Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EvilGnome: Rare Malware Spying on Linux Desktop Users

intezer.com

Post reply on HN
Print view View original

31–40 of 51 posts

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#31

Post by simion314 »

emerongi wrote: post #25
simion314 wrote: post #18

This incident made me think that the hackers planned to hijack some popular extension. this would make the more damage. My (unpopular) opinion is that GNOME should see what are the most used extensions, accept that people want those feature and bring those features into GNOME or make those official extension and not third party, so you at least control what most people would install.

GNOME has been nuking features for a while, recommending people to go and install extensions. Extensions work by monkey-patching and once you have a critical mass of them, you're guaranteed to run into some glitches where one monkey-patch messes up the other. I like the KDE approach more where features are actually baked into the DE. It's much easier to reproduce bugs and fix bugs that can depend on different feature…

I agree with you, but if the GNOME devs can't change their "vision" the next best thing is to adopt the popular extensions the downstream distribution use and bring them in the main repository, at least you reduce the risks and maybe keep the extensions more updated.

I am a KDE user and to be fair during KDE4 days ,Plasma had a maintainer with big ego that had a similar mentality with GNOME devs, we could not get a patch merged in to hide the Cachew thingy. Makes me wonder if all this GNOME vision of removing non default options is just one guy with big ego and lot of influence

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#32

Post by Crinus »

tjoff wrote: post #13
Crinus wrote: post #8

Note that this requires for a user to actually download and run this malware, it doesn't randomly get into someone's computer by itself: > This implant is delivered in the form of a self-extracting archive shell script created with makeself

Most malware is. The question becomes how good they are at tricking people to install it.

I'd expect very little success, most people on Linux download software from repositories or other trustworthy places (e.g. Steam).

Though some people do tend to install stuff via "curl | sudo bash"... but i think this malware is the least of their concerns :-P

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#33

Post by dd2 »

pmlnr wrote: post #7

The more uniform linux (and linux desktop) becomes the more easier and more valuable target it becomes as well. Systemd, GNOME3, DBUS - they are essentially omnipresent on "modern" linuxes these days. The questionable safety that was provided by snowflake installs is evaporating fast.

> The more uniform linux (and linux desktop) becomes the more easier and more valuable target it becomes as well

This is an oversimplification. There is a sweet spot for security between monoculture and excessive fragmentation.

Most lesser-famous Linux distributions struggle to provide extensive and timely security updates (or provides no security fixes at all by doing only "rolling" releases that track upstream).

To provide security a skilled security team, as well as a large enough userbase is needed.

Linux Desktops are not very common, which leads to wonder if more uniformity can be a good thing.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#34

Post by Crinus »

ga-vu wrote: post #23

So, basically, disable Gnome extensions and you're fine.

No, do not download and run random stuff from shady places and you're fine. This relies on you explicitly downloading and running a self-extracting shell script, it doesn't get installed by itself.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#35

Post by tjoff »

Crinus wrote: post #32
tjoff wrote: post #13

Earlier quoted context omitted.

Most malware is. The question becomes how good they are at tricking people to install it.

I'd expect very little success, most people on Linux download software from repositories or other trustworthy places (e.g. Steam). Though some people do tend to install stuff via "curl | sudo bash"... but i think this malware is the least of their concerns :-P

With npm, pip and random github repositories used for plugins in various applications I tend to disagree. It's not like it is uncommon with third-party additions to package managers such as apt either.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#36

Post by emidln »

Crinus wrote: post #34
ga-vu wrote: post #23

So, basically, disable Gnome extensions and you're fine.

No, do not download and run random stuff from shady places and you're fine. This relies on you explicitly downloading and running a self-extracting shell script, it doesn't get installed by itself.

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, not an exploit itself.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#37

Post by Crinus »

tjoff wrote: post #35
Crinus wrote: post #32

Earlier quoted context omitted.

I'd expect very little success, most people on Linux download software from repositories or other trustworthy places (e.g. Steam). Though some people do tend to install stuff via "curl | sudo bash"... but i think this malware is the least of their concerns :-P

With npm, pip and random github repositories used for plugins in various applications I tend to disagree. It's not like it is uncommon with third-party additions to package managers such as apt either.

I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to download, the harder it becomes to judge things.

For example i'd trust an apt repository or pip package developed by -say- Blender developers, regardless of it being a 3rd party repository or delivered through pip.

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#38

Post by Crinus »

dd2 wrote: post #33
pmlnr wrote: post #7

The more uniform linux (and linux desktop) becomes the more easier and more valuable target it becomes as well. Systemd, GNOME3, DBUS - they are essentially omnipresent on "modern" linuxes these days. The questionable safety that was provided by snowflake installs is evaporating fast.

> The more uniform linux (and linux desktop) becomes the more easier and more valuable target it becomes as well This is an oversimplification. There is a sweet spot for security between monoculture and excessive fragmentation. Most lesser-famous Linux distributions struggle to provide extensive and timely security updates (or provides no security fixes at all by doing only "rolling" releases that track upstream). To…

Wouldn't uniformity be a bad thing for less common Linux distributions since whatever targets the famous distros would also work with the less common distros but while the former have the big userbase and skilled security team, the latter will be left exposed? And in turn create a vicious circle where the less common distros will be used even less and the more common distros even more, thus creating a monoculture that despite being open source gives control to a few organizations and/or individuals?

(of course this issue with uniformity can also happen outside of security reasons - e.g. if all distros provide more or less the same experience then why bother with a small distro?)

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#39

Post by Crinus »

emidln wrote: post #36
Crinus wrote: post #34

Earlier quoted context omitted.

No, do not download and run random stuff from shady places and you're fine. This relies on you explicitly downloading and running a self-extracting shell script, it doesn't get installed by itself.

Who is to say that future versions of this won't be paired with some arbitrary browser/email-based RCE. This is the persistent threat, a payload if you will, not an exploit itself.

If someone can force download and install an application through browser/email then the issue isn't with the application being downloaded and installed but whatever allowed the application to be forcefully downloaded and installed (that is, your browser/email client).

Re: EvilGnome: Rare Malware Spying on Linux Desktop Users

#40

Post by tjoff »

Crinus wrote: post #37
tjoff wrote: post #35

Earlier quoted context omitted.

With npm, pip and random github repositories used for plugins in various applications I tend to disagree. It's not like it is uncommon with third-party additions to package managers such as apt either.

I do not consider all 3rd party places as untrusted (this sort of thinking leads to walled gardens) and i'd put these under "downloading from trustworthy places" in the sense that they are more of a way to download something and less a source themselves (e.g. you can download a pip package from both a trustworthy developer and untrusted developer). Of course the more layers between you and whatever you want to downlo…

Neither do I. But even if I download a pip package from blender and it depends on 14-third party packages - how on earth am I able to assess the risk/trust of that?

I most certainly trust that there is no ill intent from them and that it didn't raise any flags during testing. But even if I believe they have the resources to audit everything I might be getting a newer and infected version.

And even if my trust of a programmer/entity is rock-solid it is hard to guard against their account being compromised, that is all it takes for most 3rd party sources.

Post reply on HN