Debian & Ubuntu APT MitM Flaw: Detecting and Remediating Malicious Package Substitution on Retried Downloads

---
title: APT or DPKG Spawning Suspicious Child Processes
description: Detects apt/apt-get/dpkg spawning shells, network tools, or script interpreters — consistent with a trojaned maintainer script from a substituted package executing as root during installation.
references:
  - https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html
author: Security Arsenal
date: 2026/11/05
status: experimental
tags:
  - attack.execution
  - attack.t1059
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/apt'
      - '/apt-get'
      - '/dpkg'
      - '/aptitude'
  selection_child:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/socat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
      - '/openssl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare — some third-party vendor packages fetch components in postinst scripts; baseline known-good packages and alert on deviations
level: high
---
title: APT Package Retrieval Over Cleartext HTTP
description: Detects apt tools invoked with or configured for plain-HTTP repositories, exposing package downloads to MitM substitution per the APT retry flaw. HTTP transport removes TLS as a barrier for attackers modifying package downloads.
references:
  - https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html
author: Security Arsenal
date: 2026/11/05
status: experimental
tags:
  - attack.defense_evasion
  - attack.t1195.002
  - attack.t1557
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/apt'
      - '/apt-get'
      - '/aptitude'
  selection_cli:
    CommandLine|contains:
      - 'http://'
  condition: selection_img and selection_cli
falsepositives:
  - Internal mirrors served over HTTP on isolated segments — migrate them to HTTPS rather than tuning out the signal
level: medium
---
title: Root Shell or Recon Execution Immediately Following Package Installation
description: Detects interactive shells or reconnaissance commands executed as root shortly after dpkg/apt activity — a post-exploitation pattern when a substituted package drops an implant or opens a shell via maintainer scripts.
references:
  - https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html
author: Security Arsenal
date: 2026/11/05
status: experimental
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_user:
    User: 'root'
  selection_parent:
    ParentImage|endswith:
      - '/dpkg'
      - '/apt'
      - '/apt-get'
  selection_img:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/chmod'
      - '/chown'
      - '/useradd'
      - '/usermod'
      - '/crontab'
      - '/systemctl'
  selection_cli:
    CommandLine|contains:
      - ' -i'
      - '/dev/tcp/'
      - 'chmod +s'
      - 'chmod 4755'
      - 'authorized_keys'
  condition: selection_user and selection_parent and selection_img and selection_cli
falsepositives:
  - Legitimate postinst scripts enabling services via systemctl — the CLI modifiers (reverse shells, SUID bits, SSH key writes) are the discriminating signal
level: high

// Hunt: suspicious child processes of apt/dpkg on Linux endpoints via MDE for Linux
// or Syslog process_creation ingestion into Sentinel — consistent with trojaned
// maintainer scripts from a MitM-substituted APT package executing as root.
let apt_parents = dynamic(["apt", "apt-get", "dpkg", "aptitude"]);
let suspicious_children = dynamic(["curl", "wget", "nc", "ncat", "socat", "python", "python3", "perl", "base64", "openssl"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (apt_parents)
   or InitiatingProcessCommandLine has_any ("apt-get", "/usr/bin/apt ", "dpkg ")
| where FileName in~ (suspicious_children)
   or ProcessCommandLine has_any ("/dev/tcp/", "chmod 4755", "chmod +s", "authorized_keys", "curl http", "wget http")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, SHA256, ReportId
| sort by TimeGenerated desc
;
// Companion hunt: Syslog-ingested Linux hosts running apt over plain HTTP
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("apt", "apt-get", "aptitude")
| where SyslogMessage has "http://" and SyslogMessage !has "https://"
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc

-- Velociraptor artifact: enumerate APT exposure and anomalous install activity
-- 1) Flag HTTP-configured APT sources (MitM-exposable download paths)
-- 2) List apt/dpkg processes and their children during a hunt window
SELECT * FROM foreach(
  row={ SELECT FullPath FROM glob(globs='/etc/apt/sources.list.d/*.list') },
  query={
    SELECT FullPath, parse_file(filename=FullPath) AS SourceContent
    FROM scope()
  })
;
-- HTTP sources in the main sources file
SELECT '/etc/apt/sources.list' AS ConfigFile,
       parse_file(filename='/etc/apt/sources.list') AS Content
FROM scope()
WHERE Content =~ 'http://'
;
-- Live view: any apt/dpkg process trees with suspicious children (run during hunt)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '^(apt|apt-get|dpkg|aptitude)$'
   OR CommandLine =~ '(curl|wget|nc |ncat|/dev/tcp/|authorized_keys|chmod \+s)'

#!/bin/bash
# APT MitM flaw — verify, patch, and harden (Debian/Ubuntu)
# Run as root on every Debian-family host, build agent, and container base image.

set -euo pipefail

echo "=== [1/5] Current APT version ==="
apt --version
dpkg -l apt libapt-pkg* 2>/dev/null | grep '^ii' || true

echo "=== [2/5] Inventory cleartext-HTTP package sources (MitM-exposable) ==="
grep -rEhn '^\s*deb\s+http://' /etc/apt/sources.list /etc/apt/sources.list.d/ 2>/dev/null || echo "No HTTP sources found."

echo "=== [3/5] Migrate sources to HTTPS where the mirror supports it ==="
# Backup first, then rewrite http:// -> https:// for official Debian/Ubuntu mirrors.
cp -a /etc/apt/sources.list /etc/apt/sources.list.bak.$(date +%F) 2>/dev/null || true
mkdir -p /root/apt-hardening-backup && cp -a /etc/apt/sources.list.d/ /root/apt-hardening-backup/ 2>/dev/null || true
sed -i -E 's|http://(deb\.debian\.org|security\.debian\.org|archive\.ubuntu\.com|security\.ubuntu\.com)|https://\1|g' \
  /etc/apt/sources.list /etc/apt/sources.list.d/*.list 2>/dev/null || true

echo "=== [4/5] Update APT itself FIRST, with retries disabled for this transaction ==="
# The flaw requires a failed download + retry; pin retries to 0 for the bootstrap update.
apt-get -o Acquire::Retries=0 -o Acquire::http::Timeout=30 update
apt-get -o Acquire::Retries=0 install -y --only-upgrade apt libapt-pkg6.0 2>/dev/null \
  || apt-get -o Acquire::Retries=0 install -y --only-upgrade apt

echo "=== [5/5] Persistent hardening: disable retry-driven re-fetch of partial downloads ==="
cat > /etc/apt/apt.conf.d/99-mitm-hardening <<'EOF'
// Mitigation for APT retry package-substitution flaw (Nov 2026 advisories)
// Fail loudly instead of silently retrying potentially tampered transfers.
Acquire::Retries "0";
// Enforce hash verification strictly; never allow downgrade of verification.
Acquire::AllowInsecureRepositories "false";
Acquire::AllowDowngradeToInsecureRepositories "false";
EOF

echo "=== Post-patch verification ==="
apt --version
echo "Confirm the installed APT version matches the fixed version in your distro advisory:"
echo "  Debian:  https://www.debian.org/security/"
echo "  Ubuntu:  https://ubuntu.com/security/notices"
echo "Done. Re-run your normal 'apt-get update && apt-get upgrade' after verifying sources."