Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Arch Linux AUR Repository Found to Contain Malware

sensorstechforum.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: Arch Linux AUR Repository Found to Contain Malware

#41

Post by xiii1408 »

ploxiln wrote: post #33
21 wrote: post #13

Earlier quoted context omitted.

Because there is this myth that only Windows users get infected because Windows is insecure, that packages are vetted, that code being open source means that a backdoor insertion would quickly be discovered, and so on.

Packages are vetted, in the repos, just not in AUR. They also keep tools that would easily/automatically build and install packages from AUR out of the main repos, to encourage manual handling and individual consideration of AUR package build scripts. Also this malware was found in AUR within a few hours of it going up.

Exactly. It's actually kind of a success story for the AUR, since they found the malware so quickly.

Of course, it would be more interesting if we could scan or survey the AUR to get a percentage of suspicious packages. I've long been under the impression that some popular AUR packages (e.g. Google Chrome) are pretty safe from tampering. For anything else, I glance over the PKGBUILD to make sure it's not doing anything obviously fishy, and I've never noticed anything.

Re: Arch Linux AUR Repository Found to Contain Malware

#42

Post by xiii1408 »

Aardwolf wrote: post #32

Unfortunately lots of things one actually wants are on AUR, things like jpeginfo, golly, steam-fonts, simple-mtpfs, jslint, ... A case for putting more things in the main Archlinux repositories!

My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.

Re: Arch Linux AUR Repository Found to Contain Malware

#43

Post by trash_panda »

cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place.

Anyways, I know I don't manually review everything I install on my system, I trust the packet manager.

I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?

Re: Arch Linux AUR Repository Found to Contain Malware

#44

Post by xiii1408 »

LukeShu wrote: post #15
chimeracoder wrote: post #2

The Arch User Repository hosts whatever people want to upload to it, with basically no proactive vetting whatsoever. In addition, the installation scripts run arbitrary code, a portion of which must run with root privileges. When a package gets orphaned, that means that anybody in the community can take over maintainership of the package. There's a whole lot of trust that has to go on when installing a package from t…

> yes, this is a fundamental problem with the security model of Arch Linux No, it's not. AUR is not Arch, and is not "supported" by Arch. It's a fundamental problem with the security model running code from randos on the internet. If someone published a git repo on GitHub that installed malware when you ran git clone git://github.com/user/repo . && ./configure && make && sudo make install you wouldn't be saying that…

AUR PKGBUILDs are much more restricted than this, since they're restricted to a fakeroot.

Of course, if you're ultimately going to run the program, the binary set up by the PKGBUILD has a lot of control. But the PKGBUILD itself is limited in what it can do (to things like listing your installed packages, getting `uname -a`--the stuff mentioned in the article).

Re: Arch Linux AUR Repository Found to Contain Malware

#45

Post by hultner »

walrus01 wrote: post #27
farresito wrote: post #9

Earlier quoted context omitted.

Who would want to use a rolling release distribution for a (production) server? Sounds like a pretty terrible choice, to be quite honest.

Nobody that values their job or sleeping well at night. It's basically one level of nuts above and beyond running Debian Sid on all your production servers.

I ran SID in a embedded customer box testing unreleased software, I did run it in KVM from a stable release since I wouldn’t have physical access if something went wrong, glad I did.

Re: Arch Linux AUR Repository Found to Contain Malware

#46

Post by dozzie »

JackCh wrote: post #38
dozzie wrote: post #34

Earlier quoted context omitted.

Oh yes, it is a problem with the users, not the software itself, but you don't get to separate the two in the case of an OS or distribution.

> "but you don't get to separate the two in the case of an OS or distribution." Actually I do get to do that. It's an important distinction because if the software isn't at fault, then a technically competent user can safely use it by merely not being as dumb as the average user. But if the software itself is at fault, then the technically competent user should stay clear of it. Idiots will be idiots no matter the di…

> It's an important distinction because if the software isn't at fault, [...]

Though the software is at fault. It created a false sense of security, misleading the users. What else in Arch just feels secure, but in fact is not?

And then, if the users around the software generally exhibit a jockey attitude, you get the whole environment built in a similar manner, not a robust one. The software may technically not be at fault and technically could be used in a safe manner, but you won't get much exposure to that, any such use will be cumbersome and difficult (because nobody uses it this way), so you still should stay clear of the software. So no, you don't get to separate the users and the OS/distribution.

Re: Arch Linux AUR Repository Found to Contain Malware

#47

Post by xiii1408 »

trash_panda wrote: post #43
cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place. Anyways, I know I don't manually review everything I install on my system, I trust the packet manager. I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?

No, AUR packages are PKGBUILD files, which are essentially little batch scripts that run inside a fakeroot.

IMHO, the danger of a PKGBUILD itself doing something nasty is small--it would be limited to things like recording `uname -a`, listing all your installed packages: the things mentioned in the article.

The real danger is that the PKGBUILD is installing some software, which you will later run with full user privileges. If you don't notice that the Git repo listed in the PKGBUILD file is wrong, you won't notice that you're actually installing a backdoored version of the package.

Re: Arch Linux AUR Repository Found to Contain Malware

#48

Post by vertex-four »

trash_panda wrote: post #43
cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place. Anyways, I know I don't manually review everything I install on my system, I trust the packet manager. I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?

The AUR repo is, basically, a free for all. It’s not the official repository, which is trustworthy - it’s just a hosting space for user-provided build instructions.

Re: Arch Linux AUR Repository Found to Contain Malware

#49

Post by arendtio »

xiii1408 wrote: post #42
Aardwolf wrote: post #32

Unfortunately lots of things one actually wants are on AUR, things like jpeginfo, golly, steam-fonts, simple-mtpfs, jslint, ... A case for putting more things in the main Archlinux repositories!

My understanding is some things (e.g. Google Chrome, Google and Microsoft fonts) can't be put in the main Arch Linux repos for copyright reasons.

I wonder how other distributions solve that situation.

Re: Arch Linux AUR Repository Found to Contain Malware

#50

Post by chias »

trash_panda wrote: post #43
cmiles74 wrote: post #4

From the article: "This is yet another incident that showcases that Linux users should not explicitly trust user-controlled repositories." LOL. Why should this only apply to Linux users? We should all be wary of downloading random things from websites. AUR has always been labeled "user submitted", but I guess it's easy to forget that some "users" are really out to cause harm.

Of course, one should be careful about what one installs on their system. Even more so an Arch user, which should be technical saavy in the first place. Anyways, I know I don't manually review everything I install on my system, I trust the packet manager. I'm not an Arch user so I don't know, but doest the AUR repo have some kind of code signing or automatic analysis of the packages?

AUR is not an "official" repository at all -- indeed the acronym stands for "Arch User Repository". Kinda like github, you can go put whatever you want in there, and people can download and install it on their machines if they want to.

The "correct" way to install something from AUR is to go grab the install script, READ THROUGH IT CAREFULLY, then knowing that you just downloaded a thing uploaded by someone unafilliated with Arch, you make your decision on whether or not to run/install it. That said, there are (non-official) package managers that you can use which give you a package-manager-like experience installing packages from AUR and do a pretty good job of sweeping all of that under the rug. Convenient? yes; a good idea? it's your system, you decide (my opinion is 'no').

Post reply on HN