Achieving Consistency of Software Updates against Strong Attackers

Update systems regularly distribute updates for installed software to end users. Problems arise when the update system is misused and malicious updates are sent to a small set of users only. Such situations can occur if the software supplier has been successfully attacked or is coerced by government agencies to distribute hand-crafted updates containing promiscuous functionality like backdoors. In this paper, we define a set of general security requirements for update systems that encompass protection against malicious updates. We then introduce the design of an update system that satisfies the requirements and present an implementation as an extension to the advanced package tool (APT) for the Debian OS. We evaluate the strengths and weaknesses of the system and discuss its large-scale applicability with respect to security and performance overhead.