3

I ran the Update Manager gui. When I asked it to install all the packages, it prompted me to make sure I wanted to install. There were 3 dropdown lists of packages, one of which was named "NOT AUTHORISED". So I went back and tried installing packages one at a time. I selected one called "ca-certificates", because I thought if I did that one it might make the others install without warnings, and I thought I'd get a chance to say no. But when I ran it with just that one package it just went ahead and installed without prompting me. And I think that one might have been on the naughty list the first time round. So now I've got a possibly malicious update.

How do I know whether this was legit? And if it wasn't, how do I remove it?

I don't see anything suspicious in either the console output or /var/log/dpkg.log, but I can post either if that's helpful.

I'm using Linux Mint version 1.17.3 with dpkg version 1.17.5. I don't know the version of Update Manager (but it's a file called /usr/lib/linuxmint/mintUpdate/mintUpdate.py).

/var/log/dpkg.log:

2017-11-05 12:12:26 startup archives unpack 2017-11-05 12:12:32 upgrade ca-certificates:all 20160104ubuntu0.14.04.1 20170717~14.04.1 2017-11-05 12:12:32 status half-configured ca-certificates:all 20160104ubuntu0.14.04.1 2017-11-05 12:12:32 status unpacked ca-certificates:all 20160104ubuntu0.14.04.1 2017-11-05 12:12:32 status half-installed ca-certificates:all 20160104ubuntu0.14.04.1 2017-11-05 12:12:32 status triggers-pending man-db:amd64 2.6.7.1-1ubuntu1 2017-11-05 12:12:33 status half-installed ca-certificates:all 20160104ubuntu0.14.04.1 2017-11-05 12:12:33 status unpacked ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:33 status unpacked ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:33 trigproc man-db:amd64 2.6.7.1-1ubuntu1 2.6.7.1-1ubuntu1 2017-11-05 12:12:33 status half-configured man-db:amd64 2.6.7.1-1ubuntu1 2017-11-05 12:12:34 status installed man-db:amd64 2.6.7.1-1ubuntu1 2017-11-05 12:12:35 startup packages configure 2017-11-05 12:12:35 configure ca-certificates:all 20170717~14.04.1 <none> 2017-11-05 12:12:35 status unpacked ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:35 status half-configured ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:37 status installed ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:37 status triggers-pending ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:38 trigproc ca-certificates:all 20170717~14.04.1 <none> 2017-11-05 12:12:38 status half-configured ca-certificates:all 20170717~14.04.1 2017-11-05 12:12:43 status installed ca-certificates:all 20170717~14.04.1

console output from update:

(synaptic:12479): GLib-CRITICAL **: g_child_watch_add_full: assertion 'pid > 0' failed Preconfiguring packages ... (Reading database ... 180668 files and directories currently installed.) Preparing to unpack .../ca-certificates_20170717~14.04.1_all.deb ... Unpacking ca-certificates (20170717~14.04.1) over (20160104ubuntu0.14.04.1) ... Processing triggers for man-db (2.6.7.1-1ubuntu1) ... Setting up ca-certificates (20170717~14.04.1) ... Processing triggers for ca-certificates (20170717~14.04.1) ... Updating certificates in /etc/ssl/certs... WARNING: Skipping duplicate certificate Go_Daddy_Class_2_CA.pem WARNING: Skipping duplicate certificate Go_Daddy_Class_2_CA.pem 17 added, 42 removed; done. Running hooks in /etc/ca-certificates/update.d.... Adding debian:AC_RAIZ_FNMT-RCM.pem Adding debian:Amazon_Root_CA_1.pem Adding debian:Amazon_Root_CA_2.pem Adding debian:Amazon_Root_CA_3.pem Adding debian:Amazon_Root_CA_4.pem Adding debian:Certplus_Root_CA_G1.pem Adding debian:Certplus_Root_CA_G2.pem Adding debian:Certum_Trusted_Network_CA_2.pem Adding debian:Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015.pem Adding debian:Hellenic_Academic_and_Research_Institutions_RootCA_2015.pem Adding debian:ISRG_Root_X1.pem Adding debian:LuxTrust_Global_Root_2.pem Adding debian:OpenTrust_Root_CA_G1.pem Adding debian:OpenTrust_Root_CA_G2.pem Adding debian:OpenTrust_Root_CA_G3.pem Adding debian:SZAFIR_ROOT_CA2.pem Adding debian:TUBITAK_Kamu_SM_SSL_Kok_Sertifikasi_-_Surum_1.pem Removing debian:AC_Raíz_Certicámara_S.A..pem Removing debian:ApplicationCA_-_Japanese_Government.pem Removing debian:Buypass_Class_2_CA_1.pem Removing debian:CA_Disig.pem Removing debian:ComSign_CA.pem Removing debian:EBG_Elektronik_Sertifika_Hizmet_Sağlayıcısı.pem Removing debian:Equifax_Secure_CA.pem Removing debian:Equifax_Secure_Global_eBusiness_CA.pem Removing debian:Equifax_Secure_eBusiness_CA_1.pem Removing debian:IGC_A.pem Removing debian:Juur-SK.pem Removing debian:Microsec_e-Szigno_Root_CA.pem Removing debian:NetLock_Business_=Class_B=_Root.pem Removing debian:NetLock_Express_=Class_C=_Root.pem Removing debian:NetLock_Notary_=Class_A=_Root.pem Removing debian:NetLock_Qualified_=Class_QA=_Root.pem Removing debian:RSA_Security_2048_v3.pem Removing debian:Root_CA_Generalitat_Valenciana.pem Removing debian:S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN.pem Removing debian:Sonera_Class_1_Root_CA.pem Removing debian:Staat_der_Nederlanden_Root_CA.pem Removing debian:StartCom_Certification_Authority.pem Removing debian:StartCom_Certification_Authority_2.pem Removing debian:StartCom_Certification_Authority_G2.pem Removing debian:SwissSign_Platinum_CA_-_G2.pem Removing debian:TC_TrustCenter_Class_3_CA_II.pem Removing debian:UTN_USERFirst_Email_Root_CA.pem Removing debian:Verisign_Class_1_Public_Primary_Certification_Authority.pem Removing debian:Verisign_Class_1_Public_Primary_Certification_Authority_-_G2.pem Removing debian:Verisign_Class_1_Public_Primary_Certification_Authority_-_G3.pem Removing debian:Verisign_Class_2_Public_Primary_Certification_Authority_-_G2.pem Removing debian:Verisign_Class_2_Public_Primary_Certification_Authority_-_G3.pem Removing debian:Verisign_Class_3_Public_Primary_Certification_Authority.pem Removing debian:Verisign_Class_3_Public_Primary_Certification_Authority_-_G2.pem Removing debian:Verisign_Class_3_Public_Primary_Certification_Authority_2.pem Removing debian:WellsSecure_Public_Root_Certificate_Authority.pem Removing debian:WoSign.pem Removing debian:WoSign_China.pem Removing debian:CA_WoSign_ECC_Root.pem Removing debian:Certification_Authority_of_WoSign_G2.pem Removing debian:S-TRUST_Universal_Root_CA.pem Removing debian:TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sağlayıcısı_H6.pem done. done.
Improve this question
7
  • Please add the Operating System and version to your question. Commented Nov 6, 2017 at 18:29
  • Sorry, I've now said it's Mint but I don't know how to check the exact version. (But I think it's got a 17 in it.) Commented Nov 6, 2017 at 18:56
  • 2
    I didn’t vote to close it, because I’m not familiar with Mint, but I would think that it’d be important to give the name of the package that you installed and are concerned about. If you don’t know what it is, the installer logs may be useful and possibly a reminder to you . Commented Nov 11, 2017 at 0:05
  • 2
    We really do eed to know the name of the package you installed. Ideally along with the contents of /etc/apt/sources.list and any files in the directory /etc/apt/sources.d/ Commented Nov 18, 2017 at 19:55
  • 1
    @roaima Done. dpkg.log says the package was called ca-certificates, so I added that to the question. Commented Nov 18, 2017 at 20:09

3 Answers 3

Reset to default
3
+25

If the package was malicious, it already had the chance to run code with root privileges, including erasing logs and tracks of what it did, so you might just need to consider the server compromised no matter if you find evidence of that or not, depending on your policies.

If that's not the case, and if you have only the official repositories configured on /etc/apt/sources.list and /etc/apt/sources.d (as commented by @roaima), you can assume nothing went wrong as these packages are signed and their signatures verified before you install them.

Still, if you want to double check something now, you can verify the hashes listed here against the file you have on /var/cache/apt/archives/ca-certificates_20170717~14.04.1_all.deb. For that run sha256sum /var/cache/apt/archives/ca-certificates_20170717~14.04.1_all.deb and compare the string, character by character against what you see on the ubuntu page. If they match exactly you can say that was the file you installed and that it came from Ubuntu (Mint does not provide their own certificates package, as you can confirm by searching here).

For your convenience, the hash I got from that page is 3b464250889051e2da74d123d9d440572158d87583090c75be9eab7c2e330f14.

Again, if the package was malicious, it's too late, if not, leave it there or remove as usual with apt-get remove ca-certificates.

If you can't find that file, maybe I got the wrong version from your logs or the apt cache has already been cleaned on your machine, which would make it really difficult to verify what you had downloaded.

Improve this answer
3
  • How do we know that /etc/apt/sources.list and /etc/apt/sources.d have always been clean ? The software can revert those and touch them ... it can also re-install the official ca-certificates package. Then again, I have never seen apt report "NOT AUTHORISED" ... not sure what apt means by that ... Commented Nov 20, 2017 at 13:04
  • Sure! That's one reason it's too late if a malicious package has already been installed. His not authorized message I suspect may not have come from apt, but from the polkit for the update manager, but I can't be sure. Commented Nov 20, 2017 at 13:19
  • Yes, the NOT AUTHORIZED part was in the UI. Commented Nov 22, 2017 at 20:10
1

Check with apt-cache policy ca-certificates where the package from.

Run sudo apt-get update && sudo apt-get clean && sudo apt-get install --reinstall ca-certificates Any warnings again?

It is always a good idea not to install or update packages, when this warning from apt-key poppuped. The most time they are harmless.

The seal works with a chain of cryptographical hashes and a signature. The signed file is the Release file, provided by the Debian mirrors. It contains a list of the Packages files (including their compressed forms, Packages.gz and Packages.xz, and the incremental versions), along with their MD5, SHA1 and SHA256 hashes, which ensures that the files haven't been tampered with. These Packages files contain a list of the Debian packages available on the mirror, along with their hashes, which ensures in turn that the contents of the packages themselves haven't been altered either.

apt-key is used to manage the list of keys used by apt to authenticate packages. Packages which have been authenticated using these keys will be considered trusted.

Please read more in Manpage. man apt-key

Improve this answer
0

You should be able to walk back through your configuration to verify that this package is/was safe.

First, locate ca-certificates*.deb in your apt-cache at /var/cache/apt/archive/ and run

md5sum /var/cache/apt/archive/ca-certificates*.deb

According to the manpage for debsums you should find a list of files/md5 hashes located at /var/lib/dpkg/info/*.md5sum. Take a backup of this file. You can then go and manually obtain the deb file in question from your repository and verify the GPG against the package you download, or configure security for your repository and reinstall the package. Once the package is reinstalled (be sure you use the exact same version) you can use

md5sum -c /path.to.backup.md5

(or just use debsums)

Which will list and validate every file from the Debian package. Assuming that you find no differences, you can be sure that every file in the old Debian package can be trusted as it was validated against a known-good, newer deb package now installed in /var/cache/apt/archives.

Be sure not to run apt-clean cache, otherwise you will wipe out the deb package and be unable to tell if a malicious script was run.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.