A Look In the Mirror: Attacks on Package Managers

This work studies the security of ten popular package man-agers. These package managers use different security mech-anisms that provide varying levels of usability and resilience to attack. We find that, despite their existing security mech-anisms, all of these package managers have vulnerabilities that can be exploited by a man-in-the-middle or a malicious mirror. While all current package managers suffer from vul-nerabilities, their security is also positively or negatively im-pacted by the distribution’s security practices. Weaknesses in package managers are more easily exploited when distri-butions use third-party mirrors as official mirrors. We were successful in using false credentials to obtain an official mir-ror on all five of the distributions we attempted. We also found that some security mechanisms that control where a client obtains metadata and packages from may actually de-crease security. We analyze current package managers to show that by exploiting vulnerabilities, an attacker with a mirror can compromise or crash hundreds to thousands of clients weekly. The problems we disclose are now being cor-rected by many different package manager maintainers