Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free Download Manager backdoored – a possible supply chain attack on Linux

securelist.com

Post reply on HN
Print view View original

101–110 of 143 posts

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#101

Post by Nursie »

dotty- wrote: post #79
acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

> How is this a supply chain attack? It's a supply-chain attack because the article has a section about how the official website for "Free Download Manager" was serving malware to a percentage of people. > While checking videos on Free Download Manager that are hosted on YouTube, we identified several tutorials demonstrating how to install this software on Linux machines. We observed the following actions that happen…

It's a supply-chain attack on Free Download Manager, rather than on linux itself. The truncated HN headline makes this seem like it's a general linux problem.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#102

Post by untech »

thenickdude wrote: post #83
untech wrote: post #80

Why did the authors blanked out “Ukraine” from an (apparent) statement “Glory to Ukraine” in the comments? Seemed weird to me, what’s the point?

"securelist by Kaspersky", they are Russian.

Wow. Given that Kaspersky leaders are very non-neutral, it makes these comments even fishier, because they look like a clumsy attempt to implicate Ukrainians in an attack.

(Clumsy because, firstly, source code comments is a very strange place to write “Glory to Ukraine”, and secondly, because the whole section is written in Russian, except for the word “thanks”)

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#103

Post by jtvjan »

If you're curious what it says, I put the Russian text in a translator:

  > glory to Ukraine!
  > rel 20200126 15:15
  > rel 20200126 15:46 added ubuntu 19.10 【thanks russkis】
  > rel 20200127 02:46 removed upx,  crashes often, unpacked version only now
The bracketed text is written in Ukrainian

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#105

Post by archi42 »

postmodest wrote: post #30
blackhaz wrote: post #13

Earlier quoted context omitted.

Happy FileZilla user here, on my FreeBSD laptop. I move tons of files from remote astronomical observatory routinely, sometimes need to define custom rules - what to download, upload, filter across folders, etc. Sometimes I need to push a file from very low data-rate link from somewhere in the middle of nowhere to the observatory, sometimes over a satellite link. Sometimes I want a throttled download of a large queue…

R sync has a --bwlimit option. But I suppose you're probably talking about devices that only know about internet protocols before 1991....

And curl has --limit-rate and supports more protocols. But so what? If they are happy using FileZilla and it helps them getting stuff done, why berate them? It's not even like they're abusing a tool in an entirely unintended way, quite the opposite.

I'm saying this as a shell-user.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#106

Post by NicuCalcea »

jtvjan wrote: post #103

If you're curious what it says, I put the Russian text in a translator: > glory to Ukraine! > rel 20200126 15:15 > rel 20200126 15:46 added ubuntu 19.10 【thanks russkis】 > rel 20200127 02:46 removed upx, crashes often, unpacked version only now The bracketed text is written in Ukrainian

Interesting that the built-in macOS OCR reads the first line as "слава нации" (glory to the nation).

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#107

Post by rollcat »

failuser wrote: post #65
mulmen wrote: post #41

Earlier quoted context omitted.

Yeah who would ever trust a free BSD?

That’s right, security-minded people trust OpenBSD instead.

...which conveniently routinely breaks binaries between stable releases ;)

(Obviously joking, nothing but love for OpenBSD.)

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#108

Post by firen777 »

untech wrote: post #102
thenickdude wrote: post #83

Earlier quoted context omitted.

"securelist by Kaspersky", they are Russian.

Wow. Given that Kaspersky leaders are very non-neutral, it makes these comments even fishier, because they look like a clumsy attempt to implicate Ukrainians in an attack. (Clumsy because, firstly, source code comments is a very strange place to write “Glory to Ukraine”, and secondly, because the whole section is written in Russian, except for the word “thanks”)

A year or so ago I would say this is way too petty to the point of incompetence for them to do this.

Knowing how the country actually functions since the invasion, I wouldn't rule this out at all.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#109

Post by nprateem »

RulerOf wrote: post #92
thephyber wrote: post #73

Earlier quoted context omitted.

Other than reputation analysis by Snyk, I honestly don’t know how to objectively analyze one repo/package versus another. Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). I actually cons…

>Obviously I can make some basic heuristics, but I can’t reasonably evaluate all of the components of trust for every library, package, container, framework, repo even at a regular interval, let alone fast enough to just maintain patch levels (nevermind being reasonably productive). Related: have you tried throwing a file (or a hash) at VirusTotal lately? If it's executable, they'll run it in a sandbox and give you a…

Reviewing code is an insurmountable task if you're using more than a few very simple packages.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#110

Post by ndsipa_pomu »

rahimnathwani wrote: post #99
hughw wrote: post #78

Earlier quoted context omitted.

A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.

Years ago, I asked data scientist (with a PhD) whether his jupyter notebooks were only on his laptop or whether they were backed up on a server. He said they were on a server. I wanted to make sure whatever server that was had regular backups, so I asked for the server name. He looked at the URL bar and gave me the server's IP address: 127.0.0.1

What a coincidence, that's where I store my backups too.
Post reply on HN