Live data from Hacker News

Free Download Manager backdoored – a possible supply chain attack on Linux

securelist.com

11–20 of 143 posts

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#11
post #4
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

I'm trying to imagine the kind of user that's both able to blindly install a random .deb downloaded from a website, while also being willing to do so. Linux geeks with no sense of danger on the internet?

not too terribly different from `sudo (curl | bash)`

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#12
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

People who are still on dialup modems or very slow wireless ISPs with flaky connections. High Speed Internet is not universal even today, despite what web developers seem to think. Ever try to surf raw Facebook on a 128kbps wireless link? It's not fun. Cloud services are a joke for these people.

Hacker News is one of the last holdouts in the low bandwidth friendly website game.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#13
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

Happy FileZilla user here, on my FreeBSD laptop. I move tons of files from remote astronomical observatory routinely, sometimes need to define custom rules - what to download, upload, filter across folders, etc. Sometimes I need to push a file from very low data-rate link from somewhere in the middle of nowhere to the observatory, sometimes over a satellite link. Sometimes I want a throttled download of a large queue so I won't overload my connection and leave some bandwidth to other users. Also, I have a directory of different FTP servers I work with, it's easy to keep them in one place. So, there you have it.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#14
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

Similar software is used in some products. For example, synology DSM has a package called download station. Who knows if it’s based on some obscure .deb (or scripts such as youtube-dl).

It could give rise to a supply chain attack.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#18
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

Download managers are more important on high speed links than ever.

The more bandwidth you have (and use), the less adequate the little "downloads" pane in your browser is.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#19
Why would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager?

This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you downloaded a random .exe and ran it on Windows with admin access.

Its not a supply chain attack, its a PEBKAC attack.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#20
post #2

Who uses a download manager in the days of high speed internet access and, in general, cloud services?

People who are still on dialup modems or very slow wireless ISPs with flaky connections. High Speed Internet is not universal even today, despite what web developers seem to think. Ever try to surf raw Facebook on a 128kbps wireless link? It's not fun. Cloud services are a joke for these people. Hacker News is one of the last holdouts in the low bandwidth friendly website game.

A decade ago, I remember buying 500MB or 1GB of mobile internet credit and burning through that in an evening just reading news and stuff. Today, with uBlock Origin and NoScript, I can buy the same amount of mobile internet and it lasts me quite a while. I therefore concluded that, while website bloat does exist, what really consumes bandwidth is advertising, and that can be avoided. Moreover, a decade ago lazy loading of images was not common, but now the respective CSS tag exists, is supported by browsers, and widely implemented by CMSs like Wordpress.
Post reply on HN