Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

101–110 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#101

Post by StavrosK »

zokier wrote: post #39
userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

I would be really surprised if the miner is contributing any major portion of that size. I just did a very basic search and a random miner I found has binary sizes https://github.com/xmrig/xmrig/releases edit: apparently the actual game is based on https://github.com/gabrielecirulli/2048 which is HTML+JS, so probably the Snap was bundling in Chromium/Electron, which explains the size.

Yeah, the Coinhive miner is ~115 KILObytes.

Re: Malware Found in the Ubuntu Snap Store

#102

Post by superkuh »

crispyporkbites wrote: post #62
paulpauper wrote: post #60

A Monero miner is one of the more innocuous forms of malware ,compared to a C&C trojan or a keylogger. Some websites will mine monero in the background. Because it's just a js script, it's not much different than a banner ad except it's less intrusive, yet somehow 'currency miner' has more negative connotations than 'ad server'. That is the downside of decentralized mining and asic resistance is you end up with a lot…

> Because it's just a js script, it's not much different than a banner ad except it's less intrusive Tell that to your electricity provider

The same thing can be said about JS ad analytics scripts and ads. Or sites that turn the entire webpage into a JS 'web app' when it'd work fine as HTML with static images and text.

Re: Malware Found in the Ubuntu Snap Store

#103

Post by matthewbauer »

wollw wrote: post #12
spullara wrote: post #3

Apple's strategy for their store looks better and better every day.

I prefer the BSD port system.

Is there a significant difference between BSD ports vs. Portage vs. Arch Build System? Especially in terms of security I think that they all have the same model.

FreeBSD ports has a ton of packages, though. Maybe they have incredible quality control, but I would bet a few of those have some malware in them. That goes for all Linux/BSD build systems, obviously, just huge ones make it more likely.

https://repology.org/statistics/newest

Re: Malware Found in the Ubuntu Snap Store

#104

Post by fjsolwmv »

FRex wrote: post #87
scarface74 wrote: post #61

Earlier quoted context omitted.

It would still look quite shady. It's also burning electricity, hogging your CPU and putting heat and stress onto your CPU Like any other Electron based app...

This is false equivalence. The electron app is ostensibly working for your benefit, just in a very inefficient way, not mining a currency using your resources to ship off to someone. You could argue that making users pay for savings in development by their RAM, Disk, CPU, GPU and electricity costs is also bad (and even bad for the planet) but that's a less shady business strategy for saving cost than covertly mining.…

You say "shady" but you don't explain why. I don't understand the distinction. I care about the quality of an app and how much it costs in $/CPU/RAM. Why should I care why it uses the CPU it uses?

If someone (legally) cloned an app, cut CPU in half, and replaced have the savings with mining, why would you prefer the original app?

Re: Malware Found in the Ubuntu Snap Store

#105

Post by matthewbauer »

alsadi wrote: post #41

Unlike flahub where either original develop or flathub admins take control Canonical's Snapcraft literally says "Get published in minutes" Any random guy would publish his malware with near no review https://dashboard.snapcraft.io/snaps/ Yes, they maybe win the counter for published apps compared to flathub. Congratulations!

I really don't see the use case at all for Snappy. I mean FlatPak makes sense for devs who want to "package- once, run everywhere", but Snappy is Ubuntu-only. The thing is Ubuntu through Debian is really good at having lots of up-to-date packages. Why abandon that for some crummy app store?

Re: Malware Found in the Ubuntu Snap Store

#106

Post by FRex »

scarface74 wrote: post #95
FRex wrote: post #87

Earlier quoted context omitted.

This is false equivalence. The electron app is ostensibly working for your benefit, just in a very inefficient way, not mining a currency using your resources to ship off to someone. You could argue that making users pay for savings in development by their RAM, Disk, CPU, GPU and electricity costs is also bad (and even bad for the planet) but that's a less shady business strategy for saving cost than covertly mining.…

and goes against what Joel Spolsky said about rewrite from scratch[1] Joel at one time was the product manager(?) for Excel. Microsoft also got lambasted for trying to use an internally built cross platform solution to use the same codebase for Mac Office and Windows Office back in the mid 1990s. Microsoft even decided that it was better to use native tooling for both platforms. There is a difference between "rewriti…

Why not? Is Java + Swing very heavy or something? Is NetBeans in Swing or something else? I've used NetBeans for C, C++, PHP and HTML5 on my old Core 2 Duo with 2 Gigs of RAM on Fedora during my uni years and it was fine by me. It lagged some but on that machine everything lagged and it was a full on IDE (not just a code editor) with some really nice features.

Re: Malware Found in the Ubuntu Snap Store

#107

Post by viraptor »

superkuh wrote: post #102
crispyporkbites wrote: post #62

Earlier quoted context omitted.

> Because it's just a js script, it's not much different than a banner ad except it's less intrusive Tell that to your electricity provider

The same thing can be said about JS ad analytics scripts and ads. Or sites that turn the entire webpage into a JS 'web app' when it'd work fine as HTML with static images and text.

Not the same thing. JS increases the usage a bit. Badly broken JS may use a lot of CPU - but the author still has the incentive to fix it. But mining is a completely different category - it's designed to peg your CPU at 100%, because that's what's profitable.

Re: Malware Found in the Ubuntu Snap Store

#108

Post by RayDonnelly »

userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

> I'm not really familiar with the latest trends in (bloatware?) development, but a simple game like that taking >100MB would make me suspicious

This is very much the idea of these awful (IMHO) ways of distributing software. Bundle all of your dependencies, share nothing, expose users to the risks of exploits in the libraries you've bundled (and maybe statically so no one can even figure out you have done that).

Please stop this madness.

Re: Malware Found in the Ubuntu Snap Store

#109

Post by im3w1l »

geofft wrote: post #51
ISL wrote: post #13

Earlier quoted context omitted.

I do tend to believe that the presence of a package in the Debian repositories is a limited representation of quality/review, as there is a package-maintainer and apparent community decision as to whether or not to keep it in the distro. Is that perception correct?

That perception is correct. It's limited because in practice Debian developers (being almost entirely volunteers!) don't have the resources to read and audit each line in an upstream release, so certainly intentionally obfuscated backdoors from a previously trustworthy upstream would almost certainly get through. But the type of attack in this article, with a new binary and an unwanted line of shell script to run it,…

Thanks a lot for clarifying these things. Do they do any identity verification so people can be held accountable after the fact if something shady were to be discovered?

Re: Malware Found in the Ubuntu Snap Store

#110

Post by evand »

matthewbauer wrote: post #105
alsadi wrote: post #41

Unlike flahub where either original develop or flathub admins take control Canonical's Snapcraft literally says "Get published in minutes" Any random guy would publish his malware with near no review https://dashboard.snapcraft.io/snaps/ Yes, they maybe win the counter for published apps compared to flathub. Congratulations!

I really don't see the use case at all for Snappy. I mean FlatPak makes sense for devs who want to "package- once, run everywhere", but Snappy is Ubuntu-only. The thing is Ubuntu through Debian is really good at having lots of up-to-date packages. Why abandon that for some crummy app store?

The "Users by distribution" table at the bottom of the Spotify page is worth a look: https://snapcraft.io/spotify

Snaps are not Ubuntu-only. You can find install instructions for many distros here: https://docs.snapcraft.io/core/install

Post reply on HN