0

This has concerned me for awhile. I had downloaded and installed many different operating systems and have always verified the integrity and authenticity of the ISO files by checking the hashes and comparing the digital signature to it.

If I had an infected machine or an infected web browser what are the chances of my ISO file being compromised while it's downloading or even after it has been downloaded? Also what if I downloaded the file from a malicious or unofficial source but everything matched (checksums etc.)? If everything matches, does this mean that my download is the way it was meant to be?

schroeder
  • 125,553
  • 55
  • 289
  • 326

1 Answers1

3

While I cannot give you an exact possibility, I can answer your other questions.

There are three main ways to corrupt a download:

  1. a malicious server,
  2. insecure transport & a malicious carrier,
  3. a compromised host.

While checksum and hash checking can help against (2) and maybe (depending on how the signature is distributed and you establish trust in the signature) (1), you can not mitigate (3).

Supposing a machine is compromised, it is a lost cause to do anything, really, with it, except a nuke from orbit.

  • malware could alter the download when written to disk,
  • when transferred to another Medium or
  • download the image from where you are not trying to load it and modify the tools you use to validate the correctness of the file so that all your checks come back positive while they actually are not.

As you see: when you cannot trust the machine you are workin with, anything might happen.

Tobi Nary
  • 14,352
  • 8
  • 44
  • 58
  • Would the attacks that you mentioned be easy to perform? Especially when you talked about the modification of the hash checking tools. –  Nov 15 '17 at 06:31
  • 4
    As usual, that depends on the threat model. Easy for _whom_? – Tobi Nary Nov 15 '17 at 06:33