Malware Found in the Ubuntu Snap Store
linuxuprising.com
Malware Found in the Ubuntu Snap Store
1–10 of 223 posts
Re: Malware Found in the Ubuntu Snap Store
#2>For example, the 2048buntu snap was submitted as proprietary, so we can't actually see the package contents, except for the init script which you can see above.
Unless the Snap Store uses some kind of DRM, I don't see how that can be the case. Just install it and see the contents in your filesystem?
Re: Malware Found in the Ubuntu Snap Store
#3Apple's strategy for their store looks better and better every day.
Re: Malware Found in the Ubuntu Snap Store
#4This is the Snap distribution system working as intended with unfortunate consequences.
Re: Malware Found in the Ubuntu Snap Store
#5>For example, the 2048buntu snap was submitted as proprietary, so we can't actually see the package contents, except for the init script which you can see above. Unless the Snap Store uses some kind of DRM, I don't see how that can be the case. Just install it and see the contents in your filesystem?
Presumably they mean they can't see the source code.
Re: Malware Found in the Ubuntu Snap Store
#6This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.
Re: Malware Found in the Ubuntu Snap Store
#7>For example, the 2048buntu snap was submitted as proprietary, so we can't actually see the package contents, except for the init script which you can see above. Unless the Snap Store uses some kind of DRM, I don't see how that can be the case. Just install it and see the contents in your filesystem?
It probably refers to distribution of binaries without source code, which MIT license allows. Wording could be better
Re: Malware Found in the Ubuntu Snap Store
#8The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u...
>"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong security policies can simply type into another window," he wrote.
They might have wrapped X protocol to provide more security and control. Instead they decided not to.
They might have created a system which is as bulletproof as on iOS where you can install any apps and be 99.9999% sure that they won't steal your data unless you allow them to. But they created this instead.
Re: Malware Found in the Ubuntu Snap Store
#9There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish
Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that it's endorsed by the OS vendor?
I was at a PyCon BoF earlier today about security where I learned that many developers - including experienced developers - believe that the presence of a package on the PyPI or npm package registries is some sort of indicator of quality/review, and they're surprised to learn that anyone can upload code to PyPI/npm. One reason they believe this is that they're hosted by the same organizations that provide the installer tools, so it feels like it's from an official source. (And on the flip side, I was surprised to learn that Conda does do security review of things they include in their official repositories; I assumed Conda would work like pip in this regard.)
Whether or not people should believe this, it's clear that they do. Is there something that the development communities can do to make it clearer that software in a certain repository is untrusted and unreviewed and we regard this as a feature? The developers above generally don't believe that the presence of a package on GitHub, for instance, is an indicator of anything, largely because they know that they themselves can get code on GitHub. But we don't really want people publishing hello-worlds to PyPI, npm, and so forth the way they would to GitHub as part of a tutorial, and the Ubuntu Snap Store is targeted at people who aren't app developers at all.
Re: Malware Found in the Ubuntu Snap Store
#10I'm not familiar with Ubuntu snap store, but how does it compare with Google play store in terms of security?
For example, do apps need to request permissions for accomplishing specific tasks, or is there any kind of sandboxing involved?