Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

171–180 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#171

Post by geofft »

rando444 wrote: post #151
geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

While code reviews are helpful, can they really prevent malware? (since an app can always download and execute extra code after it's installed.)

Yes - the code review can say "This app has functionality to download and execute extra code without the user's active participation/consent, which isn't allowed."

iOS enforces this in several ways. Any executable page of code must be signed by Apple (unless your phone is jailbroken), so you simply can't ship native code outside of the App Store delivery path. Apple looks at what functions you link against and bans "private API", and functions like dlsym() that let you open arbitrary symbols from a runtime string are forbidden. Apple usually disallows things that look like they're downloading and interpreting some language at runtime (though I'm not clear on the current rules for this, and I think things like e.g. Python shells are fine as long as it's user-supplied code). The only exception is JavaScript inside a webview, and that doesn't give you any access to the system without having native code to expose things to JavaScript, and Apple can review that native code.

Debian will enforce this too, for computing-freedom reasons as opposed to platform-control reasons: it's impossible for Debian to say "yes, this is free software" if the code isn't available for Debian to audit. And it's obviously impossible for Debian to check it for malware / unwanted functionality. Applications like Firefox or pip can download and install code at the user's request, but applications that automatically download part of their core functionality cannot go into Debian without being patched to allow Debian to compile and ship those parts as part of the package.

Re: Malware Found in the Ubuntu Snap Store

#172

Post by bowlich »

the_common_man wrote: post #6

This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.

Don't run random Docker or Vagrant Boxes seems to be something that isn't really emphasized by the providers of these services.

I ran into this realization the other day. I wanted to give Mint a try. I run over to Vagrant's site which prominently displays a "Discover Boxes" link. But gives zero indication from the main site that these Boxes are not provided by any kind of official maintainer or Hashicorp itself but are community uploads I suppose... at least I can't find any vetted information about who the uploader's are and why I should trust them.

This should be a big read flag in the quick start guide that screams: Don't just download any old box from our site and then load it up with all your customer data and put it into production. Instead it's buried deep in the documentation: https://www.vagrantup.com/docs/vagrant-cloud/boxes/catalog.h...

Re: Malware Found in the Ubuntu Snap Store

#173

Post by atomicnumber1 »

pierrec wrote: post #155
matthewbauer wrote: post #91

Earlier quoted context omitted.

Be warned that malware like this is in the AUR all the time. It's so common it's not even newsworthy. They are usually pretty good at handling it though.

I've never heard of this happening and I can't find a single occurrence of it. I mean, I agree with "don't blindly trust everything in the AUR", but this seems wrong.

Also, the aur community seems to be very active.

Re: Malware Found in the Ubuntu Snap Store

#174

Post by Sylos »

subway wrote: post #56
solomatov wrote: post #36

Earlier quoted context omitted.

Why not run random docker images? As far as I understand, docker container are pretty solid. Not super solid but solid enough.

Those random docker images are rarely used in isolation. They typically handle your data and often your customers data. Beyond that, numerous escape exploits in linux containerization (and docker specifically) have popped up over the years, and many more are going to pop up over the coming years. This is not a mature space. Running random binary code distributed from an non-curated source, even in a "container" is go…

> Those random docker images are rarely used in isolation. They typically handle your data and often your customers data.

Thank you. This is something that I truly hate Google for. They constantly spread this mentality that isolation = nothing bad can ever happen to your data. And then they build a horrible permission system on top of that idea and leave everything else up to the user.

And as a result, the Google Play Store and Chrome Store are the most malware-filled app stores that I'm aware of.

Despite that, you still had people giving Firefox shit for not isolating add-ons, which however were thoroughly reviewed and as a result quite clearly less often subject to malicious intents.

And then something like the Web of Trust fiasco, where the add-on as a feature sends your browsing history out to the internet and then bad things happen there (the WoT devs sold the browsing data in an anonymized form that was shown to be deanonymizable rather easily), against that neither isolation nor a review can help, so we shouldn't act like any security technique is perfect. We still need users to think for themselves, even if that's bad for Google's business model.

Re: Malware Found in the Ubuntu Snap Store

#176

Post by nkkollaw »

I've had bad experiences with Snap.

I understand that with Snap devs have to bundle their own dependencies and take care of upgrading, which is bad if I understood correctly.

In my case, a few programs I had installed needed to be connected to other snaps, and they would suddenly stop working for no apparent reason. Only by trying to launch the misbehaving program from the command line I'd find out I had to update the connected program(s).

Has never happened to me with Apt, so my opinion so far is that installing .deb files is vastly superior, at the moment.

Re: Malware Found in the Ubuntu Snap Store

#177

Post by hsivonen »

hsivonen wrote: post #175

How does one figure out who a given snapcraft packager is? E.g. Sublime Text says it's packaged by Snapcrafters. Who is that?

Presumably it's https://github.com/snapcrafters , but what links the Snap Store identity to that GitHub org?

Where does snapcraft.yaml get executed? On my computer? On Canonical's infra? On the packager's computer?

Re: Malware Found in the Ubuntu Snap Store

#178

Post by michaelmrose »

eat_veggies wrote: post #24
geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

I like Arch's package management model, where sources are split into the official repositories, which are manually approved, and the AUR, which everyone knows are not officially endorsed or reviewed, and to check the sources and PKGBUILDS for anything sketchy before installing. The processes for installing from the two are also different enough that the user can't mistake one for the other: official packages are a pa…

A pop up of the pkgbuild is almost worthless. It would require the user to personally examine at the very least the source the pkgbuild is pulling from and the pkgbuild script itself and be able to spot malfeasance including subtle attempts.

Since doing otherwise is a few clicks away and sufficiently subtle attempts are unlikely to be noticed by even observant parties this is about as bad as the windows hunt down an exe model which has been proven for decades NOT TO WORK.

The AUR isn't filled with malware because arch is a very small target compared to windows full of observant people.

It cannot possibly scale even to the levels ubuntu aspires to achieve.

Re: Malware Found in the Ubuntu Snap Store

#179

Post by hsivonen »

The risk here is not just going to the Snap Store. At least right now on Ubuntu 18.04 if you type a command that's not installed but is provided by a Snap app, the shell suggests that you install the snap the way it suggested an apt command previously.

Re: Malware Found in the Ubuntu Snap Store

#180

Post by michaelmrose »

matthewbauer wrote: post #91
dtx1 wrote: post #75

Earlier quoted context omitted.

Well as a lazy arch user i installed pacaur and just use official and AUR sources without much checking. It's just convenient that there's an AUR for everything

Be warned that malware like this is in the AUR all the time. It's so common it's not even newsworthy. They are usually pretty good at handling it though.

citation needed
Post reply on HN