Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware identified in CCleaner 5.33

blog.talosintelligence.com

Post reply on HN
Print view View original

51–60 of 229 posts

Re: Malware identified in CCleaner 5.33

#51

Post by cm2187 »

cyphar wrote: post #47
cm2187 wrote: post #41

Earlier quoted context omitted.

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

As I posted above, we have a build service that does this automatically for you. It takes maybe 30 minutes to create a few spec files, and now it's supported by a bunch of different distributions. You can then point your users at the repo (or mirror the repo if you prefer). Also OBS lets you create forks of projects that just inherit the unmodified packages (and said forks can also be cross-host so you don't need to…

But who would use the build service? The consumer of the software or the publisher?

[edit] also that protects you against malware injecting binaries in an executable when compiling it, but not from malware injecting code into the source code of the executable.

Re: Malware identified in CCleaner 5.33

#52

Post by pmontra »

cm2187 wrote: post #41
cyphar wrote: post #37

Earlier quoted context omitted.

First of all, this is why reproducible builds (getting bit-for-bit identical binaries independent of the machine used to build the software) is something we should be putting much more work into. The Debian folks are doing an amazing job there. Another important point is that distributions have already solved effectively all of these problems. We have automated building and signing systems that mean that installation…

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

I don't know what they're planning to do, but we could need only a few parties doing the verifications. If a build yields the wrong binary then the release is flagged and nobody gets it. Apt should check against the expected results.

Many things could go wrong with this (mainly attacks on the expected results db, it should be replicated) but the idea should work.

Re: Malware identified in CCleaner 5.33

#54

Post by cm2187 »

pmontra wrote: post #52
cm2187 wrote: post #41

Earlier quoted context omitted.

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

I don't know what they're planning to do, but we could need only a few parties doing the verifications. If a build yields the wrong binary then the release is flagged and nobody gets it. Apt should check against the expected results. Many things could go wrong with this (mainly attacks on the expected results db, it should be replicated) but the idea should work.

The thing is if the threat is any machine on the publisher side being infected, then it sorts of need to be verified by the consumer of the software, a bit like compiling a checksum when you download software.

Re: Malware identified in CCleaner 5.33

#55

Post by cyphar »

cm2187 wrote: post #51
cyphar wrote: post #47

Earlier quoted context omitted.

As I posted above, we have a build service that does this automatically for you. It takes maybe 30 minutes to create a few spec files, and now it's supported by a bunch of different distributions. You can then point your users at the repo (or mirror the repo if you prefer). Also OBS lets you create forks of projects that just inherit the unmodified packages (and said forks can also be cross-host so you don't need to…

But who would use the build service? The consumer of the software or the publisher? [edit] also that protects you against malware injecting binaries in an executable when compiling it, but not from malware injecting code into the source code of the executable.

> But who would use the build service? The consumer of the software or the publisher?

Publisher. A user could (if they were really paranoid) rebuild the packages locally, with two or three commands.

> Also that protects you against malware injecting binaries in an executable when compiling it, but not from malware injecting code into the source code of the executable.

You can download the source code that OBS used (both as a src RPM generated by the builder and the OBS repo that the builder was given read-only access to), and OBS supports cryptographic signatures of the originating source (with gpg-offline keys to avoid WoT attacks). If your developers are using sane source control practices (use GPG keys for every commit, but especially tags) then you are protected against that too.

Of course, reproducible builds is something that would solve this problem even better (protecting against attacks on OBS that cause it to add source that are not in the repo). As a side point, our threat model doesn't fully trust the nodes compiling the software so such attacks are fairly limited in scope (but I'm not a developer of OBS so I'm really not the right person to be asked these questions).

Re: Malware identified in CCleaner 5.33

#56

Post by cyphar »

pmontra wrote: post #52
cm2187 wrote: post #41

Earlier quoted context omitted.

That's ok for the NSA and a few large enterprises to check certain binaries but you can't ask any start up or small company to recompile themselves every version of every OS / Software / Library that they use. It's not really a practical solution (even assuming everything is open source).

I don't know what they're planning to do, but we could need only a few parties doing the verifications. If a build yields the wrong binary then the release is flagged and nobody gets it. Apt should check against the expected results. Many things could go wrong with this (mainly attacks on the expected results db, it should be replicated) but the idea should work.

Right, and this is why we need reproducible builds.

Re: Malware identified in CCleaner 5.33

#57

Post by avenius »

pmlnr wrote: post #38
Jdam wrote: post #33

"CCleaner is an application that allows users to perform routine maintenance on their systems ." It's 2017, how is this still a thing?

I don't understand the question. Maintenance will always be a thing, carried out by humans, cron, or the os itself doesn't really matter.

I think he's referring to the fact that you need a third-party application to perform maintenance, rather than have the functionality supplied in the OS.

Re: Malware identified in CCleaner 5.33

#58

Post by 0xabe »

julianj wrote: post #48
superasn wrote: post #35

Earlier quoted context omitted.

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

Give Ubuntu desktop a try. The installer allows you to run the OS live without installation. You can use this to see if Ubuntu is something you may be interested in.

My experience with Ubuntu (xubuntu 16.04.x) is that you really need a modern Nvidia card to get high/native resolution. Especially for someone who wants to run 3 monitors.

Re: Malware identified in CCleaner 5.33

#59

Post by zolthrowaway »

julianj wrote: post #48
superasn wrote: post #35

Earlier quoted context omitted.

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

Give Ubuntu desktop a try. The installer allows you to run the OS live without installation. You can use this to see if Ubuntu is something you may be interested in.

+1 for this. Try before you "buy" so to speak. In a very similar vein, Linux Mint also allows you to do this. Both OSes work very well out of the box and there are large communities for help.

Re: Malware identified in CCleaner 5.33

#60

Post by omginternets »

superasn wrote: post #35
happy-go-lucky wrote: post #23

As a kid, the only OS I was aware of was Windows. Once, my computer was infected to the point where it was almost unusable. A more experienced friend suggested a non-free antivirus and the CCleaner. After a lot of effort, I could get my machine back to working, but it became so slow that it led me to discover Linux. Now, on a Windows 10 machine, I’ve nothing but Defender, and since the aforementioned experience I’ve…

> it led me to discover Linux As someone who is the same boat but hasn't discovered Linux yet, how hard would you say it would be to install a version of Linux that support 3 monitors (using an onboard ATI card and a PCIe card)? Last time I tried installing it this is the part I gave up at. Also as a person always been aware of Window I find the graphics in Ubuntu lacking some finesse, i.e. the scrollbars, window pan…

ElementaryOS [0] prides itself in it's UI. Granted, this is very much a matter of taste, but if you're into the whole Mac look-and-feel, you might like it.

But frankly I find the Gnome-Shell desktop to be beautiful. Maybe try Ubuntu-Gnome? [1]

[0] https://elementary.io/ [1] https://ubuntugnome.org/

Post reply on HN