But I thought there were no viruses or malware on Linux! For example: https://www.howtogeek.com/135392/htg-explains-why-you-dont-n...
A typical Linux install is actually less secure than Windows nowadays, which in turn is less secure than macOS.
Free Download Manager backdoored – a possible supply chain attack on Linux
121–130 of 143 posts
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#122This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…
>This is installed by adding a shady repository to your apt sources.list...
In the article they show a video which shows the user downloading FDM from the official website, and the file coming from that repo.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#123Earlier quoted context omitted.
Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo
I never understand why people get more upset about the bash script running arbitrary code than the program it's actually installing.
It’s not that the bash script is worse than the installed program. The problem is that the bash script risks installing a malicious program.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#124Earlier quoted context omitted.
People who are still on dialup modems or very slow wireless ISPs with flaky connections. High Speed Internet is not universal even today, despite what web developers seem to think. Ever try to surf raw Facebook on a 128kbps wireless link? It's not fun. Cloud services are a joke for these people. Hacker News is one of the last holdouts in the low bandwidth friendly website game.
A decade ago, I remember buying 500MB or 1GB of mobile internet credit and burning through that in an evening just reading news and stuff. Today, with uBlock Origin and NoScript, I can buy the same amount of mobile internet and it lasts me quite a while. I therefore concluded that, while website bloat does exist, what really consumes bandwidth is advertising, and that can be avoided. Moreover, a decade ago lazy loadi…
For news I just head to gopher://magical.fish (the news section) and gopher://gopherddit.com under Lynx and the data usage gets down fast.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#125But I thought there were no viruses or malware on Linux! For example: https://www.howtogeek.com/135392/htg-explains-why-you-dont-n...
A typical Linux install is actually less secure than Windows nowadays, which in turn is less secure than macOS.
Yeah, sure, until you open your browser and start installing all the crap like crazy. Because even 'legitimate' software can give you nasty adware today in software installers. And lots of adware isn't tagged as malware.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#126Earlier quoted context omitted.
Oftentimes the installer needs greater system access than the code you're running, particularly on Windows IME most of the randomly-downloaded software I've used does what it says on the tin. But there is a whole screening process: where did it come from? Does the originating site look legit? What are the possible motivations for the creator? Besides there is no signing mechanism for your random install.sh. Maybe you…
Aren't the most interesting things to steal already in the user's home folder, so having admin rights won't really give you that much more.
Depends on the malware. Not all of them aim to steal, some may want to turn your PC into a botnet node, or a remote proxy for illegal activities.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#127Earlier quoted context omitted.
Because the official repository has a strict vetting process. You cannot just show up and put your shaddy software in the official repository. Debian packagers have a mutual trust process which you need to gain. Only trusted Debian packagers can approve packages to be included. Also some Debian maintainers will just randomly check packages from time to time. (e.g. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792…
But Debian packagers aren't always super careful. They generally don't audit the full changeset between each version they package and publish. They mostly trust that upstream has not been compromised and continues to be trustworthy. I'm not trying to minimize all the hard work Debian (or any other distro) packagers do, but "only use official repositories" is not sufficient as a malware-avoidance strategy. Yes, it's b…
its obviously not a 100% garantuee, but its about as good as anyone can reasonably do
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#128Earlier quoted context omitted.
A typical Linux install is actually less secure than Windows nowadays, which in turn is less secure than macOS.
Yeah, sure, until you open your browser and start installing all the crap like crazy. Because even 'legitimate' software can give you nasty adware today in software installers. And lots of adware isn't tagged as malware.
Both Windows and macOS have binary whitelisting in place making it harder to run arbitrary binaries that aren't known good to the OS vendor. Pain in the ass sometimes because Windows Defender quarantines executables and DLLs I freshly compiled, and you have to do command line magic -- after every update -- to get unsigned stuff past Gatekeeper and Xprotect, but in terms of endpoint security for normies both Windows and macOS are way ahead of Linux.
Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#129Re: Free Download Manager backdoored – a possible supply chain attack on Linux
#130This is one more reason to run every program in a sandbox rather than with full privileges.
This is a download manager. By definition it will have access to the internet, will write files to disk, and you will open the files it wrote. A sandbox wouldn't keep you safe if you have to keep those vectors open.
A download manager doesn't need to access your .ssh directory, your browser cookies, get your motherboard serial number, query a list of nearby WiFi points and so on. But in Linux all of these is accessible to any program by default.
> and you will open the files it wrote.
Open in a sandbox? Why not.