Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free Download Manager backdoored – a possible supply chain attack on Linux

securelist.com

Post reply on HN
Print view View original

71–80 of 143 posts

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#71

Post by mistrial9 »

acatton wrote: post #32
sva_ wrote: post #28

Earlier quoted context omitted.

> This is installed by adding a shady repository to your apt sources.list... How is this possible? Aren't the packages signed like on ArchLinux so that you can use any mirrorlist?

Yes, they are signed, but not with the official key. If you add it through the UI, it will auto-accept the key from the repository. (I'm not sure how it exactly works, it might ask the user for the confirmation) If you do it from the command line, by editing files, you will have to add the key manually. But most inexperienced users will just copy/paste and run the "curl | sudo apt-key add" command from the shady repo…

"people who walk on the sidewalk often cross the street in front of traffic THEREFORE walking on the street is just like walking in front of traffic"

maybe you intend to deeply explore the behavior of "the most inexperienced" as if it is Typical of Desktop Linux admins?

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#72

Post by mulmen »

failuser wrote: post #65
mulmen wrote: post #41

Earlier quoted context omitted.

Yeah who would ever trust a free BSD?

That’s right, security-minded people trust OpenBSD instead.

And Open File Manager!

The point here is it’s actually really hard to identify scammy software by name. It only seems that way with extensive domain knowledge. As adoption of Linux continues to grow more people will be duped.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#73

Post by thephyber »

baz00 wrote: post #39
acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another.

Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive).

I actually considered first steps in making a business out of this idea, but I’m convinced that every developer overestimates their ability to identify untrustworthy repos/packages and companies aren’t willing to pay the actual cost (with either subscription dollars or in the friction it would add to reject almost all 3rd party code because it doesn’t meet high standards of quality and security in a transparent and verifiable way).

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#74

Post by cosmojg »

acatton wrote: post #34
sudobash1 wrote: post #31

Earlier quoted context omitted.

This is more like using AUR (except the packages are prebuilt with no way to inspect source). They are entirely user submitted.

No. This is not AUR, this is an entire third party repository. It would be the equivalent of these https://wiki.archlinux.org/title/Unofficial_user_repositorie...

If you run Arch, I highly recommend checking out ALHP and chaotic-aur.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#75

Post by mistrial9 »

knappe wrote: post #52
acatton wrote: post #26

Earlier quoted context omitted.

I disagree. This is more another reason to not run programs which are not from the official repository.

Even packages from the official repos can not be safe. https://www.debian.org/security/2008/dsa-1571 I would just like to remind everyone to be cautious, in general. This bug was in the openssl package, and as a consequence was creating incredibly weak keys, for around 2 years before being discovered in what is arguably one of the most critical pieces of software for the OS.

one hundred and sixty thousand signed packages with ten+ years of history and of course, one bad one means the system is "weak"

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#76

Post by Nursie »

acatton wrote: post #42
baz00 wrote: post #39

Earlier quoted context omitted.

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…

It doesn't have to be. Corporations which are FedRAMP[1] compliant, have to build software reproducibly in a fully isolated environment, only from reviewed code.[2] [1] https://en.wikipedia.org/wiki/FedRAMP [2] https://slsa.dev/

Ah, I remember when we all did that. It was just part of basic due diligence - pull all your dependencies into your own build system, review and check compatibility, then build completely locally.

Of course a lot of what we built wasn’t public facing or exposed to the internet at all, so addressing the latest vulnerabilities in record time wasn’t quite as important as known-good builds.

I’ve worked in one or two places recently (big bank) that are large enough to have their own internal repo systems and teams of security/compliance reviewers. Their versions of things can be a bit behind but are at least under control of the same org. Everywhere else, well, it feels a bit like cowboy country…

(edit - the other trade-off was of course that you wrote a lot more of everything yourself, rather than pulling in whatever you felt like. This slows down the development cycle significantly but it does mean people had a greater understanding of everything in their stack, and products were often more lean as a result.)

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#77

Post by rangerelf »

zx8080 wrote: post #63
mtillman wrote: post #53

Earlier quoted context omitted.

Who is running random curl scripts without checking the code first? Is this common now?

Quite so. A quick example from k3s installation page ( https://docs.k3s.io/quick-start ): ``` curl -sfL https://get.k3s.io | sh - ```

It bugs me to no end that they (those that give those instructions) are normalizing this.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#78

Post by hughw »

randombits0 wrote: post #60

A Linux user that would install a Free Download Manager? We need to bring back complicated Linux installation processes. Vendors have dumb down the process to the point that idiots are getting cooties from downloading bullish!t.

A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#79

Post by dotty- »

acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

> How is this a supply chain attack?

It's a supply-chain attack because the article has a section about how the official website for "Free Download Manager" was serving malware to a percentage of people.

> While checking videos on Free Download Manager that are hosted on YouTube, we identified several tutorials demonstrating how to install this software on Linux machines. We observed the following actions that happen in all these videos:

> - The video makers opened the legitimate website of Free Download Manager (freedownloadmanager[.]org) in the browser;

> - They afterwards clicked on the Download button for the Linux version of the software;

> - They were redirected to the malicious https://deb.fdmpkg[.]org/freedownloadmanager.deb URL that hosts the infected version of Free Download Manager.

Post reply on HN