Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Free Download Manager backdoored – a possible supply chain attack on Linux

securelist.com

Post reply on HN
Print view View original

131–140 of 143 posts

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#131

Post by codedokode »

Obscurity4340 wrote: post #24
codedokode wrote: post #16

This is one more reason to run every program in a sandbox rather than with full privileges.

Should people reflexively refuse prompts to authenticate as admin and see if the underlying programs still work as expected? This comes up all the time for Macs and the keychain

Instead of "authenticate as admin" the prompt should contains specific privileges required by a program, for example:

- read .ssh directory

- write to .ssh directory

- read motherboard serial number

And so on. Accessing the keychain should require confirmation if one program wants to read other program's secrets. If it wants only its own secrets, then no prompt needed.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#132

Post by CoolCold »

mtillman wrote: post #53
pdntspa wrote: post #50

Earlier quoted context omitted.

Or all those `curl install.sh | bash -` scripts that nobody checks that could do pretty much anything, esp when they ask you to sudo

Who is running random curl scripts without checking the code first? Is this common now?

My own estimations and observations say - 80% of programmers do. It's called "great DX" nowadays

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#133

Post by CoolCold »

hughw wrote: post #78
randombits0 wrote: post #60

A Linux user that would install a Free Download Manager? We need to bring back complicated Linux installation processes. Vendors have dumb down the process to the point that idiots are getting cooties from downloading bullish!t.

A few years ago I asked a new hire to ssh to a certain machine from their new dev Linux laptop, and they said OK and began searching the web for PuTTY for Linux. Didn't work out with them.

Putty for Linux exists and even works to my knowledge, so had chances for success ;)

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#134

Post by anthk »

bitwize wrote: post #128
anthk wrote: post #125

Earlier quoted context omitted.

Yeah, sure, until you open your browser and start installing all the crap like crazy. Because even 'legitimate' software can give you nasty adware today in software installers. And lots of adware isn't tagged as malware.

Both Windows and macOS have binary whitelisting in place making it harder to run arbitrary binaries that aren't known good to the OS vendor. Pain in the ass sometimes because Windows Defender quarantines executables and DLLs I freshly compiled, and you have to do command line magic -- after every update -- to get unsigned stuff past Gatekeeper and Xprotect, but in terms of endpoint security for normies both Windows a…

I repeat: a lot of installers from good companies bundle adware which might not be malware but turns your i5 machine into a Pentium II, which in the end it's the same.

Re: Free Download Manager backdoored – a possible supply chain attack on Linux

#138

Post by FDM_Team »

acatton wrote: post #22

This is installed by adding a shady repository to your apt sources.list... How is this a supply chain attack? My official debian repository have never been breached so far. This is no different from downloading an .exe off a shady website and blindly running the .exe. Also: https://packages.debian.org/search?keywords=download+manager... lists: • uget: https://sourceforge.net/projects/urlget/ • kget: https://apps.kde.…

[dead]
Post reply on HN