If you intentionally install something called Free Download Manager, you should not be surprised when it turns out to be malware.
Yeah who would ever trust a free BSD?
Free Download Manager backdoored – a possible supply chain attack on Linux
41–50 of 143 posts
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#42This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…
Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…
It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2]
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#43Who uses a download manager in the days of high speed internet access and, in general, cloud services?
They can be very useful for:
- bypassing antiquated per connection throttles on otherwise fast servers by downloading chunks in parallel
- downloading files such as videos from sites that don't really want you to download the file
I have never heard of the program in the article, but this one still sees many active users on windows for the above reasons: https://jdownloader.org/
There's even a little community still making and maintaining plugins for extracting files from uncooperative websites. Really does feel like the kind of program you only ever want to be running in a sandbox though!
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#44Earlier quoted context omitted.
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
Nice classic email spam at the end of that thread! > "All we require from you is your willingness and ability to receive the funds in question"
You can report the spam by clicking on the link at the very bottom (or just going to https://bugs-master.debian.org/cgi-bin/bugspam.cgi?bug=79258... and confirming).
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#45Earlier quoted context omitted.
why do you think this can not happen in the official repository?
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
the list of contributors is huge, you just need to hack one person https://contributors.debian.org/
not to mention libraries like libxslt that is used by like half the packages
even kernel.org was hacked, and git saved us, and luckily it was before the sha1 collision attacks were viable
https://www.reddit.com/r/linux/comments/k0mco/kernelorg_comp... https://crypto.stackexchange.com/questions/99767/how-easy-is...
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#46Earlier quoted context omitted.
why do you think this can not happen in the official repository?
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
But Debian packagers aren't always super careful. They generally don't audit the full changeset between each version they package and publish. They mostly trust that upstream has not been compromised and continues to be trustworthy.
I'm not trying to minimize all the hard work Debian (or any other distro) packagers do, but "only use official repositories" is not sufficient as a malware-avoidance strategy. Yes, it's better than installing random binaries from random websites, but let's not give ourselves a false sense of security.
The suggestion upthread to run everything in a sandbox is a good one. I wish that was more common and that there was a better UX when doing so.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#47I see free. I download!
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#48Why would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager? This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you…
From their website[1]:
> FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files!
No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#49Why would you use a "Free Download Manager" when wget is right there? Or a web browser, such as Firefox? Or torrent clients to deal with large Linux ISO downloads? Or the various storefronts, like Steam? Or your own distro's package manager? This wasn't packaged on any distro, so this isn't even a meaningful attack: Users had to go out of their way to install it from a foreign source. This is no different than if you…
From their website[1]: > FDM can boost all your downloads up to 10 times, process media files of various popular formats, drag&drop URLs right from a web browser as well as simultaneously download multiple files! No, I still don't a clue what it actually does that the OS and existing tools can't. It sounds like those scam "RAM doubler" programs from the 90s. Run this executable to boost your system's chakras . 1: htt…
Sounds like, er, download managers from the 90's a la https://getright.com/
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#50This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…
Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo