The scary part is how easily malicious repos can blend in with legitimate open-source projects
I found 10k GitHub repositories distributing Trojan malware
181–190 of 268 posts
Re: I found 10k GitHub repositories distributing Trojan malware
#182> Why do they delete a commit and push a new one every few hours?
Maybe they want to get into "trending" section, or to have higher position in search results (maybe Github or Google prioritizes repositories updated recently)?
Re: I found 10k GitHub repositories distributing Trojan malware
#183> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…
Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.
Re: I found 10k GitHub repositories distributing Trojan malware
#184This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root issue.
And Linux has no warning and no button to check the program with antivirus before running. How worse could it be?
In comparison, on Android and iOS there are sandboxes, and you can run any program relatively safely as long as you don't grant dangerous permissions and your kernel is not outdated. And even if you grant permissions, the malware still won't be able to read your browser cookies or the messages in your Matrix client.
Linux needs to be better that this. Linux seems to be built on presumption that you either download the code from official repository you trust, or write your own, and doesn't support safe execution of third-party or closed-source programs. For example, if you run proprietary software, it might scan through your data, silently collect your hardware identifiers (like motherboard serial number) to better track and identify you and Linux does not prevent this.
Re: I found 10k GitHub repositories distributing Trojan malware
#185> Why do they only clone new repositories, rather than popular ones? > Why do they delete a commit and push a new one every few hours? Because this is not targetted to humans. It's targetted to agents. They just need to appear on a fraction of the searches agents do to add dependencies and get lucky a couple times to start a new infection cluster. Then to the more interesting question: why now? 1. Agents, agents ever…
Political manipulation is a problem, but I don't think it's nearly as profitable as pushing scams and gambling.
I suspect that politicians right before elections may pay more than standard gambling. They gamble with much higher stakes.
Re: I found 10k GitHub repositories distributing Trojan malware
#186This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…
You can use VMs for sandboxes.
Linux main feature is that you are free to do anything you want.
Linux does verify signatures for packages from official repos.
Linux has features like SELinux and AppArmor.
If you want to install a random package, you are free to do and its your responsibility. Equivalent is side loading in android.
On iOS Apple doesn't even let you have full Firefox... That is wrong. And yet, there have always been exploits.
Re: I found 10k GitHub repositories distributing Trojan malware
#187This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…
> as long as you don't grant dangerous permissions and your kernel is not outdated
There's like 2 or maybe 3 phone models in the world without an outdated kernel in Android.
And then sure, Android and iOS sandboxing is better but in the same time, the quality of the apps and the vetting is 100x worse than your average Linux distribution so I'm not sure that makes up the difference.
Re: I found 10k GitHub repositories distributing Trojan malware
#188This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…
I do not want my OS to tell me what i can and cannot do on the computer I bought, its as simple as that
Re: I found 10k GitHub repositories distributing Trojan malware
#189Being reminded of this anecdote from NYMag's recent cover story (which had previously been reported in a WSJ story[0]) about a Disney engineer who downloaded an AI-gen tool from Github and "checked the code himself, it had looked legitimate": https://archive.is/yAUNy > He had no idea why the hackers had targeted him or what their plan was, whether they would drain his family’s finances or stalk his home. Eventually,…
A password manager is a single point of failure and should be avoided. I've heard other sad stories about someone who's pw manager was compromised and they lost everything.
True for KeyPass or 1Password, but not for GNU pass.
Re: I found 10k GitHub repositories distributing Trojan malware
#190This highlights the problem with legacy desktop OSes like Windows, Linux and MacOS: they allow a random program from Internet to get full access to the computer. Windows and Mac display a warning that the program might be malicious, but how is the user supposed to check it? Do Windows and MacOS developers expect every user to disassemble the program? That's just shifting responsibility instead of solving the root iss…
I do not want my OS to tell me what i can and cannot do on the computer I bought, its as simple as that
I did not suggest that; what I suggested was that the programs should run in sandboxes.