Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

181–190 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#181

Post by michaelmrose »

ChristianBundy wrote: post #93
AsyncAwait wrote: post #77

Earlier quoted context omitted.

For packages with many votes this is somewhat fine, but you should still skim the PKGBUILD as the maintainers of even popular packages may change in time.

I'd recommend checking both PKGBUILD and clicking "View Changes" to see who (and what) the last few authors have been up to. It's relatively common for people to be added as co-maintainers after posting even just one helpful comment (!) in an unpopular package, so it's worth double-checking to make sure a big change hasn't been made recently without the author's permission.

If this is your means to secure your system you may be in for a rude awakening.

Re: Malware Found in the Ubuntu Snap Store

#182

Post by michaelmrose »

solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

I think securing X would reasonably be viewed as a non starter for those who intend to replace X with wayland.

Re: Malware Found in the Ubuntu Snap Store

#183

Post by michaelmrose »

64kbisalluneed wrote: post #144
faho wrote: post #142

Earlier quoted context omitted.

And the explanation for that word? It's still nothing to do with X, and it's not certain that it would plug the "hole" that is being used here. This "exploit" requires unfettered (or at least not completely throttled) access to the CPU and a way to send the spoils home via the network. Would this actually be stopped with "lxc"? I doubt it'd do much to curb the CPU abuse, and network access is something games frequent…

Sorry, missplaced my answer. It was regarding the guy above yours concerning apps in general can create havoc to a system. I mean that using containers like lxc can create a sandbox.

Containers under linux aren't in themselves very secure at all. This isn't inherently so. Supposedly solaris can do much better for example.

Re: Malware Found in the Ubuntu Snap Store

#184

Post by michaelmrose »

fjsolwmv wrote: post #92
scarface74 wrote: post #55

Earlier quoted context omitted.

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

If you log into Facebook on web, then visit any other site, they send your browsing info to Facebook via Like button. The Facebook app is more sandboxed, since it can't snoop on your web browsing.

The facebook app for quite a while was actually sending facebook data about your phone calls and sms so guess again.

Re: Malware Found in the Ubuntu Snap Store

#185

Post by pritambaral »

cookiecaper wrote: post #154
zootboy wrote: post #35

Earlier quoted context omitted.

Also, compare the wording on the snap store: > Safe to run - Not only are snaps kept separate, their data is kept separate too. Snaps communicate with each other only in ways that you approve. Versus the AUR: > DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

The difference being that Snaps always run in a semi-encapsulated environment (a container), whereas the AUR just executes in whatever security context you're issuing commands from. PKGBUILDs are arbitrary shell scripts and they can do anything that the user executing them can do. I'm not trying to defend the perception that Snaps are immune from malware, but there is a real difference in the default safety of a pack…

> Snaps always run in a semi-encapsulated environment (a container)

Even with the `--classic` switch?

Re: Malware Found in the Ubuntu Snap Store

#186

Post by michaelmrose »

userbinator wrote: post #22

used a proprietary license Does the license actually mention it mines? I am reminded of a lot of "freemium"/"ad-supported"/etc. software that makes its author money via ads or whatever else --- and you agree to that if you read the license --- and it is a bit shady to name the miner 'systemd', but it seems rather overboard to call this "malware"... when I see that term I think of software that self-propagates and exf…

Mining in the background is worse than ads because it will be silently ruining the battery life of your laptop or silently running up your electric bill on your desktop.

Note that at 12c per kilowatt hour 200W of extra draw on a machine that's always running is 2.4c per hour.

Over the expected 5 year lifespan of a machine this could cost you $880 in the EU this would be more like $1980 because electricity is on average more expensive there.

Stealing up to 2K from users isn't much more friendly that cryptolockers.

Re: Malware Found in the Ubuntu Snap Store

#187

Post by pjmlp »

icebraining wrote: post #26
solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

On Windows, the equivalent to the X problem was called a Shatter attack: https://en.wikipedia.org/wiki/Shatter_attack Vista and subsequent reduced the problem by introduce levels, so that lower-privileged applications can't interact with higher-privileged, but as far as I know they can still interact with applications at the same level.

That was fixed on Windows 8 and later with all store improvements.

And Microsoft is still quite confident that eventually Win32 will join Win16, even if it takes considerably longer that they were initially willing to wait for.

Re: Malware Found in the Ubuntu Snap Store

#188

Post by beojan »

cookiecaper wrote: post #154
zootboy wrote: post #35

Earlier quoted context omitted.

Also, compare the wording on the snap store: > Safe to run - Not only are snaps kept separate, their data is kept separate too. Snaps communicate with each other only in ways that you approve. Versus the AUR: > DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

The difference being that Snaps always run in a semi-encapsulated environment (a container), whereas the AUR just executes in whatever security context you're issuing commands from. PKGBUILDs are arbitrary shell scripts and they can do anything that the user executing them can do. I'm not trying to defend the perception that Snaps are immune from malware, but there is a real difference in the default safety of a pack…

If the application is trustworthy, it doesn't matter. If not, you should think twice about running it even in a container.

Re: Malware Found in the Ubuntu Snap Store

#189

Post by ezoe »

Ubuntu 18.04 is horrible on this.

The default GUI package manager, "Ubuntu Software" shows up snap packages just like ordinary packages. It was uploaded by somebody who is not bright at the domain and badly configured for locale. It can only handle ASCII characters. Probably reviewed by nobody.

Re: Malware Found in the Ubuntu Snap Store

#190

Post by dschuetz »

Snaps was initially tooted as the bestest securest container based application solution by Canonical back then. It is impossible for the app the steal your data, they said. Because of "secure encapsulation" and such. So, that means that there is no need for a review process for uploads, just to make installing packages even more easier than it already is?

I'm sorry, Canonical and Ubuntu are the point were Open Source Software apparently breaks with its traditions. No review on binary blobs uploads most certainly made with OSS when marked "proprietary"? They are kidding, right?

Post reply on HN