<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"\@等线";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:DengXian;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:DengXian;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:DengXian;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="ZH-CN" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Hello, this topic is about the Loophole of packages managers(apt and apt-get).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">link: https://www.theregister.co.uk/2019/01/22/debian_package_manager_flaws/<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">System’s package manager is a very important part of CM. And that is also very easy to be attacked. Normally, Apt and Apt-get use HTTP when downloading packages. We have studied that the HTTP is not secure enough.
a man-in-the-middle (MITM) miscreant can intercept the victim's network connection and even change the URL for fetch packages. So, the attacker can use the script run as root on that machine or install some unwanted software in that machine.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">This could be solved by install SSL support for apt-get<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">apt-get install apt-transport-https<o:p></o:p></span></p>
</div>
</body>
</html>