mjhjmtu

To install Sublime, it wants me to add a GPG key and a sources.list entry so that apt-get can find it. A couple of other programs have asked for the same. Why isn't it a security risk to add more domains to sources.list?

That is: suppose package A is supposed to come from host B. I add host C in a new sources.list. Host C gets subverted, an attacker hosts a malicious package and calls it A. Next time I try to update A, apt-get checks the sources and decides to download it from C instead of B, and I get the malicious version.

The answer: It is.

It's always a risk in introducing additional sources for packages, irregardless of what distro/OS you're using. The use of GPG keys, in theory, helps to mitigate the risks, since in theory, someone would have to:

1. get access to the server where the binaries are being served from


2. get access to the private GPG key that was used to sign the binaries


3. package new versions of compromised binaries, sign them, and then put on server

In this scenario, someone would have to get through multiple layers to do something nefarious. As is always the case with security. It's all about layers! In order for a community to thrive and stand on the shoulders of others, you have to be willing to forgo isolation, and put your trust in others.

And keep in mind, the servers that serve files have been compromised before to varying degrees, but it's typically caught right away and can be addressed in short order.

Previous Attacks

• Fedora Web Site Hacked, But the Servers Undamaged !


• Malicious Software Packages Found On Arch Linux User Repository


• Malware Found in Arch Linux AUR Package Repository

Tips

• Always scrutinize URLs and make sure they are legit


• Don't add repos unless you absolutely need a package from them


• Periodically vet your sources.list


• Periodically vet the GPG keys used by sites to sign packages


• Be diligent about staying up to date on packages