TUF: Secure Software Updates Justin Cappos NYU Poly Computer Science and Engineering

Introduction You need to update software Software update systems are widely insecure [Bellissimo HotSec 06, Cappos CCS 08, Samuel login 09, Samuel CCS 10] You don’t want to think about security

Is there a practical risk? Trivial to become an official mirror [Cappos 08] Often can even target specific nodes [Samuel login 09] Example attack that is fixed in modern package managers due to our work Find existing exploit code for an old version of a package that isn't installed Change the package metadata so the old version of the package is installed with any update After the computer does an update, remotely exploit it A knowledgeable attacker can root any system on PlanetLab today!

But security is simple, right? Just use HTTPS Common errors in how certificates are handled Online data becomes single point of weakness Four CAs hacked since June!!!... and add signatures to the software updates Attackers can perform a replay attack... and add version numbers to the software updates Attackers can launch freeze attacks

But security is simple, right? (cont.) and add a quorum of keys signature system for the root of trust, add signing by different compartmentalized key types, use online keys only to provide freeze attack protection and bound their trust window, etc. [Thandy software updater for Tor] We still found 8 design or implementation flaws The median Windows machine has ~24 updaters [Secunia]

Why is it hard to secure software update systems? Cannot have everyone build their own Complicated to implement correctly There are lots of them in mature systems The median Windows machine has ~24 updaters [Secunia] There are lots of existing legacy software update systems Easy for an attacker to interpose on traffic GENI -> MITM Hard to protect from within the network Outgoing encrypted connection Cannot simply mandate one updater Updaters need to do application specific actions

Our approach for new systems

How do I integrate with TUF? If you don't have a software updater, we'll provide it You set up a 'repository' (or borrow ours) Generate keys Run a script to push a new release Your clients will automatically update (Well integrated into Python code, but works anywhere)

How do I integrate an existing updater with TUF? If you implemented a software updater Import TUF and use it to communicate / verify signatures Almost a drop in replacement for HTTPS or HTTP libs You set up a 'repository' (or borrow ours) Generate keys Run a script to push a new release Your clients will automatically update (Well integrated into Python code, but works anywhere)

Our approach for legacy systems Intercept traffic

Project roadmap Build an artifact early, add security mechanisms gradually Portability of the client library is key Many pairs of eyes uncover bugs more easily Work with projects inside of GENI Raven, PrimoGENI, PlanetLab, etc. Work with outside projects nmap, Firefox, etc. Focus on supporting the developer / repository interface(s) used by GENI devels

TUF Conclusion Software update systems are extremely vulnerable Building a secure software update system is very hard We have the solution! We will: Securing legacy systems by exploiting their insecurity Working with different communities to ensure quality