weaknesses of the system and discuss its
large-scale applicability with respect to security and performance
overhead.…
Author: | Lamya Abdullah, Sebastian Hahn, Felix Freiling |
---|---|
Persistent identifiers - URN: | urn:nbn:de:bvb:29-opus4-115166 |
Persistent identifiers - DOI: | https://doi.org/10.25593/issn.2191-5008/CS-2019-03 |
ISSN: | 2191-5008 |
Series (Volume number): | Technical reports / Department Informatik (CS-2019-03) |
Document Type: | Report |
Language: | English |
Year of publication: | 2019 |
Date of online publication (Embargo Date): | 2019/08/03 |
Publishing Institution: | Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU) |
Release Date: | 2019/08/06 |
Tag: | Malicious Update, Software Update, Consistency, Debian, Merkle Tree. |
Institutes: | Technische Fakultät / Department Informatik |
Dewey Decimal Classification: | 0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik |
open_access (DINI-Set): | open_access |
Licence (German): |