Free Download Manager backdoored – a possible supply chain attack on Linux

Post by marcus_holmes » Wed, Sep 13, 2023, 1:48 AM UTC

baz00 wrote: post #39

acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

Basically, as per everything these days, the entire software industry is based on "download and run any old shit off the Internet" with little to no fucks given about the source or trustworthyness or correctness. End users are no better because for most people, including a lot of novice Linux users, this isn't even considered as part of fixing or dealing with any particular problem. Cut / paste / job done. Worst is I…

Post by RulerOf » Wed, Sep 13, 2023, 1:54 AM UTC

mtillman wrote: post #53

pdntspa wrote: post #50

Earlier quoted context omitted.

Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo

Who is running random curl scripts without checking the code first? Is this common now?

Post by justsomehnguy » Wed, Sep 13, 2023, 2:20 AM UTC

untech wrote: post #80

Why did the authors blanked out “Ukraine” from an (apparent) statement “Glory to Ukraine” in the comments? Seemed weird to me, what’s the point?

Post by thephyber » Wed, Sep 13, 2023, 3:52 AM UTC

RulerOf wrote: post #92

thephyber wrote: post #73

Earlier quoted context omitted.

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another. Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). I actually cons…

>Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a…

Post by rahimnathwani » Wed, Sep 13, 2023, 4:56 AM UTC

hughw wrote: post #78

randombits0 wrote: post #60

A Linux user that would install a Free Download Manager? We need to bring back complicated Linux installation processes. Vendors have dumb down the process to the point that idiots are getting cooties from downloading bullish!t.

A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.