Achieving Consistency of Software Updates against Strong Attackers

Please always quote using this URN: urn:nbn:de:bvb:29-opus4-115166
  • Update systems that regularly distribute updates for installed software systems to end users are an essential part of modern security. Problems arise when the update system is misused and malicious updates are sent to a small set of end users only. Such situations can occur if the software supplier has been successfully attacked or is coerced by government agencies to distribute hand-crafted updates to a set of "suspects" containing promiscuous functionality like back-doors. In this paper, we define a set of general security requirements for update systems that encompass protection against malicious updates. We then introduce the design of an update system thatUpdate systems that regularly distribute updates for installed software systems to end users are an essential part of modern security. Problems arise when the update system is misused and malicious updates are sent to a small set of end users only. Such situations can occur if the software supplier has been successfully attacked or is coerced by government agencies to distribute hand-crafted updates to a set of "suspects" containing promiscuous functionality like back-doors. In this paper, we define a set of general security requirements for update systems that encompass protection against malicious updates. We then introduce the design of an update system that satisfies all requirements and present an implementation as an extension to the advanced package tool (APT) for the Debian operating system. We evaluate the strengths and weaknesses of the system and discuss its large-scale applicability with respect to security and performance overhead.show moreshow less

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar Statistics
Metadaten
Author:Lamya Abdullah, Sebastian Hahn, Felix Freiling
URN:urn:nbn:de:bvb:29-opus4-115166
DOI:https://doi.org/10.25593/issn.2191-5008/CS-2019-03
ISSN:2191-5008
Series (Volume number):Technical reports / Department Informatik (CS-2019-03)
Document Type:Report
Language:English
Year of Completion:2019
Embargo Date:2019/08/03
Publishing Institution:Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Release Date:2019/08/06
Tag:Malicious Update, Software Update, Consistency, Debian, Merkle Tree.
Institutes:Technische Fakultät / Department Informatik
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik
open_access (DINI-Set):open_access
Licence (German):Keine Creative Commons Lizenz - es gilt der Veröffentlichungsvertrag und das deutsche Urheberrecht