Full Disclosure mailing list archives
Skype Debian package: allows complete machine takeover for Microsoft
From: "Enrico Weigelt, metux IT consult" <info () metux net>
Date: Tue, 25 Sep 2018 19:04:18 +0200
Level: Critical Description: The Skype debian packege for Skype (even when not installed via their offical repo) automatically installs apt configuration that adds Microsoft's apt repo to the system's package sources. That way, Microsoft (or anybody holding their repo's private key) can easily inject malicious packages via regular update and replace distro packages w/ their own manipulated ones. Suggested vendor solution: Remove all apt configuration stuff from the .deb. Operator's workaround: a) remove Skype's apt config (sources.list entry as well as the Microsoft apt key) immediately after installation b) unpack and repackage it manually (w/o that apt config) before installation on production machines c) use apt pinning to restrict the Microsoft repo to only the package 'skypeforlinux' c) only install it in a strictly confined container --mtx -- Enrico Weigelt, metux IT consult Free software and Linux embedded engineering info () metux net -- +49-151-27565287 _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- Skype Debian package: allows complete machine takeover for Microsoft Enrico Weigelt, metux IT consult (Sep 28)