Vulnerability of OpenSource Software download mechanisms: VLC

[Steve Kinney]

On 07/03/2017 08:36 AM, Fabio Pietrosanti - Lists wrote:
> Hello,
> 
> as we move to improve the status of encryption of the internet and at
> all levels internet companies diffuse the uses of HTTPS encryption and
> integrity protection methods there are still a variety of massively
> diffused pieces of software that can be subject to malware injection
> trough MITM techniques.
> 
> VLC, Videolan Client, the most used opensource video player have their
> entire website in HTTP, their download page in HTTP and the mirror
> providing the downloading in HTTP.
> 
> However they are refusing to implement HTTPS arguing that because their
> .exe are digitally signed with authenticode they are safe 
> https://trac.videolan.org/vlc/ticket/18472 .

From the post @ videolan.org:  "VLC trust and diffusion has been also
being exploited by CIA."  And:  "So VLC is responsible to let attacks
inject malware bundled with the software package, because it's only VLC
project maintainer responsibility to use HTTPS as the only method to
prevent a third party attacker to hijack VLC website content and files."

Against hostile State actors, HTTPS only provides a false sense of
security.  If your threat model includes the CIA, reliance on HTTPS is a
fundamental error in the "game over" category.

The HTTPS procotol implemented in web browsers relies on digital
signatures by 3rd parties called Certificate Authorities to
transparently verify that the key used for the "secure" connection
belongs to the website in question.  Any actor who owns a copy of any
one of the numerous Certificate Authorities' signing keys can sign an
SSL certificate in any website's name, and it will be accepted as
authentic by any web browser.

The HTTPS trust model is broken at the foundation.  This does not make
HTTPS useless; smaller criminal organizations and hostile individuals do
not normally have access to Certificate Authority signing keys, and so
can not effectively do man in the middle attacks against HTTPS
connections.  In most cases implementing HTTPS is worth doing - as long
as it is understood that this provides no protection against large, well
funded adversaries.

> Please help me explain them how digital attacks works, or please someone
> make a MITM video-screencast to show them how urgent and important is to
> upgrade all of the connections to HTTPS.

See above:  It seems likely that the people at videolan.org have a basic
understanding of how digital attacks work, more so than someone who
believes that HTTPS can interfere with attacks by State actors.

If it is urgent and important for videolan.org to use HTTPS, preventing
MITM attacks by State actors (or other criminal gangs with substantial
resources) is not the reason.

A more effective way to protect against malware injection via
substitution of executables in transit, is for the distributor to
digitally sign the installers themselves.  This method is not 100%
reliable - nothing is - but at present it's the best method we have.
And note that it is already implemented in the Linux software repositories.




-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 490 bytes
Desc: OpenPGP digital signature
URL: <http://lists.cpunks.org/pipermail/cypherpunks/attachments/20170703/9939ff89/attachment.sig>