I am running Tails version .22.0. I downloaded version .23 and the sig file (under the verify signature command). It was reported as a bad signature. This happened again with the 1.0 download. I have tried a few different ways of verifying the signature - same result. Does anyone have any idea what has been happening? Is this an actual attack? Could the key I downloaded with .22 have been tampered with (in which case the software is probably also comprimised)?
1 Answer
I did encounter this problem a while because of a stupid mistake : I was checking the signature after issuing the isohybrid command on it, which of course messed up the signature... Duh. So check your verifying procedure first.
I don't think the key would have been tampered because what's the point of tampering it if still doesn't verify the alleged tampered ISO ?
Intercepting your download and replacing it by a forged one is quite a sophisticated attack. If you are not a (really) high target profile, or don't have a very determined ennemy, the probability of this attack seems very low to me.
One way to know it for sure is to download the ISO "as someone else" (public internet, other's computer, etc), if its sigs match, your previous ISO was indeed not the original Tails. Now you have to know what happened. Keep the previous corrupted badly signed ISO on a read-only media (CD-R) to then compare it with the new legit one.
Comparing route :
SHA2 checksums on each file of the unpacked ISO.
Spot the ones that differs.
Identify wether it looks like bugs/mistake or malware intended modification through code reviews and reverse-engineering.
Get help online for any of the steps whose you don't have the ability for.
The line between unlimited paranoïa and certainty of an attack relies on proofs. Without them you'll never move forward and I know this because I've been there.