Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free Download Manager backdoored – a possible supply chain attack on Linux

securelist.com

Post reply on HN
Print view View original

31–40 of 143 posts

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#31

Post by sudobash1 »

sva_ wrote: post #28
acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

This is more like using AUR (except the packages are prebuilt with no way to inspect source). They are entirely user submitted.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#32

Post by acatton »

sva_ wrote: post #28
acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

Yes, they are signed, but not with the official key. If you add it through the UI, it will auto-accept the key from the repository. (I'm not sure how it exactly works, it might ask the user for the confirmation)

If you do it from the command line, by editing files, you will have to add the key manually.

But most inexperienced users will just copy/paste and run the "curl | sudo apt-key add" command from the shady repository website, because they want to run the software.

This is not much different from downloading an .exe from an untrusted website, and ignoring the warning from windows when running the .exe.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#33

Post by [deleted] »

sva_ wrote: post #28
acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

[deleted]

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#34

Post by acatton »

sudobash1 wrote: post #31
sva_ wrote: post #28

Earlier quoted context omitted.

> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

This is more like using AUR (except the packages are prebuilt with no way to inspect source). They are entirely user submitted.

No. This is not AUR, this is an entire third party repository. It would be the equivalent of these https://wiki.archlinux.org/title/Unofficial_user_repositorie...

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#35

Post by acatton »

throwaway71271 wrote: post #29
acatton wrote: post #26

Earlier quoted context omitted.

I disagree. This is more another reason to not run programs which are not from the official repository.

why do you think this can not happen in the official repository?

Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository.

Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580 )

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#36

Post by Gigachad »

yjftsjthsd-h wrote: post #21
fortran77 wrote: post #7

But I thought there were no viruses or malware on Linux! For example: https://www.howtogeek.com/135392/htg-explains-why-you-dont-n...

Look, if the malware spreads by users manually installing it , 1. it's not really an OS problem, 2. an AV wasn't going to save them.

That's how almost all malware was installed though. Linux really isn't any more resistant to malware than anything else.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#39

Post by baz00 »

acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done.

Worst is I've seen CD/CI systems which just pull unsigned unverified binaries off the internet and build software from github, random APT and YUM repos, all sorts of shit. This is then all thrown together and pushed into production systems.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#40

Post by wfurney »

acatton wrote: post #35
throwaway71271 wrote: post #29

Earlier quoted context omitted.

why do you think this can not happen in the official repository?

Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…

Nice classic email spam at the end of that thread!

> "All we require from you is your willingness and ability to receive the funds in question"

Post reply on HN