Bonum Certa Men Certa

Microsoft Edge for “Linux” Uses Outdated GPG and Then Configures it to Silence Your Distribution’s Package Security Checks

Reprinted with permission from Ryan

Previously: Bruce Schneier: Microsoft Edge is Apparently a Password Stealer Too, Even on GNU/Linux

Microsoft Edge for “Linux” uses outdated GPG and then configures it to silence your distribution’s package security checks.



I got bored today and decided to look at the RPM package for Microsoft Edge for “Linux”.



If you installed it, it will add a microsoft-edge.repo file in etc/yum.repos.d with the following:



[microsoft-edge]
name=microsoft-edge
baseurl=https://packages.microsoft.com/yumrepos/edge/
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc


As you can see, Microsoft has essentially bypassed the GPG check by enabling the check, and then instead of installing a package signing key into the RPM database, like well behaved software does, they point it at a Public Key hosted on their server.



The gist of this is that it shuts up the “package is unsigned” warning that prevents tampering, but then provides no assurances that Microsoft Edge updates are actually not tampered with.



If an attacker compromises Microsoft’s server, they could replace the key, then replace Microsoft Edge with a package containing anything (or just add malware to Edge to increase the amount of time before people realized anything was wrong with the package), and it would pass the signature check because DNF would check the URL and find the attacker-modified microsoft.asc Public Key.



Additionally, by following the URL to the Microsoft Public Key block, I noticed that they are using an outdated branch of GPG as well, which dates back to 2004 and is only maintained to address CVEs.



GPG recommends migrating to the current branch (2.3.8 is the latest as of this writing), and Mullvad VPN warns its users not to use the 1.4 branch as well.



Additionally, GPG says that the 1.4 branch is not widely used, so there’s likely fewer people legitimately studying it to fix it, and more likely just attackers looking for slobs that are still using it, like Microsoft.



This should be yet another example of how much Microsoft can be trusted to “secure” your computer.



They can’t even secure their own. They had a couple of major data breaches thanks to misconfiguration of Azure recently, which even BleepingComputer covered.



I hope that if you’re considering putting Microsoft software where it doesn’t belong, on your GNU/Linux system, then witnessing their slovenly practices should give you some second thoughts.



Just this repo alone sets up your GNU/Linux system to be seriously compromised.



The point of installing GPG keys into RPM is so that when there’s a breach of the server, it doesn’t affect users that already have the program and get alerted that there’s an update. A legitimate update which updates RPM with the new GPG key would have to be signed using the old one, meaning that a chain of trust is preserved.



When you point it at a Web site, like Microsoft does, you have no idea what you’ll get.



Recent Techrights' Posts

Destruction and Distortion of Information, Including Facts About Linux (Bonus: This is Destroying the Planet)
All that LLMs have going for them is hype, and moreover media that intentionally misrepresents them and their supposed capabilities
Google Seems to Have Just Killed All Instances of Invidious
YouTube is rapidly becoming just "another Neflix"
 
Links 12/02/2025: SSL FUD, DEI Phase-out, Felonies Committed by MElon (Data Breaches)
Links for the day
Italian Media Covers Richard Stallman's English Talk Ahead of Tonight's Public Appearance
article in La Stampa
Microsoft Skype in a Freefall: About 20% Decrease in Site Traffic in 3 Months (Amid Microsoft Phasing Out Credits)
Microsoft axing more services/features may mean that now they scrape the bottom of the barrel and Skype will simply die, discontinuing service (like ICQ) in a matter of years
Gemini Links 12/02/2025: Depression, Gabbro, WikiTok, and More
Links for the day
Links 12/02/2025: Health, Security, and Monopolies
Links for the day
Gemini Protocol is Increasingly Important to the Net
Gemini Protocol will turn 6 this summer
Former EPO Manager Warns That the Illegal 'Court' for "Unitary Patents" Enables “Law Shopping”
Daniel X. Thomas opposed the very existence of the UPC, which any honest person could recognise was both illegal and unconstitutional
Like GAFAM, the EPO is Passing the Financial Pains to Staff
the EPO is operating illegally at this point
Morale at Microsoft Ruined by the Company Labelling Thousands of Workers 'Low Performers', Sacking Them on the Spot and Denying Them Basic Benefits
people laid off as "low performers" go to social control media to bemoan the label
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Tuesday, February 11, 2025
IRC logs for Tuesday, February 11, 2025
Links 11/02/2025: Current state of the Internet and Smallnet Information Services (SIS)
Links for the day
Conservative Estimate: Over 10,000 IBM Workers to Be Laid Off in the Next Two Waves
The morale is low and layoffs are expected soon, with mass layoffs likely happening next month and then again later
Links 11/02/2025: Trade Wars and "Crisis for American Universities"
Links for the day
Parasitic LLM Slop Sites Destroy the Ability to Find "Linux" News in Google News
Remember that Google News laid off lots of its workers
Richard Stallman's English Talk in Italy Less Than 24 Hours Away (Torino) and Then Another Talk in Italy Scheduled (University of Bozen-Bolzano)
He's active and he travels a lot in spite of his medical condition
IBM Layoff Rumours, Large-Scale Implementations Weeks Ahead (in March 2025)
There are some people corroborating
Links 11/02/2025: Nutritional Poverty, Closure of USAID, More Fictional 'Valuations' Around Buzzwords
Links for the day
Perl Programming Leftovers
recently in perl.org
Microsoft in Africa: From 98% to Less Than 10% in Just 16 Years
Microsoft being on less than 1 in 10 Web-connected devices in Africa is a very big deal
Almost as If MElon Reads Techrights
The joke we started appears to be spreading
Microsoft Blasted for Adding Insult to Injury: Workers Laid Off Without Prior Notice, Without Severance Payment and Basic Coverage (Like Health), Then Stigmatised as Bad Performers So They Cannot Find a Job Elsewhere
Such stereotypes end entire careers
Gemini Links 11/02/2025: NeoVim and Deploying Other People's Code
Links for the day
BetaNews is Still Publishing LLM Slop/SPAM About "Linux"
Assuming it is indeed LLM slop, it seems clear BetaNews has no intention of improving or is simply unable/unwilling to improve
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, February 10, 2025
IRC logs for Monday, February 10, 2025
Scheduled Maintenance Tomorrow and on Valentines
If the site (or Gemini capsule) is offline for a bit, the maintenance windows are likely the root cause
If Matthias Kirschner Loves Free Software, He'll Change the Name of the Microsoft-Sponsored Organisation He Governs (in Order to Avoid Confusion)
The FSF-EEE does not really like Software Freedom, it just loves money (including Microsoft's)
Soylent News Lessens the Scope of Discussion Due to Persistent Trolling and Online Abuse
if they make it a lot harder for new people to participate, then they limit the "general appeal" and reach
EPO's Local Occupational Health, Safety and Ergonomics Committee (LOHSEC) in The Hague: Workers Are Getting Sicker, Conditions in Which to Assess Patent Applications Deteriorate
"According to the Office statistics the total number of days of absence has gone up from 12.4 to 13.1 total number of sick days per Full Time Equivalent (FTE) from 2023 to 2024."
The Standard Needs to Improve Its Standards for Fact-Checking, Aaron Swartz Had Nothing to Do With Reddit and He Detested the Company That Created It
The Web is already bad enough as it is
When the Livestream of Richard Stallman is Apparently Bury-Brigaded Offline You Finally Learn to Avoid Google/YouTube for Streaming
Please, people, stop uploading to Google/YouTube
New Paper From the EPO Highlights Large-Scale Discrimination at the Office, Where People Are Rewarded for Granting More and More Illegal Patents
Even the Kremlin is probably more competent than this
Links 10/02/2025: Ban on D.E.I. Language, Listeria Risk/Outbreak
Links for the day
Links 10/02/2025: Announcing "Stringless" and Mental Health Improvement
Links for the day
Links 10/02/2025: Facebook Mass Layoffs, "Meta" Did What Aaron Swartz Had Done But to the Tune of 81.7 Terabytes
Links for the day
Microsoft Tarnishing the Brand of Arch
Of course Arch can do whatever it wants, but being associated with Microsoft is a badge of shame
The Ultimate and Inevitable Fall of OpenAI (Even Brave is 'Bigger' Now)
"When you advertise at the Super Bowl, you’ve reached just about every consumer in America. It’s the last stop. If you’re not profitable yet, you never will be."
Adding Slop to Your Blog Only Makes One Assume All the Text is LLM Slop
Simon Coter from Oracle has turned to slop
Macao is Leaving Microsoft Behind
Windows is falling to new all-time lows
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, February 09, 2025
IRC logs for Sunday, February 09, 2025
Microsoft's WSL (LSW) Shows That It Can Never Love Linux, Only Windows
that's just how Microsoft rolls
Activism in Times of War and a Coup
'Linux' Foundation works for fascism
What the Silencing of Neatnik Tells Us About Linus Torvalds Inside a Microsoft-Dominated 'Linux' Foundation
Is Linus Torvalds free to express his mind as he wishes about every topic, even just any technical topic?
Windows Down to 11.35% in Senegal, as Measured by statCounter
Another all-time low (Windows was at 99% in 2009)
"Latest Technology News" in BetaNews is LLM Slop Promoting OOXML and Proprietary Software at the Expense of LibreOffice and OpenDocument Format (ODF)
Remember that "open-source" and Open Source aren't the same; the former is fake