编写自动更新客户端时我必须担心哪些安全问题？
我正在编写一个自动更新客户端。这是一个非常简单的应用程序：
1) 检查中央服务器以查看某些应用程序是否存在更新
2) 如果存在更新版本，则从服务器下载安装程序
3) 运行安装程序
除了服务器端问题（例如有人入侵我们的网站并在那里放置“较新”的恶意应用程序）之外，在实现此操作时我还必须考虑哪些客户端安全问题？
我目前的想法是：
1) 校验和。将校验和包含在 .xml 文件中，并根据下载的文件进行检查。 （加密前还是加密后？）
2) 加密文件。使用一些私钥加密该文件，并让该程序使用公钥对其进行解密。
这两者或其中之一是必要和充分的吗？还有什么我需要考虑的吗？
请记住，这仅是为了解决客户端的问题。我几乎无法控制服务器本身。
I am writing an auto update client. It's a very simple app that:
1) Checks a central server to see if an update exists for some application
2) Downloads the install program from the server if a newer version exists
3) Runs the setup program
Other than server-side concerns (like someone hacking our site and placing a 'newer' malicious application there), what client-side security concerns must I take into account when implementing this?
My current ideas are:
1) Checksum. Include the checksum in the .xml file and check that against the downloaded file. (Pre or post encryption?)
2) Encrypt the file. Encrypt the file with some private key, and let this program decrypt it using the public key.
Are both or either of these necessary and sufficient? Is there anything else I need to consider?
Please remember this is only for concerns on the CLIENT-SIDE. I have almost no control over the server itself.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您通过 https 检索所有信息并检查有效证书，则可以确定数据来自您的服务器。
If you retrieve all of the information over https and check for a valid certificate then you can be sure that the data is coming from you server.
校验和的强度取决于下载它们的站点。
如果您使用非对称签名，以便自动更新客户端拥有公钥，那么您可以对更新进行签名，并且只要他们没有获得私钥，即使有人攻击您的网站也没关系。
The checksums are only as strong as the site from which they're downloaded.
If you use an asymmetric signature, so that the auto-update client has the public key, then you can sign your updates instead, and it won't matter if someone hacks your website, as long as they don't get the private key.
如果我可以破坏提供补丁的服务器，并且校验和位于同一台服务器上，那么我就可以破坏校验和。
如果您不使用 SSL 传送文件，则加密补丁非常有用。
执行程序的用户通常无权写入安装目录（出于安全原因；这适用于桌面应用程序以及 Web 服务器上的 PHP 脚本）。在找出安装补丁的方法时，您必须考虑到这一点。
If I can compromise the server that delivers the patch, and the checksum is on the same server, then I can compromise the checksum.
Encrypting the patch is mainly useful if you do not use SSL to deliver the file.
The user that executes a program is usually not authorized to write to the installation directory (for security reasons; this applies to desktop applications as well as e.g. PHP scripts on a web server). You will have to take that into account when figuring out a way how to install the patch.