The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026

24 days ago by modem_down to c/cybersecurity

In 2025, I found and disclosed a bunch of vulnerabilities in GPG, the most used PGP implementation, and held a talk at 39c3 about it. **S...

Crossposted from https://futurology.today/post/12245375

ChunderBustickles 6 points 24 days ago

Please bear with my dumb ass. if validating a certificate / signature is risking an RCE, does that essentially make this a planet-wide potential supply chain hack (wherever gnupg is used, at least?)

save

path: 0 26024337, hotness: undefined, score: 6, children: 1

ChunderBustickles 1 point 24 days ago

Follow up: I suppose the verification could be done in a container?

save

path: 0 26024337 26024345, hotness: undefined, score: 1, children: 0

modem_down 5 points 24 days ago

I'm probably having a brainfart (watched the video during insomnia), but re: the section 12m 10s into the video, can someone please clarify why "the instructions are dangerously wrong"?

I understand it relates to the earlier demo in which those instructions gave the illusion of "verifying" an ISO that was in fact malicious. But:

why did those instructions fail to genuinely verify the ISO?
what would the correct instructions have been?

save

path: 0 26021153, hotness: undefined, score: 5, children: 8

tribut 4 points 24 days ago

Cleatext signing (having the signature and data in the same file) is broken in many ways. It is possible to put unsigned data at the top of the file in a way that sha256sum will use it. Watch the 39c3 GPG talk if your interested in the gory details.

The solution is to use detached signatures (checksum.txt and checksum.txt.gpg to verify that). This makes sure that all of checksum.txt is actually covered by the signature.

save

path: 0 26021153 26022308, hotness: undefined, score: 4, children: 6

waltersf 0 points 24 days ago

cc @modem_down@thebrainbin.org
or, binary signatures, [which I prefer: compressionable], as textfiles are insecure formats.

I prefer a headed, mided, and tailed verification, similar to MPEG keyframing, for constant stream verification.

save

path: 0 26021153 26022308 26022568, hotness: undefined, score: 0, children: 5

lurch 1 point 24 days ago

idk about the specific formats, but i don't think you can say that in general. what are those two formats and why does it make a difference in this case?

save

path: 0 26021153 26022308 26022568 26025947, hotness: undefined, score: 1, children: 4

waltersf 1 point 24 days ago

what binary signatures offer:

smaller sizes
ability to compression
the actually signature
confidentiality

File headers^def^, miding^def^, tailing^def^.
why textfiles are insecure

i don’t think you can say that in general

What is your academic literacy please?

Cite your papers please.

or gen z:
Drop your academic flex.
What grade you at?
papers pls🙏

orly

save

path: 0 26021153 26022308 26022568 26025947 26026378, hotness: undefined, score: 1, children: 3

waltersf 1 point 24 days ago

Lexi Groves is quoting Fedora’s own mailing list irt social engineering. Both Fedora’s instructions are wrong, and the method to properly verify ISO, that to be brutal, should have been outdated decades ago, is “dangerously wrong.” It's a nice gibe.

save

path: 0 26021153 26022493, hotness: undefined, score: 1, children: 0

GalacticGrapefruit 4 points 24 days ago

Wearing a dog collar for a highly technical live presentation of a critical security feature requires a degree of personal confidence I can only admire.

save

path: 0 26026561, hotness: undefined, score: 4, children: 0

Community Rules

Community Rules