Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

191–200 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#191

Post by vbernat »

mikedelfino wrote: post #80
solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

Doesn't Xauthority solve this? I thought we could use xauth to generate an unprivileged cookie and launch the program using it. Then it could not meddle with other X clients or even the clipboard. Of course you should also prevent the program from reading the original privileged Xauthority data. Running it as a different user does the trick.

Xauthority isn't fine-grained. Once you get a cookie, you haven't any restriction to what you can do with the X server.

Re: Malware Found in the Ubuntu Snap Store

#192

Post by Sylos »

sleavey wrote: post #72

As someone who hasn't yet used Ubuntu 18.04, is the snap store something I'll be using in 5 years time instead of APT, is it just another attempt by Canonical to jump on the app store bandwagon, or is it something completely different? Excuse my ignorance but I'm intensely suspicious of "stores" on open source operating systems.

You might be using it instead of APT for some things, but it won't replace APT.

Say you want the newest version of LibreOffice for whatever reason. This is a typical use-case where Snaps will come in handy. They have most dependencies bundled into the application, so you don't have to worry about your whole system getting wonky by installing newer versions of those dependencies to go with the newer version of the application.

This is also meant to serve as a way for devs to release software without much hassle. So, they don't have to open-source their code, hope that someone finds it, packages it for Ubuntu and in like five years time is available to end-users through the repositories.

They also don't have to worry about building a .deb, .rpm, Arch's format and whatever else there is, including accounting for the differences between distros. So, Snaps are supposed to work on all distros the same.

Ultimately, this will bring in more proprietary applications.

Well, and Snaps are sandboxed, so there's some protection, which makes those proprietary applications somewhat more acceptable, but as this piece of news shows, it's not complete protection.

Is it another attempt of Canonical to jump on the app store bandwagon? Most definitely yes. There's a competing format, Flatpak, which does pretty much the same, also AppImage which is somewhat older and without sandboxing, and Canonical is mainly just pushing their own format, because they'll have control of the store behind it.

Like, it's not impossible to hook up other Snap stores, but Canonical has established their infrastructure as the primary source and then how many users are going to look elsewhere?

Re: Malware Found in the Ubuntu Snap Store

#193

Post by popey »

hsivonen wrote: post #177
hsivonen wrote: post #175

How does one figure out who a given snapcraft packager is? E.g. Sublime Text says it's packaged by Snapcrafters. Who is that?

Presumably it's https://github.com/snapcrafters , but what links the Snap Store identity to that GitHub org? Where does snapcraft.yaml get executed? On my computer? On Canonical's infra? On the packager's computer?

The build service at build.snapcraft.io is what builds it. Anyone can hook up their github repo (containing a snapcraft.yaml) to build and have to automatically rebuild the snap when changes in the git repo occur. It then pushes the snap to the 'edge' channel in the store. Developer validates that build and then pushes to stable for all users.

Re: Malware Found in the Ubuntu Snap Store

#194

Post by gitgud »

btashton wrote: post #16
solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

The issues with X11 you mention is part of what Wayland tries to fix. And why early on seemingly benign things like screenshot tools broke.

Wow that explains why "Shutter" (screenshot tool) doesn't work with wayland!!

Re: Malware Found in the Ubuntu Snap Store

#195

Post by the_why_of_y »

michaelmrose wrote: post #182
solomatov wrote: post #8

The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…

I think securing X would reasonably be viewed as a non starter for those who intend to replace X with wayland.

In the sense that Wayland is what the X.org maintainers came up with as the solution to X11's security design flaws. (There was a previous attempt in XACE, which essentially extended SELinux's security model into the X server, but somehow that never caught on.)

Re: Malware Found in the Ubuntu Snap Store

#196

Post by the_why_of_y »

viraptor wrote: post #107
superkuh wrote: post #102

Earlier quoted context omitted.

The same thing can be said about JS ad analytics scripts and ads. Or sites that turn the entire webpage into a JS 'web app' when it'd work fine as HTML with static images and text.

Not the same thing. JS increases the usage a bit. Badly broken JS may use a lot of CPU - but the author still has the incentive to fix it. But mining is a completely different category - it's designed to peg your CPU at 100%, because that's what's profitable.

And what's worse, for every dollar you spend on electricity for CPU-mining, you (or, in this case, someone else) receive 5 cents worth of cryptocurrency.

Re: Malware Found in the Ubuntu Snap Store

#197

Post by jakobegger »

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

I think a big difference between Github and package managers is that on Github everything is prefixed with a user name. It takes two clicks to find out who made jakob/TableTool. It’s obvious that the author is a random dude on the internet.

But the brew cask package “table-tool”? That sure sounds official!

Re: Malware Found in the Ubuntu Snap Store

#198

Post by hsivonen »

popey wrote: post #193
hsivonen wrote: post #177

Earlier quoted context omitted.

Presumably it's https://github.com/snapcrafters , but what links the Snap Store identity to that GitHub org? Where does snapcraft.yaml get executed? On my computer? On Canonical's infra? On the packager's computer?

The build service at build.snapcraft.io is what builds it. Anyone can hook up their github repo (containing a snapcraft.yaml) to build and have to automatically rebuild the snap when changes in the git repo occur. It then pushes the snap to the 'edge' channel in the store. Developer validates that build and then pushes to stable for all users.

Thank you.

As a user, how (other than asking here) was I supposed to convince myself of the identity binding between “snapcrafters” and the GitHub org and to convince myself that trust in the correspondence between snapcraft.yaml and what I get when I install a snap is rooted in Canonical’s build service and not in trusting an individual uploader not injecting different binaries?

Re: Malware Found in the Ubuntu Snap Store

#199

Post by irundebian »

michaelmrose wrote: post #183
64kbisalluneed wrote: post #144

Earlier quoted context omitted.

Sorry, missplaced my answer. It was regarding the guy above yours concerning apps in general can create havoc to a system. I mean that using containers like lxc can create a sandbox.

Containers under linux aren't in themselves very secure at all. This isn't inherently so. Supposedly solaris can do much better for example.

What security guarantees cannot be hold by container technologies such as LXC, cgroups, namespaces and docker?

Re: Malware Found in the Ubuntu Snap Store

#200

Post by irundebian »

wopian wrote: post #71
crispyporkbites wrote: post #62

Earlier quoted context omitted.

> Because it's just a js script, it's not much different than a banner ad except it's less intrusive Tell that to your electricity provider

Or to your laptop/mobile battery lives...

I wonder if it makes sense to implement resource controls for websites so that users can define how many CPU cycles are allowed at the maximum which give web developers incentives to write less resource-hungry web apps.
Post reply on HN