Arbitrary package attacks for pip with TUF

In an arbitrary package attack, we show pip packages with dubious origins. These are malicious packages which an attacker has overwritten over benign packages in order to deceive users into installing them.

First, we set up the virtual environment (for cleanroom testing) and install pip-with-TUF:

$ cd /tmp
$ curl -O https://pypi.python.org/packages/source/v/virtualenv/virtualenv-1.10.1.tar.gz
$ tar xvfz virtualenv-1.10.1.tar.gz
$ python virtualenv-1.10.1/virtualenv.py --no-site-packages arbitrary-package-with-tuf
$ source arbitrary-package-with-tuf/bin/activate
$ sudo apt-get install python-dev libgmp-dev
$ pip install --upgrade https://github.com/theupdateframework/tuf/archive/v0.7.5.zip
$ pip install --upgrade https://github.com/theupdateframework/pip/archive/trishank.poly.edu.zip

First, suppose the attackers on PyPI tamper with the FooBar 0.1 package, and update the FooBar simple index with the correct hash of the tampered package. However, since they do not have the (presumed) offline "targets" keys, they do not tamper with the TUF metadata for FooBar:

# POINT TO REPOSITORY WITH INTACT TUF METADATA.
$ curl http://mirror1.poly.edu/test-pip/arbitrary-package/repository.current/tuf.interposition.json -o arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/tuf.interposition.json

$ pip install FooBar
Downloading/unpacking FooBar
Cleaning up...
Exception:
Traceback (most recent call last):
  File "/tmp/arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/basecommand.py", line 134, in main
    status = self.run(options, args)
  File "/tmp/arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/commands/install.py", line 270, in run
    sys.exit('TUF stopped the update due to an error:\n'+str(error))
SystemExit: TUF stopped the update due to an error:
No working mirror was found:
  mirror1.poly.edu: Observed hash (8f387cb0c77f560bfe140ed10edd989b93eededdafb4dec90bd2ce92e9f3587d) != expected hash (35b9732ec8c575104e5b9d34bf59323707addc2d25322220e0a9ae8bba5f054c)

Storing complete log in /home/trishank/.pip/pip.log

Now, suppose the attackers on PyPI tamper with the FooBar 0.1 package, and update the FooBar simple index with the correct hash of the tampered package. Furthermore, they do have the online (for automation purposes) "timestamp" and "release" keys, and a new release is timestamped. Even though they do not have the (presumed) offline "targets" keys, they do tamper anyway with the "targets" TUF metadata for FooBar:

# POINT TO UPDATED REPOSITORY WITH TAMPERED TUF METADATA.
$ curl http://mirror1.poly.edu/test-pip/arbitrary-package/repository.next/tuf.interposition.json -o arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/tuf.interposition.json

$ pip install FooBar
Downloading/unpacking FooBar
Cleaning up...
Exception:
Traceback (most recent call last):
  File "/tmp/arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/basecommand.py", line 134, in main
    status = self.run(options, args)
  File "/tmp/arbitrary-package-with-tuf/local/lib/python2.7/site-packages/pip/commands/install.py", line 270, in run
    sys.exit('TUF stopped the update due to an error:\n'+str(error))
SystemExit: TUF stopped the update due to an error:
No working mirror was found:
  mirror1.poly.edu: targets metadata has bad signature!

Storing complete log in /home/trishank/.pip/pip.log

Developers must take care to ensure that their target-signing keys are properly secured. Ideally, target-signing keys should be stored offline and isolated from each other, and a sufficiently high number of these keys should be required as a threshold for signing targets metadata. Compare this with the situation where pip or PyPI works without TUF.