Malware Found in the Ubuntu Snap Store • Hacker News Board

Re: Malware Found in the Ubuntu Snap Store

#51

Post by geofft » Sat, May 12, 2018, 7:50 PM UTC

ISL wrote: post #13

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

I do tend to believe that the presence of a package in the Debian repositories is a limited representation of quality/review, as there is a package-maintainer and apparent community decision as to whether or not to keep it in the distro. Is that perception correct?

That perception is correct. It's limited because in practice Debian developers (being almost entirely volunteers!) don't have the resources to read and audit each line in an upstream release, so certainly intentionally obfuscated backdoors from a previously trustworthy upstream would almost certainly get through. But the type of attack in this article, with a new binary and an unwanted line of shell script to run it, would be very unlikely to get through.

There's also a limited set of people who can upload new packages and a separate team that reviews those, so duplicated functionality / low-quality apps are unlikely to make it into the archive in the first place. Yet Another 2048 Clone would probably not be allowed in unless it was part of e.g. an official GNOME game set.

It also helps that Debian insists on recompiling everything from source and does not redistribute binaries from an upstream source, even if freely-licensed source code is provided.

Re: Malware Found in the Ubuntu Snap Store

#52

Post by geofft » Sat, May 12, 2018, 7:52 PM UTC

icebraining wrote: post #21

yrro wrote: post #17

Earlier quoted context omitted.

Every line of code should have been reviewed by at least one DD. But the system is self policing, so it's hard to guarantee that that's the case. But Debian certainly leans towards being a curated collection of software rather than a wild west.

Self-policing? Aren't only DDs allowed to upload to the repositories? From what I understand, dak (the Debian archive management software) won't publish a package which hasn't been approved by a sponsor DD.

The part that's self-policing is that nobody verifies that a DD has in fact reviewed the code that they're signing and uploading (and as another reply points out, for large codebases like the Linux kernel, the maintainer almost certainly doesn't and just trusts the upstream signature).

Re: Malware Found in the Ubuntu Snap Store

#53

Post by popey » Sat, May 12, 2018, 7:52 PM UTC

amenod wrote: post #49

evand wrote: post #37

Earlier quoted context omitted.

That is not true. You absolutely can specify a license: https://snapcraft.io/vlc

Off topic: why would someone install VLC over Snap instead of the version from Ubuntu repos?

Because the same snap can run on releases of Ubuntu all the way back to 14.04. 14.04 has VLC 2.1 in the repo. 16.04 LTS has VLC 2.2. The snap store has 3.0.1 in the stable channel, with 4.0 (dev release) in the edge channel. Versions that will never be in the archive of those older releases.

As LTS releases age, the contents of the repo age with them. PPAs are one solution, but they're undiscoverable and not straightforward for new users to setup. Ubuntu has a ton of users who are 'sticky' on old LTS releases.

This enables the VLC developer to have one package that targets millions of users across lots of releases of Ubuntu - and other distros too.

Re: Malware Found in the Ubuntu Snap Store

#54

Post by detaro » Sat, May 12, 2018, 7:57 PM UTC

aritmo wrote: post #32

solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

There's not much to do with X without breaking the protocol.

... without additional overhead and engineering effort. You can sandbox an X application by running a dedicated X server in the sandbox and pass only a secured channel out.

Re: Malware Found in the Ubuntu Snap Store

#55

Post by scarface74 » Sat, May 12, 2018, 7:58 PM UTC

colejohnson66 wrote: post #47

faho wrote: post #29

Earlier quoted context omitted.

>a simple game like that taking >100MB would make me suspicious Nah. Games often feature a bunch of textures and video and sound files. Bad compression or too high resolution on those is quite common, which is why games _are_ often that large. Also proprietary software usually ships a bunch of libraries - games often ship with a premade engine, which are also often quite large. As a datapoint, I have a copy of "Strat…

I remember the Facebook app being less than 20 megabytes in size half a decade ago. Now it’s almost half a gigabyte

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do.

Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

Re: Malware Found in the Ubuntu Snap Store

#56

Post by subway » Sat, May 12, 2018, 7:58 PM UTC

solomatov wrote: post #36

the_common_man wrote: post #6

This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.

Why not run random docker images? As far as I understand, docker container are pretty solid. Not super solid but solid enough.

Those random docker images are rarely used in isolation. They typically handle your data and often your customers data.

Beyond that, numerous escape exploits in linux containerization (and docker specifically) have popped up over the years, and many more are going to pop up over the coming years. This is not a mature space.

Running random binary code distributed from an non-curated source, even in a "container" is going to end in heartache.

Re: Malware Found in the Ubuntu Snap Store

#57

Post by amenod » Sat, May 12, 2018, 7:58 PM UTC

popey wrote: post #53

amenod wrote: post #49

Earlier quoted context omitted.

Off topic: why would someone install VLC over Snap instead of the version from Ubuntu repos?

Because the same snap can run on releases of Ubuntu all the way back to 14.04. 14.04 has VLC 2.1 in the repo. 16.04 LTS has VLC 2.2. The snap store has 3.0.1 in the stable channel, with 4.0 (dev release) in the edge channel. Versions that will never be in the archive of those older releases. As LTS releases age, the contents of the repo age with them. PPAs are one solution, but they're undiscoverable and not straight…

Thanks!

Re: Malware Found in the Ubuntu Snap Store

#58

Post by codedokode » Sat, May 12, 2018, 7:59 PM UTC

drchickensalad wrote: post #31

faho wrote: post #29

Earlier quoted context omitted.

>a simple game like that taking >100MB would make me suspicious Nah. Games often feature a bunch of textures and video and sound files. Bad compression or too high resolution on those is quite common, which is why games _are_ often that large. Also proprietary software usually ships a bunch of libraries - games often ship with a premade engine, which are also often quite large. As a datapoint, I have a copy of "Strat…

For some high performance games, storing assets with weaker compression means less CPU cycles spent.

Not necessary. Larger assets take more time to read from disk.

Re: Malware Found in the Ubuntu Snap Store

#59

Post by kuschku » Sat, May 12, 2018, 7:59 PM UTC

colejohnson66 wrote: post #47

faho wrote: post #29

Earlier quoted context omitted.

>a simple game like that taking >100MB would make me suspicious Nah. Games often feature a bunch of textures and video and sound files. Bad compression or too high resolution on those is quite common, which is why games _are_ often that large. Also proprietary software usually ships a bunch of libraries - games often ship with a premade engine, which are also often quite large. As a datapoint, I have a copy of "Strat…

I remember the Facebook app being less than 20 megabytes in size half a decade ago. Now it’s almost half a gigabyte

Which is crazy – with my own apps even after they’re packed with features I can barely get above 4MB.

Going to 100x that? Insane.

Re: Malware Found in the Ubuntu Snap Store

#60

Post by paulpauper » Sat, May 12, 2018, 8:00 PM UTC

A Monero miner is one of the more innocuous forms of malware ,compared to a C&C trojan or a keylogger. Some websites will mine monero in the background. Because it's just a js script, it's not much different than a banner ad except it's less intrusive, yet somehow 'currency miner' has more negative connotations than 'ad server'. That is the downside of decentralized mining and asic resistance is you end up with a lot of zombie miners.